{"id":"CVE-2016-4049","aliases":["DLA-601-1","DSA-3654-1","EUVD-2016-5052","GHSA-5crg-85w6-wxj6","MGASA-2016-0165","RHSA-2017:0794","SUSE-SU-2016:1482-1","SUSE-SU-2016:1483-1","UBUNTU-CVE-2016-4049","USN-3102-1","openSUSE-SU-2024:10362-1"],"status":"published","title":"The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when...","description":"The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04642,"percentile":0.91783,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-05-05T16:26:44Z","modified":"2026-06-26T12:22:00Z","fixes":[{"ecosystem":"Mageia:5","package":"quagga","fixed_in":["0.99.22.4-4.2.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"quagga","fixed_in":["0.99.22.1-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"quagga","fixed_in":["0.99.22.1-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"quagga","fixed_in":["0.99.22.1-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"quagga","fixed_in":["0.99.22.1-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"quagga","fixed_in":["0.99.22.1-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"quagga","fixed_in":["0.99.22.1-12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"quagga","fixed_in":["0.99.15-0.24.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"quagga","fixed_in":["0.99.15-0.24.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"quagga","fixed_in":["0.99.15-0.24.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"quagga","fixed_in":["0.99.22.4-3ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"quagga","fixed_in":["0.99.24.1-2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.4-1+wheezy3"}]}],"versions":["0.99.21-4+wheezy1","0.99.21-4+wheezy2","0.99.22-1","0.99.22.1-1","0.99.22.1-2","0.99.22.4-1","0.99.22.4-1+wheezy1","0.99.22.4-1+wheezy2"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.23.1-1+deb8u2"}]}],"versions":["0.99.23.1-1","0.99.23.1-1+deb8u1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.4-4.2.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"quagga-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"quagga-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"quagga-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"quagga-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"quagga-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"quagga-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.99.15-14.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.1-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.1-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.1-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.1-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.1-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.1-12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-0.24.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-0.24.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.15-0.24.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.4-3ubuntu1.2"}]}],"versions":["0.99.22.1-2","0.99.22.4-1","0.99.22.4-2","0.99.22.4-3","0.99.22.4-3ubuntu1","0.99.22.4-3ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.24.1-2ubuntu1.1"}]}],"versions":["0.99.24.1-2","0.99.24.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.22.4-3ubuntu1.2"}]}],"versions":["0.99.22.1-2","0.99.22.4-1","0.99.22.4-2","0.99.22.4-3","0.99.22.4-3ubuntu1","0.99.22.4-3ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.24.1-2ubuntu1.1"}]}],"versions":["0.99.24.1-2","0.99.24.1-2ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20160315-5.1"}]}],"bundled":6}],"products":[{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"quagga","product":"quagga"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2017-0794.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201701-48","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://www.securitytracker.com/id/1035699","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2016/04/27/7","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-05/msg00062.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://lists.quagga.net/pipermail/quagga-dev/2016-January/014699.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","report"]},{"url":"http://www.securityfocus.com/bid/88561","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://lists.quagga.net/pipermail/quagga-dev/2016-February/014743.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.debian.org/security/2016/dsa-3654","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4049","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5crg-85w6-wxj6"},{"url":"https://advisories.mageia.org/MGASA-2016-0165.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18280","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/04/27/7","tags":["web","article"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0794","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=674862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=770731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=839620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=842308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=862826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=981124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1316571","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1331372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1386109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1416013","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0794.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2236","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2236","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1245","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1245","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1245","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2342","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2342","tags":["advisory"]},{"url":"http://mirror.easyname.at/nongnu//quagga/quagga-1.0.20160309.changelog.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4049","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4049","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5495","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5495","tags":["advisory"]},{"url":"https://lists.quagga.net/pipermail/quagga-dev/2017-January/016586.html","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161482-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/977012","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4049","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161483-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-4049","tags":["report"]},{"url":"https://lists.quagga.net/pipermail/quagga-dev/2016-April/015241.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3102-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-4036","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2342","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-4049","description":"The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.","status":"published","published":"2016-05-23T19:00:00Z","modified":"2024-08-06T00:17:30.643Z","updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2016-5052","description":"The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.","status":"published","published":"2016-05-23T19:00:00Z","modified":"2024-08-06T00:17:30Z","updated_at":"2026-11-03T02:22:48.270082Z"}],"ghsa":[{"id":"GHSA-5crg-85w6-wxj6","title":"The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when...","description":"The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.","status":"published","published":"2022-05-14T02:08:56Z","modified":"2023-02-02T05:05:12Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:52:03.084435Z"}],"nvd":[{"id":"CVE-2016-4049","description":"The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.","status":"published","published":"2016-05-23T19:59:07.947Z","modified":"2026-06-17T00:46:47.42Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:25.366449Z"}],"osv":[{"id":"RHSA-2017:0794","title":"Red Hat Security Advisory: quagga security and bug fix update","status":"published","published":"2024-09-15T23:49:43Z","modified":"2026-06-26T12:22:00.337085357Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2016-4049","description":"The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.","status":"published","published":"2016-05-23T00:00:00Z","modified":"2026-02-04T03:52:48.096926Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-601-1","title":"quagga - security update","status":"published","published":"2016-08-26T00:00:00Z","modified":"2026-03-09T02:09:41.981234Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3654-1","title":"quagga - security update","status":"published","published":"2016-08-26T00:00:00Z","modified":"2026-03-09T01:19:39.445525Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0165","title":"Updated quagga packages fix CVE-2016-4049","description":"Updated quagga packages fix security vulnerability:\n\nA denial of dervice vulnerability have been found in BGP daemon\nfrom Quagga routing software (bgpd): if the following conditions are\nsatisfied:\n\n - regular dumping is enabled\n - bgpd instance has many BGP peers\n\nthen BGP message packets that are big enough cause bgpd to crash.\nThe situation when the conditions above are satisfied is quite common.\nMoreover, it is easy to craft a packet which is much \"bigger\" than a\ntypical packet, and hence such crafted packet can much more likely cause\nthe crash (CVE-2016-4049).\n","status":"published","published":"2016-05-05T16:26:44Z","modified":"2026-04-16T06:25:18.099831836Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10362-1","title":"libospf0-1.0.20160315-5.1 on GA media","description":"These are all security issues fixed in the libospf0-1.0.20160315-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:42.576001Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2016:1482-1","title":"Security update for quagga","description":"\nThis update for quagga fixes the following issue:\n\nSecurity issue fixed:\n- CVE-2016-4049: Fix for a buffer overflow error in bgp_dump_routes_func. (bsc#977012)\n","status":"published","published":"2016-06-03T11:34:34Z","modified":"2026-02-04T03:32:23.286918Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1483-1","title":"Security update for quagga","description":"\nThis update for quagga fixes the following issue:\n\nSecurity issue fixed:\n- CVE-2016-4049: Fix for a buffer overflow error in bgp_dump_routes_func. (bsc#977012)\n","status":"published","published":"2016-06-03T11:36:12Z","modified":"2026-02-04T02:22:18.720431Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3102-1","title":"quagga vulnerabilities","description":"It was discovered that Quagga incorrectly handled dumping data. A remote\nattacker could possibly use a large BGP packet to cause Quagga to crash,\nresulting in a denial of service. (CVE-2016-4049)\n\nIt was discovered that the Quagga package incorrectly set permissions on\nthe configuration directory. A local user could use this issue to possibly\nobtain sensitive information. (CVE-2016-4036)\n","status":"published","published":"2016-10-13T12:41:02Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}