CVE-2018-5378
MediumThe Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid.
Published Feb 19, 2018 · Updated Feb 4, 2026
Key Facts
Patch immediately- CVE-2018-5378 is a medium-severity vulnerability (CVSS 5.9 v3.1) affecting Quagga, Ubuntu Linux (Canonical), Debian Linux and 7 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 74% probability of exploitation in the next 30 days.
- Fixed versions are available, including bgpd 1.2.3, libfpm_pb0 1.1.1-17.13.1, libfpm_pb0 1.1.1-17.7.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.9
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
EPSS (30-day exploit likelihood)
74%
Higher than 99.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2018-5378 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash.
Affected Products
97 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| QuaggaQuagga | See advisory | 1.2.2 |
| Ubuntu LinuxCanonical | 14.04, 16.04, 17.10 | n/a |
| Debian LinuxDebian | 8.0, 9.0 | n/a |
| libfpm_pb0suse | See advisory | 1.1.1-18.3.1 |
| libospf0suse | See advisory | 1.1.1-18.3.1 |
Patched Releases
bgpd
1.2.3
libfpm_pb0
1.1.1-17.13.1, 1.1.1-17.7.1, 1.1.1-18.3.1, 1.2.4-2.14
libospf0
1.1.1-17.13.1, 1.1.1-17.7.1, 1.1.1-18.3.1, 1.2.4-2.14
libospfapiclient0
1.1.1-17.13.1, 1.1.1-17.7.1, 1.1.1-18.3.1, 1.2.4-2.14
libquagga_pb0
1.1.1-17.13.1, 1.1.1-17.7.1, 1.1.1-18.3.1, 1.2.4-2.14
libzebra1
1.1.1-17.13.1, 1.1.1-17.7.1, 1.1.1-18.3.1, 1.2.4-2.14
Quagga
0.99.15-0.30.3.1, 0.99.22.1-16.4.1, 1.1.1-17.13.1, 1.1.1-17.7.1, 1.1.1-18.3.1, 1.2.4-2.14, <=1.2.2
quagga-devel
0.99.15-0.30.3.1, 1.1.1-17.13.1, 1.1.1-17.7.1, 1.1.1-18.3.1, 1.2.4-2.14
Timeline
Publicly disclosed
Feb 19, 2018
Last updated
Feb 4, 2026
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-125 Out-of-bounds Read
References
- advisoryhttp://savannah.nongnu.org/forum/forum.php?forum_id=9095
- advisoryhttps://bugzilla.suse.com/1021669
- advisoryhttps://bugzilla.suse.com/1065641
- advisoryhttps://bugzilla.suse.com/1069468
- advisoryhttps://bugzilla.suse.com/1079798
FAQ
Common Questions.
The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid.
Affected: Quagga; Ubuntu Linux (Canonical) versions 14.04, 16.04, 17.10; Debian Linux versions 8.0, 9.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including bgpd 1.2.3, libfpm_pb0 1.1.1-17.13.1, libfpm_pb0 1.1.1-17.7.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2018-5378 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo