{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SINAMICS G150 V4.6 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS G150 V4.7 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SITOP PSU8600 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC RF186C toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC Teleservice Adapter IE Standard toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC S7-1500 CPU family toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC RF181-EIP toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S150 V4.8 toutes versions ant\u00e9rieures \u00e0 V4.8 HF6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMOCODE pro V PN toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS G150 V5.1 SP1 toutes versions ant\u00e9rieures \u00e0 V5.1 SP1 HF4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC S7-1500 Software Controller toutes versions V2.5 et post\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S150 V4.7 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC ET 200 Open Controller CPU 1515SPPC2 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC CP343-1 Advanced toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "TeleControl Server Basic toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "TIM 1531 IRC toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC CP443-1 OPC UA toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC HMI Comfort Outdoor Panels 7\" \u0026 15\" toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S210 V5.1 SP1 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS G130 V5.1 SP1 toutes versions ant\u00e9rieures \u00e0 V5.1 SP1 HF4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC Teleservice Adapter IE Basic toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "CP1616 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S120 V4.7 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC WinCC Runtime Mobile toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S120 V5.1 SP1 toutes versions ant\u00e9rieures \u00e0 V5.1 SP1 HF4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS G130 V4.8 toutes versions ant\u00e9rieures \u00e0 V4.8 HF6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC S7-300 CPU family toutes versions ant\u00e9rieures \u00e0 V3.X.16",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "CP1604 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Remote Connect Client toutes versions ant\u00e9rieures \u00e0 V2.0 HF1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SITOP Manager toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS G150 V5.1 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC S7-1500 CPU family toutes versions V2.5 et post\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMOCODE pro V EIP toutes versions ant\u00e9rieures \u00e0 V1.0.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC CP443-1 Advanced toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS G150 V4.8 toutes versions ant\u00e9rieures \u00e0 V4.8 HF6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Remote Connect Server toutes versions ant\u00e9rieures \u00e0 V2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS G150 V4.7 SP1 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC WinAC RTX 2010 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Spectrum Power 4 avec Web Office Portal",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC HMI Comfort Panels 4\" - 22\" toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S150 V5.1 SP1 toutes versions ant\u00e9rieures \u00e0 V5.1 SP1 HF4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS G130 V4.6 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S150 V4.7 SP1 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC S7-PLCSIM Advanced toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC WinCC Runtime HSP Comfort toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMOCODE pro V EIP toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIAMTIC RF185C toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC ET 200 SP Open Controller CPU1515SP PC2 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC Teleservice Adapter IE Advanced toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC S7-400 PN/DP V7 (incl. F) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC WinCC Runtime Advanced toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC IPC DiagMonitor toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S120 V4.6 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC WinCC OA toutes versions ant\u00e9rieures \u00e0 V3.15-P018",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S150 V4.6 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC WinCC Runtime Comfort toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS G130 V4.7 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINUMERIK OPC UA Server toutes versions ant\u00e9rieures \u00e0 V2.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS G130 V4.7 SP1 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC S7-400 PN (incl. F) V6 et ant\u00e9rieures toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Server toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S120 V5.1 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC RF188C toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SITOP UPS1600 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S120 V4.8 toutes versions ant\u00e9rieures \u00e0 V4.8 HF",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC CP443-1 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC ET 200 SP Open Controller CPU1515SP PC toutes versions ant\u00e9rieures \u00e0 V2.1.6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S210 V5.1 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS G130 V5.1 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM ROX II toutes versions ant\u00e9rieures \u00e0 V2.13.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC NET PC Software toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEC-NMS toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S120 V4.7 SP1 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC RF600R toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC S7-1500 Software Controller toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC HMI KTP Mobile Panels KTP400F,KTP700, KTP700F, KTP900 et KTP900F toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC RF182C toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINAMICS S150 V5.1 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-6579",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6579"
    },
    {
      "name": "CVE-2019-6575",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6575"
    },
    {
      "name": "CVE-2019-6568",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6568"
    },
    {
      "name": "CVE-2018-5380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-5380"
    },
    {
      "name": "CVE-2017-12741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-12741"
    },
    {
      "name": "CVE-2018-5381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-5381"
    },
    {
      "name": "CVE-2018-14618",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-14618"
    },
    {
      "name": "CVE-2019-3822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-3822"
    },
    {
      "name": "CVE-2018-5379",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-5379"
    },
    {
      "name": "CVE-2018-16890",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-16890"
    },
    {
      "name": "CVE-2019-6570",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6570"
    }
  ],
  "initial_release_date": "2019-04-09T00:00:00",
  "last_revision_date": "2019-04-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2019-AVI-151",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-04-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "SCADA Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-436177 du 09 avril 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-480230 du 09 avril 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-480230.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-141614 du 09 avril 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-141614.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-324467 du 09 avril 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-324467.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-451142 du 09 avril 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-307392 du 09 avril 2019",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-307392.pdf"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:quagga:quagga:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5117934B-9B41-4ECF-807D-252F6CA1CF97",
              "versionEndIncluding": "1.2.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "9070C9D8-A14A-467F-8253-33B966C16886",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:ruggedcom_rox_ii_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CBDC4817-0B21-45A9-A384-AECE46E2EBC2",
              "versionEndExcluding": "2.13.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:ruggedcom_rox_ii:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1EA04F52-40D0-4A4B-9767-265A26EFD98D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input."
    },
    {
      "lang": "es",
      "value": "El demonio Quagga BGP (bgpd), en versiones anteriores a la 1.2.3, puede saturar las tablas internas de conversi\u00f3n de c\u00f3digo a cadena de BGP empleadas para depurar por un valor de puntero 1, bas\u00e1ndose en las entradas."
    }
  ],
  "id": "CVE-2018-5380",
  "lastModified": "2024-11-21T04:08:42.150",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "cret@cert.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-02-19T13:29:00.473",
  "references": [
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://savannah.nongnu.org/forum/forum.php?forum_id=9095"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/940439"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-1550.txt"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00021.html"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/201804-17"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/3573-1/"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2018/dsa-4115"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://savannah.nongnu.org/forum/forum.php?forum_id=9095"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/940439"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-1550.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/201804-17"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/3573-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2018/dsa-4115"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "cret@cert.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-5380"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-02-19T13:29:00Z",
    "severity": "MODERATE"
  },
  "details": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.",
  "id": "GHSA-265f-c4jh-jcfq",
  "modified": "2022-05-13T01:32:13Z",
  "published": "2022-05-13T01:32:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5380"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf"
    },
    {
      "type": "WEB",
      "url": "https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-1550.txt"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00021.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201804-17"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3573-1"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2018/dsa-4115"
    },
    {
      "type": "WEB",
      "url": "http://savannah.nongnu.org/forum/forum.php?forum_id=9095"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/940439"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2018-5380",
    "description": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.",
    "id": "GSD-2018-5380",
    "references": [
      "https://www.suse.com/security/cve/CVE-2018-5380.html",
      "https://www.debian.org/security/2018/dsa-4115",
      "https://ubuntu.com/security/CVE-2018-5380",
      "https://advisories.mageia.org/CVE-2018-5380.html",
      "https://alas.aws.amazon.com/cve/html/CVE-2018-5380.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2018-5380"
      ],
      "details": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.",
      "id": "GSD-2018-5380",
      "modified": "2023-12-13T01:22:39.721014Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cert@cert.org",
        "DATE_PUBLIC": "2018-02-15T00:00:00.000Z",
        "ID": "CVE-2018-5380",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "bgpd",
                    "version": {
                      "version_data": [
                        {
                          "affected": "\u003c",
                          "version_name": "bpgd",
                          "version_value": "1.2.3"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Quagga"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.0"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-125: Out-of-bounds Read"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "USN-3573-1",
            "refsource": "UBUNTU",
            "url": "https://usn.ubuntu.com/3573-1/"
          },
          {
            "name": "DSA-4115",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2018/dsa-4115"
          },
          {
            "name": "http://savannah.nongnu.org/forum/forum.php?forum_id=9095",
            "refsource": "CONFIRM",
            "url": "http://savannah.nongnu.org/forum/forum.php?forum_id=9095"
          },
          {
            "name": "GLSA-201804-17",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/201804-17"
          },
          {
            "name": "[debian-lts-announce] 20180216 [SECURITY] [DLA 1286-1] quagga security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00021.html"
          },
          {
            "name": "https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-1550.txt",
            "refsource": "CONFIRM",
            "url": "https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-1550.txt"
          },
          {
            "name": "VU#940439",
            "refsource": "CERT-VN",
            "url": "http://www.kb.cert.org/vuls/id/940439"
          },
          {
            "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf",
            "refsource": "CONFIRM",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:quagga:quagga:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.2.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:ruggedcom_rox_ii_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "2.13.0",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:ruggedcom_rox_ii:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2018-5380"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-125"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-1550.txt",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-1550.txt"
            },
            {
              "name": "VU#940439",
              "refsource": "CERT-VN",
              "tags": [
                "Third Party Advisory",
                "US Government Resource"
              ],
              "url": "http://www.kb.cert.org/vuls/id/940439"
            },
            {
              "name": "http://savannah.nongnu.org/forum/forum.php?forum_id=9095",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://savannah.nongnu.org/forum/forum.php?forum_id=9095"
            },
            {
              "name": "DSA-4115",
              "refsource": "DEBIAN",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://www.debian.org/security/2018/dsa-4115"
            },
            {
              "name": "[debian-lts-announce] 20180216 [SECURITY] [DLA 1286-1] quagga security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00021.html"
            },
            {
              "name": "USN-3573-1",
              "refsource": "UBUNTU",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://usn.ubuntu.com/3573-1/"
            },
            {
              "name": "GLSA-201804-17",
              "refsource": "GENTOO",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.gentoo.org/glsa/201804-17"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2019-10-09T23:41Z",
      "publishedDate": "2018-02-19T13:29Z"
    }
  }
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens",
        "summary": "reported this vulnerability to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s TXT advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protectnetwork access to devices with appropriate mechanisms. In order tooperate the devices in a protected IT environment, Siemens recommends toconfigure the environment according to Siemens\u0027 operational guidelinesfor Industrial Security (Download), and to follow the recommendations inthe product manuals.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "Additional information on Industrial Security by Siemens can be foundat: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions containedin Siemens\u0027 underlying license terms or other applicable agreements previouslyagreed to with Siemens (hereinafter \"License Terms\"). To the extent applicableto information, software or documentation made available in or through aSiemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website(https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), inparticular Sections 8-10 of the Terms of Use, shall apply additionally. In caseof conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-451142: Multiple Vulnerabilities in RUGGEDCOM ROX II",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-451142.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-19-099-05 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/OT/white/2019/icsa-19-099-05.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSA-19-099-05 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-19-099-05"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "ICSA-19-099-05 Siemens RUGGEDCOM ROX II",
    "tracking": {
      "current_release_date": "2019-04-09T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-19-099-05",
      "initial_release_date": "2019-04-09T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2019-04-09T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV2.13.0",
                "product": {
                  "name": "RUGGEDCOM ROX II",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM ROX II"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-5379",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The shipped version of the Quagga BGP daemon (bgpd) can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code. The security vulnerability could be exploited by an attacker spoofing a malicious BGP UPDATE message within the network. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise confidentiality, integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5379"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.13.0 - Download: The firmware updates for the RUGGEDCOM ROX-based devices can be obtained by contacting the RUGGEDCOM support team at: https://support.industry.siemens.com/my/WW/en/requests#createRequest",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/my/WW/en/requests"
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Disable the BGP routing service if not in use in your setup.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Configure BGP passwords to authenticate BGP neighbours.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2018-5380",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The shipped version of the Quagga BGP daemon (bgpd) can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input. The security vulnerability could be exploited by an attacker spoofing a malicious BGP code-point. Successful exploitation requires the attacker to be in the position of a configured, trusted BGP peer. No system privileges and no user interaction is required. An attacker could use the vulnerability to insert binary data into the internal log files. At the time of advisory publication no public exploitation of this security vulnerability was known.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5380"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.13.0 - Download: The firmware updates for the RUGGEDCOM ROX-based devices can be obtained by contacting the RUGGEDCOM support team at: https://support.industry.siemens.com/my/WW/en/requests#createRequest",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/my/WW/en/requests"
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Disable the BGP routing service if not in use in your setup.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Configure BGP passwords to authenticate BGP neighbours.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2018-5381",
      "cwe": {
        "id": "CWE-228",
        "name": "Improper Handling of Syntactically Invalid Structure"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The shipped version of the Quagga BGP daemon (bgpd) has a bug in its parsing of \"Capabilities\" in BGP OPEN messages. The parser can enter an infinite loop on invalid capabilities causing a denial of service. The security vulnerability could be exploited by an attacker spoofing a malicious BGP OPEN message. Successful exploitation requires the attacker to be in the position of a configured, trusted BGP peer. No system privileges and no user interaction is required. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5381"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V2.13.0 - Download: The firmware updates for the RUGGEDCOM ROX-based devices can be obtained by contacting the RUGGEDCOM support team at: https://support.industry.siemens.com/my/WW/en/requests#createRequest",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/my/WW/en/requests"
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Disable the BGP routing service if not in use in your setup.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Configure BGP passwords to authenticate BGP neighbours.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "libfpm_pb0-1.2.4-2.14 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the libfpm_pb0-1.2.4-2.14 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-11290",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11290-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2006-2223 page",
        "url": "https://www.suse.com/security/cve/CVE-2006-2223/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2007-1995 page",
        "url": "https://www.suse.com/security/cve/CVE-2007-1995/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-16227 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-16227/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5495 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5495/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5278 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5278/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5279 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5279/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5280 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5280/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5281 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5281/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5378 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5378/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5379 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5379/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5380 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5380/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5381 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5381/"
      }
    ],
    "title": "libfpm_pb0-1.2.4-2.14 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:11290-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libfpm_pb0-1.2.4-2.14.aarch64",
                "product": {
                  "name": "libfpm_pb0-1.2.4-2.14.aarch64",
                  "product_id": "libfpm_pb0-1.2.4-2.14.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libospf0-1.2.4-2.14.aarch64",
                "product": {
                  "name": "libospf0-1.2.4-2.14.aarch64",
                  "product_id": "libospf0-1.2.4-2.14.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libospfapiclient0-1.2.4-2.14.aarch64",
                "product": {
                  "name": "libospfapiclient0-1.2.4-2.14.aarch64",
                  "product_id": "libospfapiclient0-1.2.4-2.14.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libquagga_pb0-1.2.4-2.14.aarch64",
                "product": {
                  "name": "libquagga_pb0-1.2.4-2.14.aarch64",
                  "product_id": "libquagga_pb0-1.2.4-2.14.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libzebra1-1.2.4-2.14.aarch64",
                "product": {
                  "name": "libzebra1-1.2.4-2.14.aarch64",
                  "product_id": "libzebra1-1.2.4-2.14.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "quagga-1.2.4-2.14.aarch64",
                "product": {
                  "name": "quagga-1.2.4-2.14.aarch64",
                  "product_id": "quagga-1.2.4-2.14.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "quagga-devel-1.2.4-2.14.aarch64",
                "product": {
                  "name": "quagga-devel-1.2.4-2.14.aarch64",
                  "product_id": "quagga-devel-1.2.4-2.14.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libfpm_pb0-1.2.4-2.14.ppc64le",
                "product": {
                  "name": "libfpm_pb0-1.2.4-2.14.ppc64le",
                  "product_id": "libfpm_pb0-1.2.4-2.14.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libospf0-1.2.4-2.14.ppc64le",
                "product": {
                  "name": "libospf0-1.2.4-2.14.ppc64le",
                  "product_id": "libospf0-1.2.4-2.14.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libospfapiclient0-1.2.4-2.14.ppc64le",
                "product": {
                  "name": "libospfapiclient0-1.2.4-2.14.ppc64le",
                  "product_id": "libospfapiclient0-1.2.4-2.14.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libquagga_pb0-1.2.4-2.14.ppc64le",
                "product": {
                  "name": "libquagga_pb0-1.2.4-2.14.ppc64le",
                  "product_id": "libquagga_pb0-1.2.4-2.14.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libzebra1-1.2.4-2.14.ppc64le",
                "product": {
                  "name": "libzebra1-1.2.4-2.14.ppc64le",
                  "product_id": "libzebra1-1.2.4-2.14.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "quagga-1.2.4-2.14.ppc64le",
                "product": {
                  "name": "quagga-1.2.4-2.14.ppc64le",
                  "product_id": "quagga-1.2.4-2.14.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "quagga-devel-1.2.4-2.14.ppc64le",
                "product": {
                  "name": "quagga-devel-1.2.4-2.14.ppc64le",
                  "product_id": "quagga-devel-1.2.4-2.14.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libfpm_pb0-1.2.4-2.14.s390x",
                "product": {
                  "name": "libfpm_pb0-1.2.4-2.14.s390x",
                  "product_id": "libfpm_pb0-1.2.4-2.14.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libospf0-1.2.4-2.14.s390x",
                "product": {
                  "name": "libospf0-1.2.4-2.14.s390x",
                  "product_id": "libospf0-1.2.4-2.14.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libospfapiclient0-1.2.4-2.14.s390x",
                "product": {
                  "name": "libospfapiclient0-1.2.4-2.14.s390x",
                  "product_id": "libospfapiclient0-1.2.4-2.14.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libquagga_pb0-1.2.4-2.14.s390x",
                "product": {
                  "name": "libquagga_pb0-1.2.4-2.14.s390x",
                  "product_id": "libquagga_pb0-1.2.4-2.14.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libzebra1-1.2.4-2.14.s390x",
                "product": {
                  "name": "libzebra1-1.2.4-2.14.s390x",
                  "product_id": "libzebra1-1.2.4-2.14.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "quagga-1.2.4-2.14.s390x",
                "product": {
                  "name": "quagga-1.2.4-2.14.s390x",
                  "product_id": "quagga-1.2.4-2.14.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "quagga-devel-1.2.4-2.14.s390x",
                "product": {
                  "name": "quagga-devel-1.2.4-2.14.s390x",
                  "product_id": "quagga-devel-1.2.4-2.14.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libfpm_pb0-1.2.4-2.14.x86_64",
                "product": {
                  "name": "libfpm_pb0-1.2.4-2.14.x86_64",
                  "product_id": "libfpm_pb0-1.2.4-2.14.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libospf0-1.2.4-2.14.x86_64",
                "product": {
                  "name": "libospf0-1.2.4-2.14.x86_64",
                  "product_id": "libospf0-1.2.4-2.14.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libospfapiclient0-1.2.4-2.14.x86_64",
                "product": {
                  "name": "libospfapiclient0-1.2.4-2.14.x86_64",
                  "product_id": "libospfapiclient0-1.2.4-2.14.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libquagga_pb0-1.2.4-2.14.x86_64",
                "product": {
                  "name": "libquagga_pb0-1.2.4-2.14.x86_64",
                  "product_id": "libquagga_pb0-1.2.4-2.14.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libzebra1-1.2.4-2.14.x86_64",
                "product": {
                  "name": "libzebra1-1.2.4-2.14.x86_64",
                  "product_id": "libzebra1-1.2.4-2.14.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "quagga-1.2.4-2.14.x86_64",
                "product": {
                  "name": "quagga-1.2.4-2.14.x86_64",
                  "product_id": "quagga-1.2.4-2.14.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "quagga-devel-1.2.4-2.14.x86_64",
                "product": {
                  "name": "quagga-devel-1.2.4-2.14.x86_64",
                  "product_id": "quagga-devel-1.2.4-2.14.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfpm_pb0-1.2.4-2.14.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64"
        },
        "product_reference": "libfpm_pb0-1.2.4-2.14.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfpm_pb0-1.2.4-2.14.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le"
        },
        "product_reference": "libfpm_pb0-1.2.4-2.14.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfpm_pb0-1.2.4-2.14.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x"
        },
        "product_reference": "libfpm_pb0-1.2.4-2.14.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libfpm_pb0-1.2.4-2.14.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64"
        },
        "product_reference": "libfpm_pb0-1.2.4-2.14.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libospf0-1.2.4-2.14.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64"
        },
        "product_reference": "libospf0-1.2.4-2.14.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libospf0-1.2.4-2.14.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le"
        },
        "product_reference": "libospf0-1.2.4-2.14.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libospf0-1.2.4-2.14.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x"
        },
        "product_reference": "libospf0-1.2.4-2.14.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libospf0-1.2.4-2.14.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64"
        },
        "product_reference": "libospf0-1.2.4-2.14.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libospfapiclient0-1.2.4-2.14.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64"
        },
        "product_reference": "libospfapiclient0-1.2.4-2.14.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libospfapiclient0-1.2.4-2.14.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le"
        },
        "product_reference": "libospfapiclient0-1.2.4-2.14.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libospfapiclient0-1.2.4-2.14.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x"
        },
        "product_reference": "libospfapiclient0-1.2.4-2.14.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libospfapiclient0-1.2.4-2.14.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64"
        },
        "product_reference": "libospfapiclient0-1.2.4-2.14.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libquagga_pb0-1.2.4-2.14.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64"
        },
        "product_reference": "libquagga_pb0-1.2.4-2.14.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libquagga_pb0-1.2.4-2.14.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le"
        },
        "product_reference": "libquagga_pb0-1.2.4-2.14.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libquagga_pb0-1.2.4-2.14.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x"
        },
        "product_reference": "libquagga_pb0-1.2.4-2.14.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libquagga_pb0-1.2.4-2.14.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64"
        },
        "product_reference": "libquagga_pb0-1.2.4-2.14.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzebra1-1.2.4-2.14.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64"
        },
        "product_reference": "libzebra1-1.2.4-2.14.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzebra1-1.2.4-2.14.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le"
        },
        "product_reference": "libzebra1-1.2.4-2.14.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzebra1-1.2.4-2.14.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x"
        },
        "product_reference": "libzebra1-1.2.4-2.14.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libzebra1-1.2.4-2.14.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64"
        },
        "product_reference": "libzebra1-1.2.4-2.14.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-1.2.4-2.14.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64"
        },
        "product_reference": "quagga-1.2.4-2.14.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-1.2.4-2.14.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le"
        },
        "product_reference": "quagga-1.2.4-2.14.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-1.2.4-2.14.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x"
        },
        "product_reference": "quagga-1.2.4-2.14.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-1.2.4-2.14.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64"
        },
        "product_reference": "quagga-1.2.4-2.14.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-devel-1.2.4-2.14.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64"
        },
        "product_reference": "quagga-devel-1.2.4-2.14.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-devel-1.2.4-2.14.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le"
        },
        "product_reference": "quagga-devel-1.2.4-2.14.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-devel-1.2.4-2.14.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x"
        },
        "product_reference": "quagga-devel-1.2.4-2.14.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-devel-1.2.4-2.14.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        },
        "product_reference": "quagga-devel-1.2.4-2.14.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2006-2223",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2006-2223"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote attackers to obtain sensitive information (routing state) via REQUEST packets such as SEND UPDATE.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2006-2223",
          "url": "https://www.suse.com/security/cve/CVE-2006-2223"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 173828 for CVE-2006-2223",
          "url": "https://bugzilla.suse.com/173828"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2006-2223"
    },
    {
      "cve": "CVE-2007-1995",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2007-1995"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "bgpd/bgp_attr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes, which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2007-1995",
          "url": "https://www.suse.com/security/cve/CVE-2007-1995"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 266100 for CVE-2007-1995",
          "url": "https://bugzilla.suse.com/266100"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2007-1995"
    },
    {
      "cve": "CVE-2017-16227",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-16227"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-16227",
          "url": "https://www.suse.com/security/cve/CVE-2017-16227"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1065641 for CVE-2017-16227",
          "url": "https://bugzilla.suse.com/1065641"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-16227"
    },
    {
      "cve": "CVE-2017-5495",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5495"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet \u0027vty\u0027 CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local access only by default. The Quagga telnet interface \u0027vty\u0027 input buffer grows automatically, without bound, so long as a newline is not entered. This allows an attacker to cause the Quagga daemon to allocate unbounded memory by sending very long strings without a newline. Eventually the daemon is terminated by the system, or the system itself runs out of memory. This is fixed in Quagga 1.1.1 and Free Range Routing (FRR) Protocol Suite 2017-01-10.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5495",
          "url": "https://www.suse.com/security/cve/CVE-2017-5495"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1021669 for CVE-2017-5495",
          "url": "https://bugzilla.suse.com/1021669"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5495"
    },
    {
      "cve": "CVE-2018-5278",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5278"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e00c. NOTE: the vendor reported that they \"have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5278",
          "url": "https://www.suse.com/security/cve/CVE-2018-5278"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-5278"
    },
    {
      "cve": "CVE-2018-5279",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5279"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c40e02c. NOTE: the vendor reported that they \"have not been able to reproduce the issue on any Windows operating system version (32-bit or 64-bit).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5279",
          "url": "https://www.suse.com/security/cve/CVE-2018-5279"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-5279"
    },
    {
      "cve": "CVE-2018-5280",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5280"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SonicWall SonicOS on Network Security Appliance (NSA) 2016 Q4 devices has XSS via the Configure SSO screens.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5280",
          "url": "https://www.suse.com/security/cve/CVE-2018-5280"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-5280"
    },
    {
      "cve": "CVE-2018-5281",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5281"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5281",
          "url": "https://www.suse.com/security/cve/CVE-2018-5281"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-5281"
    },
    {
      "cve": "CVE-2018-5378",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5378"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5378",
          "url": "https://www.suse.com/security/cve/CVE-2018-5378"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1079798 for CVE-2018-5378",
          "url": "https://bugzilla.suse.com/1079798"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-5378"
    },
    {
      "cve": "CVE-2018-5379",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5379"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5379",
          "url": "https://www.suse.com/security/cve/CVE-2018-5379"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1079799 for CVE-2018-5379",
          "url": "https://bugzilla.suse.com/1079799"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2018-5379"
    },
    {
      "cve": "CVE-2018-5380",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5380"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5380",
          "url": "https://www.suse.com/security/cve/CVE-2018-5380"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1079800 for CVE-2018-5380",
          "url": "https://bugzilla.suse.com/1079800"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-5380"
    },
    {
      "cve": "CVE-2018-5381",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5381"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of \"Capabilities\" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
          "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5381",
          "url": "https://www.suse.com/security/cve/CVE-2018-5381"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1079801 for CVE-2018-5381",
          "url": "https://bugzilla.suse.com/1079801"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libfpm_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospf0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libospfapiclient0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libquagga_pb0-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:libzebra1-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-1.2.4-2.14.x86_64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.aarch64",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.ppc64le",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.s390x",
            "openSUSE Tumbleweed:quagga-devel-1.2.4-2.14.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-5381"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for quagga",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for quagga fixes the following security issues:\n\n- The Quagga BGP daemon contained a bug in the AS_PATH size calculation that\n  could have been exploited to facilitate a remote denial-of-service attack via\n  specially crafted BGP UPDATE messages. [CVE-2017-16227, bsc#1065641]\n\n- The Quagga BGP daemon did not check whether data sent to peers via NOTIFY had\n  an invalid attribute length. It was possible to exploit this issue and cause\n  the bgpd process to leak sensitive information over the network to a\n  configured peer. [CVE-2018-5378, bsc#1079798]\n\n- The Quagga BGP daemon used to double-free memory when processing certain\n  forms of UPDATE messages. This issue could be exploited by sending an\n  optional/transitive UPDATE attribute that all conforming eBGP speakers should\n  pass along. Consequently, a single UPDATE message could have affected many\n  bgpd processes across a wide area of a network. Through this vulnerability,\n  attackers could potentially have taken over control of affected bgpd\n  processes remotely. [CVE-2018-5379, bsc#1079799]\n\n- It was possible to overrun internal BGP code-to-string conversion tables in\n  the Quagga BGP daemon. Configured peers could have exploited this issue and\n  cause bgpd to emit debug and warning messages into the logs that would\n  contained arbitrary bytes. [CVE-2018-5380, bsc#1079800]\n\n- The Quagga BGP daemon could have entered an infinite loop if sent an invalid\n  OPEN message by a configured peer. If this issue was exploited, then bgpd\n  would cease to respond to any other events. BGP sessions would have been\n  dropped and not be reestablished. The CLI interface would have been\n  unresponsive. The bgpd daemon would have stayed in this state until\n  restarted. [CVE-2018-5381, bsc#1079801]\n\n- The Quagga daemon\u0027s telnet \u0027vty\u0027 CLI contains an unbounded memory allocation\n  bug that could be exploited for a denial-of-service attack on the daemon.\n  This issue has been fixed. [CVE-2017-5495, bsc#1021669]\n\n- The telnet \u0027vty\u0027 CLI of the Quagga daemon is no longer enabled by default,\n  because the passwords in the default \u0027zebra.conf\u0027 config file are now\n  disabled. The vty interface is available via \u0027vtysh\u0027 utility using pam\n  authentication to permit management access for root without password.\n  [bsc#1021669]\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-OpenStack-Cloud-6-2018-315,SUSE-SLE-SAP-12-SP1-2018-315,SUSE-SLE-SERVER-12-2018-315,SUSE-SLE-SERVER-12-SP1-2018-315",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_0455-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2018:0455-1",
        "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20180455-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2018:0455-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-February/003733.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1021669",
        "url": "https://bugzilla.suse.com/1021669"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1065641",
        "url": "https://bugzilla.suse.com/1065641"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1079798",
        "url": "https://bugzilla.suse.com/1079798"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1079799",
        "url": "https://bugzilla.suse.com/1079799"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1079800",
        "url": "https://bugzilla.suse.com/1079800"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1079801",
        "url": "https://bugzilla.suse.com/1079801"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-16227 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-16227/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5495 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5495/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5378 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5378/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5379 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5379/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5380 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5380/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5381 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5381/"
      }
    ],
    "title": "Security update for quagga",
    "tracking": {
      "current_release_date": "2018-02-16T01:03:32Z",
      "generator": {
        "date": "2018-02-16T01:03:32Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2018:0455-1",
      "initial_release_date": "2018-02-16T01:03:32Z",
      "revision_history": [
        {
          "date": "2018-02-16T01:03:32Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "quagga-0.99.22.1-16.4.1.ppc64le",
                "product": {
                  "name": "quagga-0.99.22.1-16.4.1.ppc64le",
                  "product_id": "quagga-0.99.22.1-16.4.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "quagga-0.99.22.1-16.4.1.s390x",
                "product": {
                  "name": "quagga-0.99.22.1-16.4.1.s390x",
                  "product_id": "quagga-0.99.22.1-16.4.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "quagga-0.99.22.1-16.4.1.x86_64",
                "product": {
                  "name": "quagga-0.99.22.1-16.4.1.x86_64",
                  "product_id": "quagga-0.99.22.1-16.4.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud 6",
                "product": {
                  "name": "SUSE OpenStack Cloud 6",
                  "product_id": "SUSE OpenStack Cloud 6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-openstack-cloud:6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP1-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP1-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12:sp1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-0.99.22.1-16.4.1.x86_64 as component of SUSE OpenStack Cloud 6",
          "product_id": "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
        },
        "product_reference": "quagga-0.99.22.1-16.4.1.x86_64",
        "relates_to_product_reference": "SUSE OpenStack Cloud 6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-0.99.22.1-16.4.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le"
        },
        "product_reference": "quagga-0.99.22.1-16.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-0.99.22.1-16.4.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64"
        },
        "product_reference": "quagga-0.99.22.1-16.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-0.99.22.1-16.4.1.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le"
        },
        "product_reference": "quagga-0.99.22.1-16.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-0.99.22.1-16.4.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x"
        },
        "product_reference": "quagga-0.99.22.1-16.4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-0.99.22.1-16.4.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64"
        },
        "product_reference": "quagga-0.99.22.1-16.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-0.99.22.1-16.4.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le"
        },
        "product_reference": "quagga-0.99.22.1-16.4.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-0.99.22.1-16.4.1.s390x as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x"
        },
        "product_reference": "quagga-0.99.22.1-16.4.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quagga-0.99.22.1-16.4.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64"
        },
        "product_reference": "quagga-0.99.22.1-16.4.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-16227",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-16227"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-16227",
          "url": "https://www.suse.com/security/cve/CVE-2017-16227"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1065641 for CVE-2017-16227",
          "url": "https://bugzilla.suse.com/1065641"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-16T01:03:32Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-16227"
    },
    {
      "cve": "CVE-2017-5495",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5495"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet \u0027vty\u0027 CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local access only by default. The Quagga telnet interface \u0027vty\u0027 input buffer grows automatically, without bound, so long as a newline is not entered. This allows an attacker to cause the Quagga daemon to allocate unbounded memory by sending very long strings without a newline. Eventually the daemon is terminated by the system, or the system itself runs out of memory. This is fixed in Quagga 1.1.1 and Free Range Routing (FRR) Protocol Suite 2017-01-10.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5495",
          "url": "https://www.suse.com/security/cve/CVE-2017-5495"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1021669 for CVE-2017-5495",
          "url": "https://bugzilla.suse.com/1021669"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-16T01:03:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5495"
    },
    {
      "cve": "CVE-2018-5378",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5378"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5378",
          "url": "https://www.suse.com/security/cve/CVE-2018-5378"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1079798 for CVE-2018-5378",
          "url": "https://bugzilla.suse.com/1079798"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-16T01:03:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-5378"
    },
    {
      "cve": "CVE-2018-5379",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5379"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5379",
          "url": "https://www.suse.com/security/cve/CVE-2018-5379"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1079799 for CVE-2018-5379",
          "url": "https://bugzilla.suse.com/1079799"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-16T01:03:32Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2018-5379"
    },
    {
      "cve": "CVE-2018-5380",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5380"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5380",
          "url": "https://www.suse.com/security/cve/CVE-2018-5380"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1079800 for CVE-2018-5380",
          "url": "https://bugzilla.suse.com/1079800"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-16T01:03:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-5380"
    },
    {
      "cve": "CVE-2018-5381",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5381"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of \"Capabilities\" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
          "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5381",
          "url": "https://www.suse.com/security/cve/CVE-2018-5381"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1079801 for CVE-2018-5381",
          "url": "https://bugzilla.suse.com/1079801"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:quagga-0.99.22.1-16.4.1.x86_64",
            "SUSE OpenStack Cloud 6:quagga-0.99.22.1-16.4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-02-16T01:03:32Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-5381"
    }
  ]
}