The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade quagga | Feb 22, 2018 | Feb 19, 2018 |
| Centos_linux | — | Upgrade quagga-debuginfoUpgrade quagga-contribUpgrade quagga-develUpgrade quagga | Mar 13, 2018 | Feb 19, 2018 |
| Debian | — | Upgrade quagga | Feb 19, 2019 | Feb 19, 2018 |
| Freebsd | — | Upgrade quagga | Dec 10, 2025 | Feb 15, 2018 |
| Gentoo Linux | — | Upgrade net-misc/quagga. | Apr 23, 2018 | Feb 19, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade quagga | Mar 16, 2018 | Feb 19, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade quagga | Mar 16, 2018 | Feb 19, 2018 |
| Oracle Solaris | — | Upgrade system/network/routing/quagga to version 0.99.19-0.175.3.31.0.3.0 on Solaris 11.3 | Apr 18, 2018 | Feb 19, 2018 |
| Oracle_linux | — | Upgrade quagga-develUpgrade quagga-contribUpgrade quagga | Mar 1, 2018 | Feb 15, 2018 |
| Redhat_linux | — | Upgrade quagga-debuginfoUpgrade quaggaUpgrade quagga-develUpgrade quagga-contribNo solution exists | Mar 1, 2018 | Feb 19, 2018 |
| Suse | — | Upgrade libzebra1Upgrade libospf0Upgrade libquagga_pb0Upgrade quagga-develUpgrade quaggaUpgrade libfpm_pb0Upgrade libospfapiclient0 | Mar 2, 2020 | Feb 16, 2018 |
| Ubuntu | — | Upgrade quagga-bgpdUpgrade quagga | Apr 25, 2018 | Feb 16, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub