The extended-community parser in bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed Extended Communities attribute.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade quagga-develUpgrade quaggaUpgrade quagga-contrib | Dec 1, 2016 | Mar 29, 2011 |
| Freebsd | — | Upgrade quagga | Dec 10, 2025 | Apr 1, 2011 |
| Gentoo Linux | — | Upgrade net-misc/quagga. | Oct 30, 2017 | Mar 29, 2011 |
| Oracle Solaris | — | Upgrade system/network/routing/quagga to version 0.99.19-0.175.0.4.0.2.0 on Solaris 11.0 | May 29, 2017 | Mar 29, 2011 |
| Oracle_linux | — | Upgrade quaggaUpgrade quagga-develUpgrade quagga-contrib | Oct 16, 2024 | Mar 29, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 21, 2011 |
| Suse | — | Upgrade libospf0Upgrade libfpm_pb0Upgrade libzebra1Upgrade quaggaUpgrade libospfapiclient0Upgrade libquagga_pb0Upgrade quagga-devel | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade quagga | Nov 8, 2024 | Mar 29, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub