------------------------------------------------------------------------- Debian LTS Advisory DLA-3578-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Markus Koschany September 22, 2023 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : lldpd Version : 1.0.3-1+deb10u2 CVE ID : CVE-2023-41910 Matteo Memelli discovered a flaw in lldpd, an implementation of the IEEE 802.1ab protocol. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. For Debian 10 buster, this problem has been fixed in version 1.0.3-1+deb10u2. We recommend that you upgrade your lldpd packages. For the detailed security status of lldpd please refer to its security tracker page at: https://security-tracker.debian.org/tracker/lldpd Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part