CVE-2018-10932

Name	CVE-2018-10932
Description	lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	low
Debian Bugs	905901

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
lldpad (PTS)	stretch	0.9.46-3.1	vulnerable
	buster	1.0.1+git20180808.4e642bd-1	fixed
	bullseye, sid	1.0.1+git20200210.2022b0c-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
lldpad	source	(unstable)	1.0.1+git20180808.4e642bd-1	unimportant		905901

Notes

https://github.com/intel/openlldp/pull/7
https://github.com/intel/openlldp/commit/41feb359a9d0082b0bcf68b1f2b37227f02af4f1
Terminal emulators need to perform proper escaping