An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding option 63" and a denial of service.

An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in frdhcpdecodeoptions()" and a denial of service.

An FR-GV-204 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in frdhcpdecode()" and a denial of service.

An FR-GV-203 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in decodetlv()" and a denial of service.

An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in radcoalesce()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.

Pierre Carrier reported a stack-based buffer overflow flaw in the FreeRADIUS rlmpap module. An authenticated user could trigger this issue by creating a large password, causing FreeRADIUS to crash. The stack protector and SSP variable re-ordering protections should help prevent this issue from being used to execute arbitrary code.

Upstream fixes: 2.x: https://github.com/FreeRADIUS/freeradius-server/commit/0d606cfc29a 3.x: https://github.com/FreeRADIUS/freeradius-server/commit/ff5147c9e5088c7 master: https://github.com/FreeRADIUS/freeradius-server/commit/f610864d4c8f51d

References: http://lists.freebsd.org/pipermail/freebsd-bugbusters/2014-February/000610.html

modules/rlmunix/rlmunix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.