[SECURITY] [DLA 3578-1] lldpd security update

2023-09-2217:10:11

lists.debian.org

remote attack

802.1ab protocol

buster

security update

debian 10

cve-2023-41910

lldpd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.001

Percentile

31.5%

JSON

Debian LTS Advisory DLA-3578-1 [email protected]
https://www.debian.org/lts/security/ Markus Koschany
September 22, 2023 https://wiki.debian.org/LTS

Package : lldpd
Version : 1.0.3-1+deb10u2
CVE ID : CVE-2023-41910

Matteo Memelli discovered a flaw in lldpd, an implementation of the IEEE
802.1ab protocol. By crafting a CDP PDU packet with specific
CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd
daemon to perform an out-of-bounds read on heap memory.

For Debian 10 buster, this problem has been fixed in version
1.0.3-1+deb10u2.

We recommend that you upgrade your lldpd packages.

For the detailed security status of lldpd please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/lldpd

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part

OSVersionArchitecturePackageVersionFilename
Debian12amd64liblldpctl-dev< 1.0.16-1+deb12u1liblldpctl-dev_1.0.16-1+deb12u1_amd64.deb
Debian10i386lldpd< 1.0.3-1+deb10u2lldpd_1.0.3-1+deb10u2_i386.deb
Debian11s390xlldpd< 1.0.11-1+deb11u2lldpd_1.0.11-1+deb11u2_s390x.deb
Debian12armellldpd-dbgsym< 1.0.16-1+deb12u1lldpd-dbgsym_1.0.16-1+deb12u1_armel.deb
Debian12mips64elliblldpctl-dev< 1.0.16-1+deb12u1liblldpctl-dev_1.0.16-1+deb12u1_mips64el.deb
Debian10i386liblldpctl-dev< 1.0.3-1+deb10u2liblldpctl-dev_1.0.3-1+deb10u2_i386.deb
Debian12armhflldpd< 1.0.16-1+deb12u1lldpd_1.0.16-1+deb12u1_armhf.deb
Debian12arm64lldpd-dbgsym< 1.0.16-1+deb12u1lldpd-dbgsym_1.0.16-1+deb12u1_arm64.deb
Debian12i386lldpd-dbgsym< 1.0.16-1+deb12u1lldpd-dbgsym_1.0.16-1+deb12u1_i386.deb
Debian11armelliblldpctl-dev< 1.0.11-1+deb11u2liblldpctl-dev_1.0.11-1+deb11u2_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	amd64	liblldpctl-dev	< 1.0.16-1+deb12u1	liblldpctl-dev_1.0.16-1+deb12u1_amd64.deb
Debian	10	i386	lldpd	< 1.0.3-1+deb10u2	lldpd_1.0.3-1+deb10u2_i386.deb
Debian	11	s390x	lldpd	< 1.0.11-1+deb11u2	lldpd_1.0.11-1+deb11u2_s390x.deb
Debian	12	armel	lldpd-dbgsym	< 1.0.16-1+deb12u1	lldpd-dbgsym_1.0.16-1+deb12u1_armel.deb
Debian	12	mips64el	liblldpctl-dev	< 1.0.16-1+deb12u1	liblldpctl-dev_1.0.16-1+deb12u1_mips64el.deb
Debian	10	i386	liblldpctl-dev	< 1.0.3-1+deb10u2	liblldpctl-dev_1.0.3-1+deb10u2_i386.deb
Debian	12	armhf	lldpd	< 1.0.16-1+deb12u1	lldpd_1.0.16-1+deb12u1_armhf.deb
Debian	12	arm64	lldpd-dbgsym	< 1.0.16-1+deb12u1	lldpd-dbgsym_1.0.16-1+deb12u1_arm64.deb
Debian	12	i386	lldpd-dbgsym	< 1.0.16-1+deb12u1	lldpd-dbgsym_1.0.16-1+deb12u1_i386.deb
Debian	11	armel	liblldpctl-dev	< 1.0.11-1+deb11u2	liblldpctl-dev_1.0.11-1+deb11u2_armel.deb