Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified in its header.

Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified in its header.

quagga: DoS (crash) by processing malformed extended community attribute in a route (ospf6d): Stack-based buffer overflow while decoding Link State Update packet with malformed Inter Area Prefix LSA (ospf6d): Denial of service by decoding malformed Database Description packet headers (ospfd): Denial of service by decoding too short Hello packet or Hello packet with invalid OSPFv2 header type (ospfd): Denial of service by decoding Link State Update LSAs of unknown type (bgpd): Heap-based buffer overflow by decoding BGP UPDATE message with unknown AS_PATH attributes (ospfd): Assertion failure due improper length check for a received LS-Update OSPF packet (ospfd): Crash by processing LS-Update OSPF packet due improper length check of the Network-LSA structures