CVE-2016-1245

{"id": "CVE-2016-1245", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-02-22T23:59:00.143", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2017-0794.html", "source": "security@debian.org"}, {"url": "http://www.gossamer-threads.com/lists/quagga/users/31952", "tags": ["Mailing List", "Mitigation", "Third Party Advisory"], "source": "security@debian.org"}, {"url": "http://www.securityfocus.com/bid/93775", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@debian.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1386109", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "security@debian.org"}, {"url": "https://github.com/Quagga/quagga/commit/cfb1fae25f8c092e0d17073eaf7bd428ce1cd546", "tags": ["Patch", "Third Party Advisory"], "source": "security@debian.org"}, {"url": "https://security.gentoo.org/glsa/201701-48", "source": "security@debian.org"}, {"url": "https://www.debian.org/security/2016/dsa-3695", "tags": ["Third Party Advisory"], "source": "security@debian.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be compatible with a message size; however, BUFSIZ is system-dependent."}, {"lang": "es", "value": "Se descubri\u00f3 que el demonio zebra en Quagga en versiones anteriores a 1.0.20161017 sufri\u00f3 un desbordamiento de b\u00fafer basado en pila al procesar mensajes de Neighbor Discovery de IPv6. La causa ra\u00edz radicaba en BUFSIZ para ser compatible con un tama\u00f1o de mensaje; sin embargo, BUFSIZ depende del sistema."}], "lastModified": "2018-01-05T02:30:33.727", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:quagga:quagga:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B646D43D-A1C2-441B-90CE-2929F7BB072A", "versionEndIncluding": "1.0.20160315"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}], "operator": "OR"}]}], "sourceIdentifier": "security@debian.org"}