CVE-2019-16159

Name	CVE-2019-16159
Description	BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message. Sending a shutdown communication with a sufficient message length causes a four-byte overflow to occur while processing the message, where two of the overflow bytes are attacker-controlled and two are fixed.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs	939990, 940522

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
bird (PTS)	buster, buster (security)	1.6.6-1+deb10u1	fixed
	bookworm, sid, bullseye	1.6.8-2.1	fixed
bird2 (PTS)	bullseye	2.0.7-4.1	fixed
	bookworm, sid	2.0.12-7	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
bird	source	jessie	(not affected)
bird	source	stretch	(not affected)
bird	source	buster	1.6.6-1+deb10u1
bird	source	(unstable)	1.6.8-1	939990
bird2	source	(unstable)	2.0.6-1	940522

Notes

[stretch] - bird <not-affected> (Vulnerable code introduced later)
[jessie] - bird <not-affected> (Vulnerable code introduced later)
https://gitlab.labs.nic.cz/labs/bird/commit/1657c41c96b3c07d9265b07dd4912033ead4124b (1.6.x)
https://gitlab.labs.nic.cz/labs/bird/commit/8388f5a7e14108a1458fea35bfbb5a453e2c563c (2.0.x)