Most recent entries from all

ALSA-2024:9158 — Moderate: lldpd security update

Affected: AlmaLinux:9: lldpd, AlmaLinux:9: lldpd-devel

LLDP is an industry standard protocol designed to supplant proprietary Link-Layer protocols such as EDP or CDP. The goal of LLDP is to provide an inter-vendor compatible mechanism to deliver Link-Layer notifications to adjacent network devices.

Security Fix(es):

* lldp/openvswitch: denial of service via externally triggered memory leak (CVE-2020-27827) * lldpd: out-of-bounds read when decoding SONMP packets (CVE-2021-43612) * lldpd: CDP PDU Packet cdp.c out-of-bounds read (CVE-2023-41910)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

EUVD-2026-215992

fkie_cve-2021-43612

In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.

GHSA-x6gw-c547-cwm7

In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.

gsd-2021-43612

openSUSE-SU-2024:11635-1 — liblldpctl4-1.0.13-1.1 on GA media

liblldpctl4-1.0.13-1.1 on GA media

UBUNTU-CVE-2021-43612

Affected: Ubuntu:16.04:LTS: lldpd, Ubuntu:18.04:LTS: lldpd, Ubuntu:20.04:LTS: lldpd, Ubuntu:22.04:LTS: lldpd, Ubuntu:24.04:LTS: lldpd, Ubuntu:25.10: lldpd, Ubuntu:26.04:LTS: lldpd

In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.