CVE-2017-15865 Information disclosure in n/a

What is CVE-2017-15865?

CVE-2017-15865 is a high-severity vulnerability in n/a, published on 8 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers to obtain sensitive information via a malformed BGP UPDATE packet from a connected peer, which triggers transmission of up to a few thousand unintended bytes because of a mishandled attribute length, aka RN-690 (CM-18492).

Weakness: CWE-200

Which versions are affected by CVE-2017-15865?

It affects 1 product.

Products include Frrouting Frrouting.

How do I fix CVE-2017-15865?

Upgrade to a fixed version.

Is CVE-2017-15865 being exploited?

There is no known exploitation of CVE-2017-15865 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-44070 Denial of service in n/a Critical 9.8
• CVE-2023-38406 bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow." Critical 9.8
• CVE-2022-37035 Use after free in n/a High 8.1
• CVE-2022-26127 Memory corruption in FRRouting High 7.8
• CVE-2022-26128 Memory corruption in FRRouting High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rh69-rw6w-x274, SUSE-SU-2024:3524-1.