Red Hat Security Advisory: quagga security and bug fix update

Fixed packages 8

Vulnerabilities 5

• Unscored —
  CVE-2013-2236

  Stack-based buffer overflow in the new_msg_lsa_change_notify function in the OSPFD API (ospf_api.c) in Quagga before 0.…

  Oct 24, 2013
• Unscored —
  CVE-2016-1245

  It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when …

  quagga Ubuntu
  Feb 22, 2017
• Unscored —
  CVE-2016-2342 EPSS 13%

  The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when…

  quagga Ubuntu
  Mar 17, 2016
• Unscored —
  CVE-2016-4049

  The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which mi…

  quagga Ubuntu
  May 23, 2016
• Unscored —
  CVE-2017-5495 EPSS 19%

  All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, l…

  quagga quagga Ubuntu Alpine
  Jan 24, 2017

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=674862
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=770731
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=839620
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=842308
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=862826
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=981124
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1316571
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1331372
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1386109
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1416013
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0794.json
• report
  https://access.redhat.com/security/cve/CVE-2013-2236
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-2236
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-2236
• report
  https://access.redhat.com/security/cve/CVE-2016-1245
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-1245
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-1245
• report
  https://access.redhat.com/security/cve/CVE-2016-2342
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-2342
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-2342
• article
  http://mirror.easyname.at/nongnu//quagga/quagga-1.0.20160309.changelog.txt
• report
  https://access.redhat.com/security/cve/CVE-2016-4049
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-4049
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-4049
• article
  http://openwall.com/lists/oss-security/2016/04/27/7
• report
  https://access.redhat.com/security/cve/CVE-2017-5495
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5495
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5495
• article
  https://lists.quagga.net/pipermail/quagga-dev/2017-January/016586.html