Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 36

Export CSV
CVE-2011-3323

(ospf6d): Stack-based buffer overflow while decoding Link State Update packet with malformed Inter Area Prefix LSA

The OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (out-of-bounds memory access and daemon crash) via a Link State Update message with an invalid IPv6 prefix length.

CVSS 2.0 · 5.0 Medium EPSS 4.7% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2011-3324

(ospf6d): Denial of service by decoding malformed Database Description packet headers

The ospf6_lsa_is_changed function in ospf6_lsa.c in the OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via trailing zero values in the Link State Advertisement (LSA) header list of an IPv6 Database Description message.

CVSS 2.0 · 5.0 Medium EPSS 4.7% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2011-3325

(ospfd): Denial of service by decoding too short Hello packet or Hello packet with invalid OSPFv2 header type

ospf_packet.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) via (1) a 0x0a type field in an IPv4 packet header or (2) a truncated IPv4 Hello packet.

CVSS 2.0 · 5.0 Medium EPSS 4.6% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2011-3326

(ospfd): Denial of service by decoding Link State Update LSAs of unknown type

The ospf_flood function in ospf_flood.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link State Update message.

CVSS 2.0 · 5.0 Medium EPSS 4.6% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2011-3327

(bgpd): Heap-based buffer overflow by decoding BGP UPDATE message with unknown AS_PATH attributes

Heap-based buffer overflow in the ecommunity_ecom2str function in bgp_ecommunity.c in bgpd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by sending a crafted BGP UPDATE message over IPv4.

CVSS 2.0 · 7.5 High EPSS 7.6% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2012-0250

(ospfd): Crash by processing LS-Update OSPF packet due improper length check of the Network-LSA structures

Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a network-LSA link-state advertisement for which the data-structure length is smaller than the value in the Length header field.

CVSS 2.0 · 3.3 Low EPSS 1.3% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2012-0255

(bgpd): Assertion failure by processing malformed AS4 capability in BGP OPEN message

The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number Capability (aka AS4 capability).

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2012-1820

(bgpd): Assertion failure by processing BGP OPEN message with malformed ORF capability TLV (VU#962587)

The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message.

CVSS 2.0 · 2.9 Low EPSS 1.0% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2013-2236

Quagga: OSPFD Potential remote code exec (stack based buffer overflow)

Stack-based buffer overflow in the new_msg_lsa_change_notify function in the OSPFD API (ospf_api.c) in Quagga before 0.99.22.2, when --enable-opaque-lsa and the -a command line option are used, allows remote attackers to cause a denial of service (crash) via a large LSA.

CVSS 3.0 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Quagga Redhat
Products
Quagga Enterprise Linux
CVE-2021-44038

quagga: unsafe chown/chmod operations may lead to privileges escalation

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Quagga
Products
Quagga
CVE-2018-5381

quagga: Infinite loop issue triggered by invalid OPEN message allows denial-of-service

The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service.

CVSS 3.0 · 6.5 Medium EPSS 30.2% KEV · Not listed
Vendors
Canonical Debian Quagga and 1 more
Products
Ubuntu Linux Debian Linux Quagga and 2 more
CVE-2018-5380

quagga: bgpd can overrun internal BGP code-to-string conversion tables potentially allowing crash

The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.

CVSS 3.0 · 4.3 Medium EPSS 14.8% KEV · Not listed
Vendors
Canonical Debian Quagga and 1 more
Products
Ubuntu Linux Debian Linux Quagga and 2 more
CVE-2018-5379

quagga: Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to crash or potentially execute arbitrary code

The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.

CVSS 3.0 · 7.5 High EPSS 38.5% KEV · Not listed
Vendors
Canonical Debian Quagga and 2 more
Products
Ubuntu Linux Debian Linux Quagga and 8 more
CVE-2018-5378

quagga: bgpd does not properly bounds check the data sent with a NOTIFY allowing leak of sensitive data or crash

The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.

CVSS 3.0 · 7.1 High EPSS 74.2% KEV · Not listed
Vendors
Canonical Debian Quagga
Products
Ubuntu Linux Debian Linux Quagga
CVE-2017-3224

Open Shortest Path First (OSPF) protocol implementations may improperly determine LSA recency in affected Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages)

Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber. According to RFC 2328 section 13.1, for two instances of the same LSA, recency is determined by first comparing sequence numbers, then checksums, and finally MaxAge. In a case where the sequence numbers are the same, the LSA with the larger checksum is considered more recent, and will not be flushed from the Link State Database (LSDB). Since the RFC does not explicitly state that the values of links carried by a LSA must be the same when prematurely aging a self-originating LSA with MaxSequenceNumber, it is possible in vulnerable OSPF implementations for an attacker to craft a LSA with MaxSequenceNumber and invalid links that will result in a larger checksum and thus a 'newer' LSA that will not be flushed from the LSDB. Propagation of the crafted LSA can result in the erasure or alteration of the routing tables of routers within the routing domain, creating a denial of service condition or the re-routing of traffic on the network. CVE-2017-3224 has been reserved for Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages).

CVSS 3.0 · 8.2 High EPSS 1.1% KEV · Not listed
Vendors
Quagga Redhat Suse
Products
Quagga Package Manager Opensuse and 1 more