CVE-2018-5379

quagga: Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to crash or potentially execute arbitrary code

Loading…

Severity

Important

Red Hat Product Security

8.1

CVSS 3.0

Review impact separately from score.

Published · February 15, 2018

Updated · June 30, 2026

Description

A double-free vulnerability was found in Quagga. A BGP peer could send a specially crafted UPDATE message which would cause allocated blocks of memory to be free()d more than once, potentially leading to a crash or other issues.

Statement

Glibc's heap protection mitigations render this issue more difficult to exploit, though bypasses may still be possible.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 8.1
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-416 · Use After Free