Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade isc-dhcp31-clientUpgrade isc-dhcp30-client | Dec 10, 2025 | Jul 15, 2009 |
| Gentoo Linux | — | Upgrade net-misc/dhcp. | Oct 30, 2017 | Jul 14, 2009 |
| Suse | — | Upgrade dhcp-serverUpgrade dhcpUpgrade dhcp-relayUpgrade dhcp-clientUpgrade dhcp-devel | Feb 17, 2015 | Jul 14, 2009 |
| Ubuntu | — | Upgrade dhcp3-clientUpgrade dhcp3-client-udebUpgrade dhcp-client | Nov 8, 2024 | Jul 14, 2009 |
| Vmsa 2009 0014 2 Service Console Update | — | Upgrade VMware ESX 3.5 to build number 199239Upgrade VMware ESX 4.0 to build number 219382Upgrade VMware ESXi 4.0 to build number 208167 | Sep 2, 2010 | Jul 14, 2009 |
| Vmsa 2009 0016 | — | Apply ESXi400-200911201-UG. | Feb 16, 2011 | Jul 14, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub