Vulnerability Description
Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lldpd Project | Lldpd | >= 0.5.6, < 0.8.0 |
| Debian | Debian Linux | 9.0 |
| Fedoraproject | Fedora | 33 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2015/10/16/2Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2015/10/30/2Mailing ListPatchThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf
- https://github.com/vincentbernat/lldpd/commit/dd4f16e7e816f2165fba76e3d162cd8d29PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00032.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://us-cert.cisa.gov/ics/advisories/icsa-21-194-07
- https://www.debian.org/security/2021/dsa-4836Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/10/16/2Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2015/10/30/2Mailing ListPatchThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf
- https://github.com/vincentbernat/lldpd/commit/dd4f16e7e816f2165fba76e3d162cd8d29PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00032.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://us-cert.cisa.gov/ics/advisories/icsa-21-194-07
FAQ
What is CVE-2015-8011?
CVE-2015-8011 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via...
How severe is CVE-2015-8011?
CVE-2015-8011 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2015-8011?
Check the references section above for vendor advisories and patch information. Affected products include: Lldpd Project Lldpd, Debian Debian Linux, Fedoraproject Fedora.