Hello,

A security issue has been found [0] in wpa_supplicant / hostapd allowing local privilege escalation. While a new version has not been made available yet, patches from the main developer are available [1][2][3][4][5] and have been commited to git [6]. It would be nice if we could backport them.

Thanks!

[0]: https://w1.fi/security/2016-1/psk-parameter-config-update.txt
[1]: https://w1.fi/security/2016-1/0001-WPS-Reject-a-Credential-with-invalid-passphrase.patch
[2]: https://w1.fi/security/2016-1/0002-Reject-psk-parameter-set-with-invalid-passphrase-cha.patch
[3]: https://w1.fi/security/2016-1/0003-Remove-newlines-from-wpa_supplicant-config-network-o.patch
[4]: https://w1.fi/security/2016-1/0004-Reject-SET_CRED-commands-with-newline-characters-in-.patch
|5]: https://w1.fi/security/2016-1/0005-Reject-SET-commands-with-newline-characters-in-the-s.patch
[6]: https://w1.fi/cgit/hostap/log/