CVE-2013-2236
Fixed in a distro release EPSS 2%
Stack-based buffer overflow in the new_msg_lsa_change_notify function in the OSPFD API (ospf_api.c) in Quagga before 0.99.22.2, when --enable-opaque-lsa and the -a command line option are used, allows remote attackers to cause a denial of service (crash) via a large LSA.
Products: quagga
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 6.0 | quagga | 0.99.20.1-0+squeeze5 |
| Debian 7 | quagga | 0.99.22.4-1+wheezy1 |
| Red Hat Enterprise Linux 6 | quagga | 0:0.99.15-14.el6 |
| Red Hat Enterprise Linux 6 | quagga-contrib | 0:0.99.15-14.el6 |
| Red Hat Enterprise Linux 6 | quagga-debuginfo | 0:0.99.15-14.el6 |
| Red Hat Enterprise Linux 6 | quagga-devel | 0:0.99.15-14.el6 |
| Ubuntu 14.04 LTS | quagga | 0.99.22.4-3ubuntu1.1 |
| openSUSE Tumbleweed | quagga | 1.0.20160315-5.1 |