Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

SUSE-SU-2024:3426-1 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceSUSE-SU-2024:3426-1

SUSE-SU-2024:3426-1

CRITICAL9.8

Security update for quagga

Published Sep 24, 2024

Modified 1 years ago

Fix available

Details

Description of the patch:

This update for quagga fixes the following issues:

CVE-2017-15865: sensitive information disclosed when malformed BGP UPDATE packets are processed. (bsc#1230866)
CVE-2024-44070: crash when parsing Tunnel Encap attribute due to no length check. (bsc#1229438)
CVE-2022-37032: out-of-bounds read when parsing a BGP capability message due to incorrect size check. (bsc#1202023)

Bug fixes:

References to /var/adm/fillup-templates replaced with new %_fillupdir macro. (bsc#1069468)

Affected Packages

libfpm_pb0

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.1.1-17.13.1

libospf0

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.1.1-17.13.1

libospfapiclient0

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.1.1-17.13.1

libquagga_pb0

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.1.1-17.13.1

libzebra1

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.1.1-17.13.1

quagga

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

1.1.1-17.13.1

quagga-devel

SUSE Linux Enterprise Software Development Kit 12 SP5

Fixed in:

1.1.1-17.13.1

References

https://bugzilla.suse.com/1069468

https://bugzilla.suse.com/1079798

https://bugzilla.suse.com/1079799

https://bugzilla.suse.com/1079800

https://bugzilla.suse.com/1079801

https://bugzilla.suse.com/1202023

https://bugzilla.suse.com/1229438

https://bugzilla.suse.com/1230866

https://lists.suse.com/pipermail/sle-security-updates/2024-September/019517.html

https://www.suse.com/security/cve/CVE-2017-15865/

https://www.suse.com/security/cve/CVE-2018-5378/

https://www.suse.com/security/cve/CVE-2018-5379/

https://www.suse.com/security/cve/CVE-2018-5380/

https://www.suse.com/security/cve/CVE-2018-5381/

https://www.suse.com/security/cve/CVE-2022-37032/

https://www.suse.com/security/cve/CVE-2024-44070/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2024/suse-su-20243426-1/

CVSS Analysis

CVSS v3.0

9.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Upstream

CVE-2017-15865 CVE-2018-5378 CVE-2018-5379 CVE-2018-5380 CVE-2018-5381 CVE-2022-37032 CVE-2024-44070

Ecosystems

SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5

Timeline

PublishedSep 24, 2024

ModifiedSep 24, 2024