CVE-2022-26126: Buffer Overflow
Published Mar 3, 2022
·Updated
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isisnbnotifications.c.
Affected Software
5 affected componentsFixes available
debian/frr<=7.5.1-1.1+deb11u2
7.5.1-1.1+deb11u48.4.4-1.1~deb12u110.2.1-2
Frrouting FRRouting<8.2
Fedoraproject Fedora=34
Fedoraproject Fedora=35
Fedoraproject Fedora=36
Remediation
Event History
Mar 3, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Jun 5, 2024
Data Sourced
via Launchpad·05:52 PM
Description
Sep 17, 2024
Data Sourced
via Ubuntu·06:07 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2022-26126?
CVE-2022-26126 is a vulnerability in FRRouting through 8.1.0 that allows buffer overflow due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.
2
What software versions are affected by CVE-2022-26126?
FRRouting versions up to 8.1.0 are affected by CVE-2022-26126.
3
What is the severity of CVE-2022-26126?
CVE-2022-26126 has a severity level of 7.8 (High).
4
How can I fix CVE-2022-26126?
To fix CVE-2022-26126, update FRRouting to version 8.4.4-1.1~deb12u1 or later.
5
Can Fedora users be affected by CVE-2022-26126?
Yes, Fedora users running versions 34, 35, or 36 are also affected by CVE-2022-26126.