CVE-2007-5365: Debian Linux

High severity, CVSS 7.2. EPSS: 80.3% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.

Affected products

• Debian Debian Linux: version 3.1 only; version 4.0 only
• OpenBSD OpenBSD: version 4.0 only; version 4.1 only; version 4.2 only
• Red Hat Enterprise Linux: version 2.1 only
• Red Hat Linux Advanced Workstation: version 2.1 only
• Sun Opensolaris: version snv_01 only; version snv_02 only; version snv_03 only; version snv_04 only; version snv_05 only; version snv_06 only; …
• Sun Solaris: version 8.0 only; version 9.0 only; version 10.0 only
• Ubuntu Ubuntu Linux: version 6.06 only; version 6.10 only; version 7.04 only; version 7.10 only

Published 2007-10-11. Last modified 2026-06-16.