Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2016-1245

Published: 18 October 2016

It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be compatible with a message size; however, BUFSIZ is system-dependent.

Priority

Medium

CVSS 3 base score: 9.8

Status

Package Release Status
quagga
Launchpad, Ubuntu, Debian
upstream Needs triage

precise
Released (0.99.20.1-0ubuntu0.12.04.6)
trusty Does not exist
(trusty was released [0.99.22.4-3ubuntu1.3])
xenial
Released (0.99.24.1-2ubuntu1.2)
yakkety
Released (1.0.20160315-2ubuntu0.1)
Patches:
upstream: https://github.com/Quagga/quagga/commit/cfb1fae25f8c092e0d17073eaf7bd428ce1cd546
This vulnerability is mitigated in part by the use of gcc's stack protector in Ubuntu.