CVE catalog

CVE-2012-1820

quagga - denial of service

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.04% · Oct 25, 2026

The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message. (bgpd): Assertion failure by processing BGP OPEN message with malformed ORF capability TLV (VU#962587) The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianquagga6.00.99.17-2vulnerable
Debianquagga6.00.99.17-2+squeeze2vulnerable
Debianquagga6.00.99.17-2+squeeze3vulnerable
Debianquagga6.00.99.17-3vulnerable
Debianquagga6.00.99.17-4vulnerable
Debianquagga6.00.99.18-1vulnerable
Debianquagga6.00.99.18-2vulnerable
Debianquagga6.00.99.19-1vulnerable
Debianquagga6.00.99.20-1vulnerable
Debianquagga6.00.99.20-1~bpo60+1vulnerable
Debianquagga6.00.99.20-2vulnerable
Debianquagga6.00.99.20-3vulnerable
Debianquagga6.00.99.20-4vulnerable
Debianquagga6.00.99.20.1-0+squeeze1vulnerable
Debianquagga6.00.99.20.1-0+squeeze2vulnerable
Debianquagga6.00.99.20.1-0+squeeze3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianquaggadeb6.00.99.20.1-0+squeeze3Not reportedDSA-2497-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]