CVE-2016-2074 Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as demonst...
CriticalCVSS 9.8
EPSS 6.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as demonstrated by a long string in an ovs-appctl command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openvswitch(Debian:12) | < 2.3.0+git20140819-4 | 2.3.0+git20140819-4 |
| debian/openvswitch(Debian:13) | < 2.3.0+git20140819-4 | 2.3.0+git20140819-4 |
| debian/openvswitch(Debian:14) | < 2.3.0+git20140819-4 | 2.3.0+git20140819-4 |
| openvswitch | = 2.2.0 | No fix listed |
| openvswitch | = 2.3.0 | No fix listed |
| openvswitch | = 2.3.1 | No fix listed |
| openvswitch | = 2.3.2 | No fix listed |
| openvswitch | = 2.4.0 | No fix listed |
| redhat openshift | = 3.1 | No fix listed |
References
- Debian Security Tracker CVE-2016-2074 vendor-advisory
- [ovs-announce] 20160328 CVE-2016-2074: MPLS buffer overflow vulnerabilities in Open vSwitch mailing-list vendor-advisory
- [ovs-announce] 20160328 Open vSwitch 2.4.1 and 2.3.3 Available mailing-list patch
- RHSA-2016:0523 vendor-advisory
- RHSA-2016:0524 vendor-advisory
- RHSA-2016:0537 vendor-advisory
- DSA-3533 vendor-advisory
- 85700 vdb-entry
- RHSA-2016:0615 vendor-advisory
- bugzilla.redhat.com
- GLSA-201701-07 vendor-advisory
- support.citrix.com