Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
USN-3573-1 (UBUNTU-CVE-2018-5378)
Vulnerability from osv_ubuntu – Published: 2018-02-16 00:32 – Updated: 2026-02-10 04:41 – Source website
VLAI
Summary
quagga vulnerabilities
Details
It was discovered that a double-free vulnerability existed in the Quagga BGP daemon when processing certain forms of UPDATE message. A remote attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2018-5379)
It was discovered that the Quagga BGP daemon did not properly bounds check the data sent with a NOTIFY to a peer. An attacker could use this to expose sensitive information or possibly cause a denial of service. This issue only affected Ubuntu 17.10. (CVE-2018-5378)
It was discovered that a table overrun vulnerability existed in the Quagga BGP daemon. An attacker in control of a configured peer could use this to possibly expose sensitive information or possibly cause a denial of service. (CVE-2018-5380)
It was discovered that the Quagga BGP daemon in some configurations did not properly handle invalid OPEN messages. An attacker in control of a configured peer could use this to cause a denial of service (infinite loop). (CVE-2018-5381)
References
{
"affected": [
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2018-5379",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-5380",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-5381",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:14.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "quagga",
"binary_version": "0.99.22.4-3ubuntu1.5"
}
]
},
"package": {
"ecosystem": "Ubuntu:14.04:LTS",
"name": "quagga",
"purl": "pkg:deb/ubuntu/quagga@0.99.22.4-3ubuntu1.5?arch=source\u0026distro=trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.99.22.4-3ubuntu1.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.99.22.1-2",
"0.99.22.4-1",
"0.99.22.4-2",
"0.99.22.4-3",
"0.99.22.4-3ubuntu1",
"0.99.22.4-3ubuntu1.1",
"0.99.22.4-3ubuntu1.2",
"0.99.22.4-3ubuntu1.3",
"0.99.22.4-3ubuntu1.4"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2018-5379",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-5380",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "low",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2018-5381",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:16.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "quagga",
"binary_version": "0.99.24.1-2ubuntu1.4"
}
]
},
"package": {
"ecosystem": "Ubuntu:16.04:LTS",
"name": "quagga",
"purl": "pkg:deb/ubuntu/quagga@0.99.24.1-2ubuntu1.4?arch=source\u0026distro=xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.99.24.1-2ubuntu1.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.99.24.1-2",
"0.99.24.1-2ubuntu1",
"0.99.24.1-2ubuntu1.1",
"0.99.24.1-2ubuntu1.2",
"0.99.24.1-2ubuntu1.3"
]
}
],
"aliases": [],
"details": "It was discovered that a double-free vulnerability existed in the\nQuagga BGP daemon when processing certain forms of UPDATE message.\nA remote attacker could use this to cause a denial of service or\npossibly execute arbitrary code. (CVE-2018-5379)\n\nIt was discovered that the Quagga BGP daemon did not properly bounds\ncheck the data sent with a NOTIFY to a peer. An attacker could use this\nto expose sensitive information or possibly cause a denial of service.\nThis issue only affected Ubuntu 17.10. (CVE-2018-5378)\n\nIt was discovered that a table overrun vulnerability existed in the\nQuagga BGP daemon. An attacker in control of a configured peer could\nuse this to possibly expose sensitive information or possibly cause\na denial of service. (CVE-2018-5380)\n\nIt was discovered that the Quagga BGP daemon in some configurations\ndid not properly handle invalid OPEN messages. An attacker in control\nof a configured peer could use this to cause a denial of service\n(infinite loop). (CVE-2018-5381)\n",
"id": "USN-3573-1",
"modified": "2026-02-10T04:41:16Z",
"published": "2018-02-16T00:32:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-3573-1"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-5378"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-5379"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-5380"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-5381"
}
],
"related": [],
"schema_version": "1.7.0",
"summary": "quagga vulnerabilities",
"upstream": [
"UBUNTU-CVE-2018-5378",
"UBUNTU-CVE-2018-5379",
"UBUNTU-CVE-2018-5380",
"UBUNTU-CVE-2018-5381"
]
}