The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade quagga | Aug 30, 2017 | Mar 17, 2016 |
| Centos_linux | — | Upgrade quagga-debuginfoUpgrade quaggaUpgrade quagga-contribUpgrade quagga-devel | Aug 28, 2019 | Mar 17, 2016 |
| Debian | — | Upgrade quagga | Mar 28, 2016 | Mar 17, 2016 |
| Freebsd | — | Upgrade quagga | Dec 10, 2025 | Mar 10, 2016 |
| Gentoo Linux | — | Upgrade net-misc/quagga. | Oct 30, 2017 | Mar 17, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade quagga | Dec 4, 2019 | Mar 17, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade quagga | Dec 18, 2019 | Mar 17, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade quagga | Feb 3, 2021 | Mar 17, 2016 |
| Oracle Solaris | — | Upgrade system/network/routing/quagga to version 0.99.19-0.175.3.8.0.3.0 on Solaris 11.3 | May 29, 2017 | Mar 17, 2016 |
| Oracle_linux | — | Upgrade quagga-develUpgrade quagga-contribUpgrade quagga | Mar 28, 2017 | Mar 9, 2016 |
| Redhat_linux | — | Upgrade quagga-contribUpgrade quagga-develNo solution existsUpgrade quagga-debuginfoUpgrade quagga | Mar 26, 2017 | Mar 17, 2016 |
| Suse | — | Upgrade libospf0Upgrade libzebra1Upgrade quagga-develUpgrade quaggaUpgrade libfpm_pb0Upgrade libquagga_pb0Upgrade libospfapiclient0 | Mar 28, 2016 | Mar 17, 2016 |
| Ubuntu | — | Upgrade quagga | Mar 28, 2016 | Mar 17, 2016 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub