Every CVE Search/ Get API key

CVE-2007-1995

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not...

6.3 MediumFix available

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.

Exploit likelihood

1.74%Down 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.3

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.

Record
CVE-2007-1995
CVSS 2.0
6.3 MediumAV:N/AC:M/Au:S/C:N/I:N/A:C
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.

Record
CVE-2007-1995
Updated
2026-11-02
EUVDEUVD-2007-1989 No score

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.

Record
EUVD-2007-1989
Updated
2026-11-03
GitHub AdvisoriesGHSA-83w3-xxm9-4ff8 No score

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not...

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.

Record
GHSA-83w3-xxm9-4ff8
Weakness
CWE-20
Updated
2026-11-02
OSV No score

bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.

Record
CVE-2007-1995
Updated
2026-11-02
OSVopenSUSE-SU-2024:11290-1 No score

libfpm_pb0-1.2.4-2.14 on GA media

These are all security issues fixed in the libfpm_pb0-1.2.4-2.14 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11290-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
quagga
Debian:3.1
 before 0.98.3-7.4, plus listed versions
0.98.3-70.98.3-7.10.98.3-7.20.98.3-7.3
0.98.3-7.4
quagga
Debian:4.0
 before 0.99.5-5etch2, plus listed versions
0.99.5-5etch1
0.99.5-5etch2
quagga
Red Hat:enterprise_linux:3::as
 before 0:0.96.2-12.3E
0:0.96.2-12.3E
quagga-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:0.96.2-12.3E
0:0.96.2-12.3E
quagga
Red Hat:enterprise_linux:3::es
 before 0:0.96.2-12.3E
0:0.96.2-12.3E
quagga-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:0.96.2-12.3E
0:0.96.2-12.3E
quagga
Red Hat:enterprise_linux:4::as
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga-contrib
Red Hat:enterprise_linux:4::as
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga-devel
Red Hat:enterprise_linux:4::as
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
Show 23 moreShow less
Affected packages
PackageAffectedFixed
quagga
Red Hat:enterprise_linux:4::desktop
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga-contrib
Red Hat:enterprise_linux:4::desktop
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga-devel
Red Hat:enterprise_linux:4::desktop
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga
Red Hat:enterprise_linux:4::es
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga-contrib
Red Hat:enterprise_linux:4::es
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga-devel
Red Hat:enterprise_linux:4::es
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga
Red Hat:enterprise_linux:4::ws
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga-contrib
Red Hat:enterprise_linux:4::ws
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga-devel
Red Hat:enterprise_linux:4::ws
 before 0:0.98.3-2.4.0.1.el4
0:0.98.3-2.4.0.1.el4
quagga
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.98.6-2.1.0.1.el5
0:0.98.6-2.1.0.1.el5
quagga-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.98.6-2.1.0.1.el5
0:0.98.6-2.1.0.1.el5
quagga-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.98.6-2.1.0.1.el5
0:0.98.6-2.1.0.1.el5
quagga
Red Hat:enterprise_linux:5::client
 before 0:0.98.6-2.1.0.1.el5
0:0.98.6-2.1.0.1.el5
quagga-contrib
Red Hat:enterprise_linux:5::client
 before 0:0.98.6-2.1.0.1.el5
0:0.98.6-2.1.0.1.el5
quagga-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:0.98.6-2.1.0.1.el5
0:0.98.6-2.1.0.1.el5
quagga
Red Hat:enterprise_linux:5::server
 before 0:0.98.6-2.1.0.1.el5
0:0.98.6-2.1.0.1.el5
quagga-contrib
Red Hat:enterprise_linux:5::server
 before 0:0.98.6-2.1.0.1.el5
0:0.98.6-2.1.0.1.el5
quagga-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:0.98.6-2.1.0.1.el5
0:0.98.6-2.1.0.1.el5
quagga-devel
Red Hat:enterprise_linux:5::server
 before 0:0.98.6-2.1.0.1.el5
0:0.98.6-2.1.0.1.el5
quagga
openSUSE:Tumbleweed
From an advisory covering 12 CVEs
 before 1.2.4-2.14
1.2.4-2.14

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-1995 is a medium vulnerability (CVSS 6.3) in Quagga, published April 12, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 77th percentile. Fixed in quagga 0.98.3-7.4.

References

Show 40 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open