CVE-2018-5378

NameCVE-2018-5378
DescriptionThe Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs890563

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
quaggasourcewheezy(not affected)
quaggasourcejessie(not affected)
quaggasourcestretch1.1.1-3+deb9u2
quaggasource(unstable)1.2.4-1890563

Notes

[jessie] - quagga <not-affected> (Vulnerable code not present)
[wheezy] - quagga <not-affected> (Vulnerable code not present)
https://www.quagga.net/security/Quagga-2018-0543.txt
https://git.savannah.gnu.org/cgit/quagga.git/commit/?id=cc2e6770697e343f4af534114ab7e633d5beabec
Search for package or bug name: Reporting problems