CVE-2018-5380

quagga: bgpd can overrun internal BGP code-to-string conversion tables potentially allowing crash

Loading…

Severity

Low

Red Hat Product Security

4.3

CVSS 3.0

Review impact separately from score.

Published · February 15, 2018

Updated · June 30, 2026

Description

A vulnerability was found in Quagga, in the log formatting code. Specially crafted messages sent by BGP peers could cause Quagga to read one element past the end of certain static arrays, causing arbitrary binary data to appear in the logs or potentially, a crash.

Statement

Red Hat Product Security has given this vulnerability a rating of Low. We believe the potential for a crash on supported architectures is very small.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 4.3
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-125 · Out-of-bounds Read