Name: CVE-2018-5378: Improper Restriction of Operations within the Bounds of a Memory Buffer
Creator: Rapid7
Published: 2018-02-19T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2018-5378, CWE-119, CVSS 5.9, EPSS 0.742

The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.

CVSS Details

CVSS 3.1 Base Score: 5.9
CVSS 3.0 Base Score: 7.1
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Debian	—	Upgrade quagga	Feb 19, 2019	Feb 19, 2018
Freebsd	—	Upgrade quagga	Dec 10, 2025	Feb 15, 2018
Gentoo Linux	—	Upgrade net-misc/quagga.	Apr 23, 2018	Feb 19, 2018
Oracle Solaris	—	Upgrade system/network/routing/quagga to version 0.99.19-0.175.3.31.0.3.0 on Solaris 11.3	Apr 18, 2018	Feb 19, 2018
Suse	—	Upgrade libospf0Upgrade libzebra1Upgrade quaggaUpgrade libfpm_pb0Upgrade libospfapiclient0Upgrade quagga-develUpgrade libquagga_pb0	Mar 3, 2020	Feb 16, 2018
Ubuntu	—	Upgrade quagga-bgpdUpgrade quagga	Apr 25, 2018	Feb 16, 2018

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence