Filtered by vendor Quagga Subscriptions
Total 36 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-2342 3 Debian, Quagga, Redhat 3 Debian Linux, Quagga, Enterprise Linux 2025-04-12 N/A
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.
CVE-2016-4049 3 Opensuse, Quagga, Redhat 4 Leap, Opensuse, Quagga and 1 more 2025-04-12 N/A
The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.
CVE-2012-0250 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a network-LSA link-state advertisement for which the data-structure length is smaller than the value in the Length header field.
CVE-2012-0255 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number Capability (aka AS4 capability).
CVE-2011-3324 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
The ospf6_lsa_is_changed function in ospf6_lsa.c in the OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via trailing zero values in the Link State Advertisement (LSA) header list of an IPv6 Database Description message.
CVE-2011-3326 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
The ospf_flood function in ospf_flood.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link State Update message.
CVE-2010-2949 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
bgpd in Quagga before 0.99.17 does not properly parse AS paths, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unknown AS type in an AS path attribute in a BGP UPDATE message.
CVE-2010-1674 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
The extended-community parser in bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed Extended Communities attribute.
CVE-2013-6051 1 Quagga 1 Quagga 2025-04-11 N/A
The bgp_attr_unknown function in bgp_attr.c in Quagga 0.99.21 does not properly initialize the total variable, which allows remote attackers to cause a denial of service (bgpd crash) via a crafted BGP update.
CVE-2012-1820 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message.
CVE-2013-2236 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
Stack-based buffer overflow in the new_msg_lsa_change_notify function in the OSPFD API (ospf_api.c) in Quagga before 0.99.22.2, when --enable-opaque-lsa and the -a command line option are used, allows remote attackers to cause a denial of service (crash) via a large LSA.
CVE-2011-3323 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
The OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (out-of-bounds memory access and daemon crash) via a Link State Update message with an invalid IPv6 prefix length.
CVE-2011-3325 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
ospf_packet.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) via (1) a 0x0a type field in an IPv4 packet header or (2) a truncated IPv4 Hello packet.
CVE-2011-3327 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
Heap-based buffer overflow in the ecommunity_ecom2str function in bgp_ecommunity.c in bgpd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by sending a crafted BGP UPDATE message over IPv4.
CVE-2012-0249 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified in its header.
CVE-2010-1675 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (session reset) via a malformed AS_PATHLIMIT path attribute.
CVE-2010-2948 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-11 N/A
Stack-based buffer overflow in the bgp_route_refresh_receive function in bgp_packet.c in bgpd in Quagga before 0.99.17 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a malformed Outbound Route Filtering (ORF) record in a BGP ROUTE-REFRESH (RR) message.
CVE-2007-4826 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-09 N/A
bgpd in Quagga before 0.99.9 allows explicitly configured BGP peers to cause a denial of service (crash) via a malformed (1) OPEN message or (2) a COMMUNITY attribute, which triggers a NULL pointer dereference. NOTE: vector 2 only exists when debugging is enabled.
CVE-2007-1995 2 Quagga, Redhat 2 Quagga, Enterprise Linux 2025-04-09 N/A
bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.
CVE-2009-1572 1 Quagga 1 Quagga 2025-04-09 N/A
The BGP daemon (bgpd) in Quagga 0.99.11 and earlier allows remote attackers to cause a denial of service (crash) via an AS path containing ASN elements whose string representation is longer than expected, which triggers an assert error.