CVE-2007-5365

CVE-2007-5365 is a high-severity vulnerability in Debian Debian Linux with a CVSS 2.0 base score of 7.2. Its EPSS exploit-prediction score of 80% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-119.

Key facts

• Severity: High (CVSS 2.0 base score 7.2)
• EPSS exploit prediction: 80% (100th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-119
• Affected product: Debian Debian Linux
• Published: 2007-10-11
• Last modified: 2026-06-16

Description

Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.

Frequently asked questions

What is CVE-2007-5365?

Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.

How severe is CVE-2007-5365?

CVE-2007-5365 has a CVSS 2.0 base score of 7.2, rated high severity.

Is CVE-2007-5365 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 80% (100th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-5365?

CVE-2007-5365 primarily affects Debian Debian Linux. In total, 222 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2007-5365?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2007-5365 published?

CVE-2007-5365 was published on 2007-10-11 and last updated on 2026-06-16.

References

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446354
• http://secunia.com/advisories/27160
• http://secunia.com/advisories/27273
• http://secunia.com/advisories/27338
• http://secunia.com/advisories/27350
• http://secunia.com/advisories/32668
• http://securitytracker.com/id?1021157
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-109077-21-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-243806-1
• http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1962
• http://www.debian.org/security/2007/dsa-1388
• http://www.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/dhcpd/options.c
• http://www.openbsd.org/errata40.html#016_dhcpd
• http://www.openbsd.org/errata41.html#010_dhcpd
• http://www.openbsd.org/errata42.html#001_dhcpd
• http://www.redhat.com/support/errata/RHSA-2007-0970.html
• http://www.securityfocus.com/archive/1/482085/100/100/threaded
• http://www.securityfocus.com/archive/1/483230/100/100/threaded
• http://www.securityfocus.com/bid/25984
• http://www.securityfocus.com/bid/32213
• http://www.securitytracker.com/id?1018794
• http://www.ubuntu.com/usn/usn-531-1
• http://www.ubuntu.com/usn/usn-531-2
• http://www.vupen.com/english/advisories/2008/3088
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37045
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5817
• https://www.exploit-db.com/exploits/4601

Affected products (222)

• cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:openbsd:openbsd:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:openbsd:openbsd:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:openbsd:openbsd:4.2:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
• cpe:2.3:o:redhat:linux_advanced_workstation:2.1:*:itanium:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_01:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_01:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_02:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_02:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_03:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_03:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_04:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_04:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_05:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_05:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_06:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_06:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_07:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_07:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_08:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_08:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_09:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_09:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_10:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_10:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_11:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_11:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_12:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_12:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_13:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_13:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_14:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_14:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_15:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_15:*:x86:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_16:*:sparc:*:*:*:*:*
• cpe:2.3:o:sun:opensolaris:snv_16:*:x86:*:*:*:*:*

More vulnerabilities in Debian Debian Linux

• CVE-2025-32433 — Critical (CVSS 10.0): Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and…
• CVE-2025-24201 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in…
• CVE-2024-42472 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious…
• CVE-2023-46604 — Critical (CVSS 10.0): The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote…
• CVE-2022-30123 — Critical (CVSS 10.0): A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell…
• CVE-2022-24884 — Critical (CVSS 10.0): ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()`…

All CVEs affecting Debian Debian Linux →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

• CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
• CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
• CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
• CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →