GCVE - cpe:2.3:a:quagga:bgpd:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:quagga:bgpd:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Quagga (`462351d8-ef9e-52e9-b528-53d0abcd56ca`)
Product	Bgpd (`4c0778ac-51e1-5422-8c4b-cc6edd7a0683`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-5381`	vulnerable	2026-06-08 05:11:50.700432	Details available MEDIUM (6.5) The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service. Published: 2018-02-19T13:00:00.000Z Updated: 2024-09-16T16:17:27.709Z Open on db.gcve.eu Reference links https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-1975.txt https://usn.ubuntu.com/3573-1/ https://www.debian.org/security/2018/dsa-4115 http://savannah.nongnu.org/forum/forum.php?forum_id=9095 https://security.gentoo.org/glsa/201804-17	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-5380`	vulnerable	2026-06-08 05:11:50.699417	Details available MEDIUM (4.3) The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input. Published: 2018-02-19T13:00:00.000Z Updated: 2024-09-17T01:05:46.243Z Open on db.gcve.eu Reference links https://usn.ubuntu.com/3573-1/ https://www.debian.org/security/2018/dsa-4115 http://savannah.nongnu.org/forum/forum.php?forum_id=9095 https://security.gentoo.org/glsa/201804-17 https://lists.debian.org/debian-lts-announce/2018/02/msg00021.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-5379`	vulnerable	2026-06-08 05:11:50.690804	Details available HIGH (7.5) The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code. Published: 2018-02-19T13:00:00.000Z Updated: 2024-09-17T03:22:36.451Z Open on db.gcve.eu Reference links https://usn.ubuntu.com/3573-1/ https://www.debian.org/security/2018/dsa-4115 http://www.securityfocus.com/bid/103105 http://savannah.nongnu.org/forum/forum.php?forum_id=9095 https://security.gentoo.org/glsa/201804-17	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-5378`	vulnerable	2026-06-08 05:11:50.688716	Details available HIGH (7.1) The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash. Published: 2018-02-19T13:00:00.000Z Updated: 2024-09-16T20:16:44.677Z Open on db.gcve.eu Reference links https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-0543.txt https://usn.ubuntu.com/3573-1/ https://www.debian.org/security/2018/dsa-4115 http://savannah.nongnu.org/forum/forum.php?forum_id=9095 https://security.gentoo.org/glsa/201804-17	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.