-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 02 Jun 2026 15:30:27 +0800
Source: frr
Architecture: source
Version: 8.4.4-1.1~deb12u2
Distribution: bookworm-security
Urgency: high
Maintainer: David Lamparter <equinox-debian@diac24.net>
Changed-By: Aron Xu <aron@debian.org>
Changes:
frr (8.4.4-1.1~deb12u2) bookworm-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* Backport upstream fixes for several BGP/OSPF/babeld vulnerabilities:
- CVE-2026-37457: off-by-one out-of-bounds write in the BGP FlowSpec
operator decoder.
- CVE-2026-28532: out-of-bounds read in OSPF TE/SR Opaque LSA TLV parsing
caused by a truncated length accumulator (ospf_te_delete_te hunk adapted
to the 8.4.4 edge-key code).
- CVE-2026-5107: missing length validation when parsing EVPN Type-2/3/4 and
ENCAP/VNC NLRIs (hand-ported to the 8.4.4 EVPN code).
- CVE-2026-37458: missing martian next-hop validation in MP_REACH_NLRI.
- CVE-2025-61099, CVE-2025-61100, CVE-2025-61101, CVE-2025-61102,
CVE-2025-61103, CVE-2025-61104, CVE-2025-61105, CVE-2025-61106,
CVE-2025-61107: NULL pointer dereference in ospfd when dumping Opaque
LSAs while OSPF packet debugging is enabled.
- CVE-2023-3748: infinite loop (DoS) in babeld packet parsing.
- CVE-2024-27913, CVE-2024-31950, CVE-2024-31951, CVE-2024-34088: crashes
and buffer overflows in OSPF Traffic Engineering / Opaque LSA parsing.
Checksums-Sha1:
d4a0d98c9c0c7073379c2ef22bb1f1961a80c7ef 2395 frr_8.4.4-1.1~deb12u2.dsc
345e0128542db4dc96781f5db305891680447a38 42676 frr_8.4.4-1.1~deb12u2.debian.tar.xz
e1dce573bd12f8e8fbe766a63fbc70d09c89b245 8447 frr_8.4.4-1.1~deb12u2_source.buildinfo
Checksums-Sha256:
35807adca17c6b3dc0abc8c5fb70cbd157a5663db19eebcaef4bb5df7dd67ae6 2395 frr_8.4.4-1.1~deb12u2.dsc
44d05e0c00278fd6d2c600b7317c466e73e57fb6684ae406c2da29aff4429a3c 42676 frr_8.4.4-1.1~deb12u2.debian.tar.xz
44546dbbdabb11239509b994995c71d5c9631cffef78f428a578345d98dc7bce 8447 frr_8.4.4-1.1~deb12u2_source.buildinfo
Files:
15bb52c5875a452279577747e58c2ed5 2395 net optional frr_8.4.4-1.1~deb12u2.dsc
4c90b7a91b68d616f74d3c43b1d6278d 42676 net optional frr_8.4.4-1.1~deb12u2.debian.tar.xz
b191850ddd28faf218be03d26103f295 8447 net optional frr_8.4.4-1.1~deb12u2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmog9Z0ACgkQ+GQ1dHE8
m66v7Qf9Gecu15XX/hXQz3vRXo1jezRaSEZOsk67I9mENoaj1xFPKr6KKUvuPSLp
VkNr8F1Qy+V97J2WdseXobdVhozPmVKRzt99CRc2QfM0dI1sGLMFcLy/OCbkHKQc
bbZp6o07Zs8ce61J7JPpLbRtcsXqwSM8+wk0F/kFpvfwBZ3N0cf/+XMpfUFooo+p
PImsNeLrDtf/LhsIs901GNJvLCLcMPxWRg2ZP4VIlew1E7CfBFGy4vFWhLbQzoXx
SlFKHr/zoUjTjmyXATOP7Q0PbFGx8jiGSWhMAEeVOse2PL+E2oEGDgzm41OHZlH7
Mncl+pXdTsa8gHKiEjEKiJmSCkr9Sg==
=RemS
-----END PGP SIGNATURE-----
