Skip to content
OpenAdvisories
Unscored USN-3102-1 2 CVEs

quagga vulnerabilities

Published Oct 13, 2016 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Quagga incorrectly handled dumping data. A remote
attacker could possibly use a large BGP packet to cause Quagga to crash,
resulting in a denial of service. (CVE-2016-4049)

It was discovered that the Quagga package incorrectly set permissions on
the configuration directory. A local user could use this issue to possibly
obtain sensitive information. (CVE-2016-4036)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS quagga 0.99.22.4-3ubuntu1.2
Ubuntu · 16.04 LTS 16.04:LTS quagga 0.99.24.1-2ubuntu1.1

Vulnerabilities 2

  • Unscored —
    CVE-2016-4036

    The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for …

    quagga Ubuntu
  • Unscored —
    CVE-2016-4049

    The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which mi…

    quagga Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2016-4036
  • report
    https://ubuntu.com/security/CVE-2016-4049