CVE-2018-5378: Buffer Overflow
Last updated 25 August 2025
Other sources
The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
quagga bgpdto a version that resolves this vulnerability.Fixed in 1.2.3
Event History
Frequently Asked Questions
What is CVE-2018-5378?
CVE-2018-5378 refers to a vulnerability in the Quagga BGP daemon (bgpd) prior to version 1.2.3 that allows for arbitrary data to be sent over the network to a peer and may cause the bgpd process to crash.
How severe is CVE-2018-5378?
CVE-2018-5378 has a severity level of high, with a CVSS score of 5.9.
Which software versions are affected by CVE-2018-5378?
Quagga versions prior to 1.2.3 are affected, including Debian Linux 8.0, Debian Linux 9.0, Canonical Ubuntu Linux 14.04, Canonical Ubuntu Linux 16.04, and Canonical Ubuntu Linux 17.10.
How can I fix CVE-2018-5378?
To fix CVE-2018-5378, update Quagga to version 1.2.3 or later, such as version 1.2.4-3 for Debian or the appropriate remedy for your specific Linux distribution.
Where can I find more information about CVE-2018-5378?
You can find more information about CVE-2018-5378 at the following references: [http://savannah.nongnu.org/forum/forum.php?forum_id=9095](http://savannah.nongnu.org/forum/forum.php?forum_id=9095), [http://www.kb.cert.org/vuls/id/940439](http://www.kb.cert.org/vuls/id/940439), [https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-0543.txt](https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-0543.txt).