Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhclient by sending a response containing a specially constructed options section. Affects ISC DHCP versions 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade dhcp | Aug 22, 2024 | Oct 9, 2019 |
| Amazon Linux Ami 2 | — | Upgrade dhcp-develUpgrade dhcpUpgrade dhcp-commonUpgrade dhcp-libsUpgrade dhcp-debuginfoUpgrade dhclient | Apr 27, 2020 | Oct 9, 2019 |
| Amazon_linux | — | Upgrade dhcp | Mar 2, 2020 | Mar 1, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 9, 2019 |
| Centos_linux | — | Upgrade dhcp-debuginfoUpgrade dhcpUpgrade dhcp-develUpgrade dhcp-commonUpgrade dhclientUpgrade dhcp-libs | Jun 19, 2018 | Mar 1, 2018 |
| Debian | — | Upgrade isc-dhcp | Feb 19, 2019 | Mar 7, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 19, 2018 |
| Freebsd | — | Upgrade isc-dhcp44-serverUpgrade isc-dhcp43-serverUpgrade isc-dhcp44-clientUpgrade isc-dhcp43-client | Dec 10, 2025 | Mar 2, 2018 |
| Gentoo Linux | — | Upgrade net-misc/dhcp. | Apr 9, 2018 | Apr 8, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade dhcp-commonUpgrade dhcp-libsUpgrade dhclientUpgrade dhcp | May 2, 2018 | Feb 28, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade dhcpUpgrade dhcp-commonUpgrade dhclientUpgrade dhcp-libs | May 2, 2018 | Feb 28, 2018 |
| Oracle Solaris | — | Upgrade service/network/dhcp/isc-dhcp to version 4.3.6.1.0-0.175.3.31.0.4.0 on Solaris 11.3 | Apr 18, 2018 | Apr 18, 2018 |
| Oracle_linux | — | Upgrade dhcp-commonUpgrade dhcpUpgrade dhcp-libsUpgrade dhcp-develUpgrade dhclient | Mar 2, 2020 | Feb 28, 2018 |
| Redhat_linux | — | Upgrade dhclientUpgrade dhcpNo solution existsUpgrade dhcp-commonUpgrade dhcp-develUpgrade dhcp-libsUpgrade dhcp-debuginfo | May 1, 2018 | Mar 1, 2018 |
| Suse | — | Upgrade dhcpUpgrade dhcp-relayUpgrade dhcp-clientUpgrade dhcp-serverUpgrade dhcp-devel | Jun 21, 2018 | Mar 1, 2018 |
| Ubuntu | — | Upgrade isc-dhcp-server-ldapUpgrade isc-dhcp-clientUpgrade isc-dhcp-serverUpgrade isc-dhcp-relay | Apr 26, 2018 | Mar 1, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub