Back to CVE Browser

CVE-2015-8011

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1390%

EPSS Percentile5.88th

PublishedJan 28, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.

Affected Platforms (CPE)

📦

Lldpd Project

Lldpd

>= 0.5.6 and < 0.8.0

💻

Debian

Debian Linux

= 9.0

💻

Debian

Debian Linux

= 10.0

💻

Fedoraproject

Fedora

= 33

References & Advisories

🔗 http://www.openwall.com/lists/oss-security/2015/10/16/2

🔗 http://www.openwall.com/lists/oss-security/2015/10/30/2

🔗 https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf

🔗 https://github.com/vincentbernat/lldpd/commit/dd4f16e7e816f2165fba76e3d162cd8d2978dcb2

🔗 https://lists.debian.org/debian-lts-announce/2021/02/msg00032.html

🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJ4DXFJWMZ325ECZXPZOSK7BOEDJZHPR/

🔗 https://us-cert.cisa.gov/ics/advisories/icsa-21-194-07

🔗 https://www.debian.org/security/2021/dsa-4836

Related Vulnerabilities

CVE-2021-436127.5

In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap r...

CVE-2015-80127.5

lldpd before 0.8.0 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via a malformed packe...

CVE-2020-16416.5

A Race Condition vulnerability in Juniper Networks Junos OS LLDP implementation allows an attacker to cause LLDP to crash leading ...

CVE-2026-464336.5

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLA...