{"id":"CVE-2016-2342","aliases":["DEBIAN-CVE-2016-2342","DSA-3532-1","EUVD-2016-3426","GHSA-jm86-8c92-649g","MGASA-2016-0126","RHSA-2017:0794","SUSE-SU-2016:0936-1","SUSE-SU-2016:0946-1","UBUNTU-CVE-2016-2342","USN-2941-1","openSUSE-SU-2024:10362-1"],"status":"published","title":"The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga...","description":"The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.13334,"percentile":0.9643,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2016-03-17T00:00:00Z","modified":"2026-06-26T12:22:00Z","fixes":[{"ecosystem":"Debian:7","package":"quagga","fixed_in":["0.99.22.4-1+wheezy2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"quagga","fixed_in":["0.99.23.1-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"quagga","fixed_in":["0.99.22.4-4.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"quagga","fixed_in":["0.99.22.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"quagga","fixed_in":["0.99.22.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"quagga","fixed_in":["0.99.22.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"quagga","fixed_in":["0.99.22.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"quagga","fixed_in":["0.99.22.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"quagga","fixed_in":["0.99.22.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"quagga","fixed_in":["0.99.15-0.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"quagga","fixed_in":["0.99.15-0.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"quagga","fixed_in":["0.99.15-0.16.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"quagga","fixed_in":["0.99.22.4-3ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.4-1+wheezy2"}]}],"versions":["0.99.21-4+wheezy1","0.99.21-4+wheezy2","0.99.22-1","0.99.22.1-1","0.99.22.1-2","0.99.22.4-1","0.99.22.4-1+wheezy1"]},{"source":"osv","ecosystem":"Debian:8","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.23.1-1+deb8u1"}]}],"versions":["0.99.23.1-1"]},{"source":"osv","ecosystem":"Mageia:5","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.4-4.1.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"quagga-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"quagga-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"quagga-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"quagga-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"quagga-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"quagga-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-0.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-0.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-0.16.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.4-3ubuntu1.1"}]}],"versions":["0.99.22.1-2","0.99.22.4-1","0.99.22.4-2","0.99.22.4-3","0.99.22.4-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.4-3ubuntu1.1"}]}],"versions":["0.99.22.1-2","0.99.22.4-1","0.99.22.4-2","0.99.22.4-3","0.99.22.4-3ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20160315-5.1"}]}],"bundled":6}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"quagga","product":"quagga"}],"references":[{"url":"http://www.securityfocus.com/bid/84318","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0794.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-03/msg00102.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.debian.org/security/2016/dsa-3532","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.kb.cert.org/vuls/id/270232","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","report"]},{"url":"http://git.savannah.gnu.org/cgit/quagga.git/commit/?id=a3bc7e9400b214a0f078fdb19596ba54214a1442","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201610-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-03/msg00117.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://nongnu.askapache.com//quagga/quagga-1.0.20160309.changelog.txt","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.ubuntu.com/usn/USN-2941-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2342","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jm86-8c92-649g"},{"url":"https://advisories.mageia.org/MGASA-2016-0126.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18060","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2016-03/msg00102.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0794","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=674862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=770731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=839620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=842308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=862826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=981124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1316571","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1331372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1386109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1416013","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0794.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2236","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2236","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1245","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1245","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1245","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2342","tags":["advisory","report"]},{"url":"http://mirror.easyname.at/nongnu//quagga/quagga-1.0.20160309.changelog.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4049","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4049","tags":["advisory"]},{"url":"http://openwall.com/lists/oss-security/2016/04/27/7","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5495","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5495","tags":["advisory"]},{"url":"https://lists.quagga.net/pipermail/quagga-dev/2017-January/016586.html","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160936-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/970952","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2342","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160946-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2342","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2941-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-2236","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4049","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-2342","description":"The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.","status":"published","published":"2016-03-17T14:00:00Z","modified":"2024-08-05T23:24:49.091Z","updated_at":"2026-11-02T14:33:33.424551Z"}],"euvd":[{"id":"EUVD-2016-3426","description":"The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.","status":"published","published":"2016-03-17T14:00:00Z","modified":"2024-08-05T23:24:49Z","updated_at":"2026-11-03T02:22:53.601545Z"}],"ghsa":[{"id":"GHSA-jm86-8c92-649g","title":"The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga...","description":"The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.","status":"published","published":"2022-05-14T03:57:50Z","modified":"2023-02-03T05:00:53Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:52.51715Z"}],"nvd":[{"id":"CVE-2016-2342","description":"The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.","status":"published","published":"2016-03-17T14:59:01.357Z","modified":"2026-06-17T00:43:51.337Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.6,"vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"RHSA-2017:0794","title":"Red Hat Security Advisory: quagga security and bug fix update","status":"published","published":"2024-09-15T23:49:43Z","modified":"2026-06-26T12:22:00.337085357Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2016-2342","description":"The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.","status":"published","published":"2016-03-17T00:00:00Z","modified":"2026-02-04T02:54:09.435724Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"DSA-3532-1","title":"quagga - security update","status":"published","published":"2016-03-27T00:00:00Z","modified":"2026-03-09T01:18:21.330804Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0126","title":"Updated quagga packages fix security vulnerability","description":"A vulnerability was found in a way VPNv4 NLRI parser copied packet data to\nthe stack. Memcpy to stack data structure based on length field from\npacket data whose length field upper-bound was not properly checked\n(CVE-2016-2342).\n","status":"published","published":"2016-03-26T15:07:38Z","modified":"2026-04-16T06:24:35.458701008Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10362-1","title":"libospf0-1.0.20160315-5.1 on GA media","description":"These are all security issues fixed in the libospf0-1.0.20160315-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:42.576001Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2016:0936-1","title":"Security update for quagga","description":"\nThis update for quagga fixes the following security issue:\n\n- CVE-2016-2342: Quagga was extended the prefixlen check to ensure it is\n  within the bound of the NLRI packet data and the on-stack prefix structure\n  and the maximum size for the address family (bsc#970952).\n","status":"published","published":"2016-04-01T14:16:54Z","modified":"2026-02-04T03:42:08.20038Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0946-1","title":"Security update for quagga","description":"\nThis update for quagga fixes the following security issue:\n\n- CVE-2016-2342: Quagga was extended the prefixlen check to ensure it is\n  within the bound of the NLRI packet data and the on-stack prefix structure\n  and the maximum size for the address family (bsc#970952).\n","status":"published","published":"2016-04-04T08:33:47Z","modified":"2026-02-04T03:52:23.654971Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"USN-2941-1","title":"quagga vulnerabilities","description":"Kostya Kortchinsky discovered that Quagga incorrectly handled certain route\ndata when configured with BGP peers enabled for VPNv4. A remote attacker\ncould use this issue to cause Quagga to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. (CVE-2016-2342)\n\nIt was discovered that Quagga incorrectly handled messages with a large\nLSA when used in certain configurations. A remote attacker could use this\nissue to cause Quagga to crash, resulting in a denial of service. This\nissue only affected Ubuntu 12.04 LTS. (CVE-2013-2236)\n","status":"published","published":"2016-03-24T12:51:55Z","modified":"2026-02-10T04:40:58Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}