Most recent entries from all

ALSA-2024:2156 — Moderate: frr security update

Affected: AlmaLinux:9: frr, AlmaLinux:9: frr-selinux

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

* frr: incorrect length check in bgp_capability_llgr() can lead do DoS (CVE-2023-31489) * frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490) * frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358) * frr: out of bounds read in bgp_attr_aigp_valid (CVE-2023-41359) * frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909) * frr: mishandled malformed data leading to a crash (CVE-2023-46752) * frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753) * frr: ahead-of-stream read of ORF header (CVE-2023-41360)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2023-08631

EUVD-2026-258854

fkie_cve-2023-46753

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute.

GHSA-33fq-cj88-4v27

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute.

gsd-2023-46753

msrc_CVE-2023-46753 — An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mand…

msrc_CVE-2023-46753

openSUSE-SU-2024:13387-1 — frr-8.4-7.1 on GA media

frr-8.4-7.1 on GA media

SSA-202008 — SSA-202008: Multiple Vulnerabilities in Ruggedcom Rox Before V2.17.0

An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…

SUSE-SU-2023:4473-1 — Security update for frr

Security update for frr

UBUNTU-CVE-2023-46753

Affected: Ubuntu:Pro:16.04:LTS: quagga, Ubuntu:Pro:18.04:LTS: quagga, Ubuntu:20.04:LTS: quagga, Ubuntu:Pro:20.04:LTS: frr, Ubuntu:22.04:LTS: frr

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute.

WID-SEC-W-2023-2748 — FRRouting: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in FRRouting ausnutzen, um einen Denial of Service Angriff durchzuführen.