Threats tagged 'ghsa-wjc3-2qjv-c8fp'

FRRouting versions before 10.5.3 have an integer overflow vulnerability in several OSPF Traffic Engineering and Segment Routing TLV parser functions. This flaw involves a uint16_t accumulator truncating uint32_t values, causing unchecked pointer advancement and out-of-bounds memory reads. An attacker with an established OSPF adjacency can exploit this by sending a crafted LS Update packet with malicious Type 10 or Type 11 Opaque LSA, leading to router crashes within the OSPF area or autonomous system.