Lucene search

K

31 matches found

CVE
CVE
added 2024/02/28 7:15 a.m.7225 views

CVE-2024-27913

ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OSPF LSA packet, because of an attempted access to a missing attribute field.

6.5CVSS6.4AI score0.00078EPSS
CVE
CVE
added 2023/08/29 4:15 a.m.218 views

CVE-2023-41358

An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.

7.5CVSS8.1AI score0.00294EPSS
CVE
CVE
added 2022/03/03 6:15 p.m.174 views

CVE-2022-26129

Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parse_hello_subtlv, parse_ihu_subtlv, and parse_update_subtlv in babeld/message.c.

7.8CVSS7.8AI score0.00093EPSS
CVE
CVE
added 2023/08/29 4:15 a.m.149 views

CVE-2023-41360

An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation.

9.1CVSS8.8AI score0.00244EPSS
CVE
CVE
added 2023/08/29 4:15 p.m.143 views

CVE-2023-38802

FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).

7.5CVSS7.1AI score0.00649EPSS
CVE
CVE
added 2023/08/29 4:15 a.m.132 views

CVE-2023-41361

An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.

9.8CVSS9.3AI score0.00498EPSS
CVE
CVE
added 2022/03/03 6:15 p.m.125 views

CVE-2022-26125

Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c.

7.8CVSS7.7AI score0.00055EPSS
CVE
CVE
added 2022/03/03 6:15 p.m.120 views

CVE-2022-26126

Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.

7.8CVSS7.8AI score0.00076EPSS
CVE
CVE
added 2022/03/03 6:15 p.m.116 views

CVE-2022-26127

A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babeld/message.c.

7.8CVSS7.5AI score0.00106EPSS
CVE
CVE
added 2022/03/03 6:15 p.m.107 views

CVE-2022-26128

A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld/message.c.

7.8CVSS7.6AI score0.00106EPSS
CVE
CVE
added 2023/11/03 9:15 p.m.101 views

CVE-2023-47234

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path attributes).

7.5CVSS8.1AI score0.00141EPSS
CVE
CVE
added 2022/09/19 10:15 p.m.99 views

CVE-2022-37032

An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.

9.1CVSS8.7AI score0.00475EPSS
CVE
CVE
added 2023/11/03 9:15 p.m.97 views

CVE-2023-47235

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw outcome.

7.5CVSS7.2AI score0.00099EPSS
CVE
CVE
added 2023/11/06 6:15 a.m.94 views

CVE-2023-38406

bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."

9.8CVSS9.2AI score0.00134EPSS
CVE
CVE
added 2023/10/26 5:15 a.m.92 views

CVE-2023-46753

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute.

5.9CVSS5.9AI score0.00086EPSS
CVE
CVE
added 2024/04/07 9:15 p.m.88 views

CVE-2024-31948

In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash.

6.5CVSS6.2AI score0.00085EPSS
CVE
CVE
added 2023/11/06 6:15 a.m.86 views

CVE-2023-38407

bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.

7.5CVSS7.2AI score0.00148EPSS
CVE
CVE
added 2023/10/26 5:15 a.m.79 views

CVE-2023-46752

An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.

5.9CVSS5.7AI score0.00097EPSS
CVE
CVE
added 2024/04/07 9:15 p.m.75 views

CVE-2024-31949

In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointer not advancing.

6.5CVSS9.2AI score0.00039EPSS
CVE
CVE
added 2023/05/03 12:16 p.m.70 views

CVE-2022-40302

An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent...

6.5CVSS6.4AI score0.00159EPSS
CVE
CVE
added 2024/04/07 9:15 p.m.66 views

CVE-2024-31950

In FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ri for OSPF LSA packets during an attempt to read Segment Routing subTLVs (their size is not validated).

6.5CVSS6.8AI score0.00156EPSS
CVE
CVE
added 2024/04/07 9:15 p.m.66 views

CVE-2024-31951

In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).

6.5CVSS6.8AI score0.00058EPSS
CVE
CVE
added 2023/05/03 12:16 p.m.59 views

CVE-2022-43681

An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (or the option length word, in case of an extended OPEN message), the FRR code reads of out of the bounds of the packet, throwing a SIGABRT s...

6.5CVSS6.8AI score0.00159EPSS
CVE
CVE
added 2024/04/30 7:15 p.m.59 views

CVE-2024-34088

In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In cases where calling functions do not handle the returned NULL value, the OSPF daemon crashes, leading to denial of service.

7.5CVSS6.3AI score0.00062EPSS
CVE
CVE
added 2017/11/08 8:29 p.m.58 views

CVE-2017-15865

bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers to obtain sensitive information via a malformed BGP UPDATE packet from a connected peer, which triggers transmission of up to a few thousand unintended bytes ...

7.5CVSS7.2AI score0.00649EPSS
CVE
CVE
added 2023/08/29 4:15 a.m.58 views

CVE-2023-41359

An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two bytes during AIGP validation.

9.1CVSS8.9AI score0.00245EPSS
CVE
CVE
added 2024/08/19 2:15 a.m.55 views

CVE-2024-44070

An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the TLV value.

9.8CVSS6.6AI score0.00286EPSS
CVE
CVE
added 2023/07/24 4:15 p.m.53 views

CVE-2023-3748

A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory f...

7.5CVSS5.2AI score0.0002EPSS
CVE
CVE
added 2023/09/05 7:15 a.m.51 views

CVE-2023-41909

An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference.

7.5CVSS8AI score0.00078EPSS
CVE
CVE
added 2023/05/03 12:16 p.m.49 views

CVE-2022-40318

An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent...

6.5CVSS6.4AI score0.00159EPSS
CVE
CVE
added 2019/01/10 5:29 p.m.39 views

CVE-2019-5892

bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 (not affecting Cumulus Linux or VyOS), when ENABLE_BGP_VNC is used for Virtual Network Control, allows remote attackers to cause a denial of service (peering session fla...

6.5CVSS6.4AI score0.03807EPSS