quagga-0.99.22.4-5.el7

The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based protocols. Quagga supports the BGP4, BGP4 , OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is intended to be used as a Route Server and Route Reflector.

Security Fix(es):

* quagga: Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to crash or potentially execute arbitrary code (CVE-2018-5379)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Asianux would like to thank the Quagga project for reporting this issue.

CVE-2018-5379
The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free
memory when processing certain forms of UPDATE message, containing
cluster-list and/or unknown attributes. A successful attack could
cause a denial of service or potentially allow an attacker to execute
arbitrary code.