It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6…

Description

It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be compatible with a message size; however, BUFSIZ is system-dependent.

Scores

EPSS (exploitation in 30 days)

3.7% · top 10% of all CVEs (3 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• stack-based buffer overflow
• CWE-119 (opens in a new tab)Other CVEs with CWE-119

Affected products

• Quagga before 1.0.20161017

  • affected Quagga before 1.0.20161017

References (7)

• RHSA-2017:0794 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• GLSA-201701-48 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• 93775 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=1386109 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://www.gossamer-threads.com/lists/quagga/users/31952 (opens in a new tab)x_refsource_CONFIRMx_transferred
• DSA-3695 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• https://github.com/Quagga/quagga/commit/cfb1fae25f8c092e0d17073eaf7bd428ce1cd546 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2016-1245](https://trackcve.app/badge/CVE-2016-1245.svg)](https://trackcve.app/cve/CVE-2016-1245)

Record last updated 5 Aug 2024, 22:48 UTC.