CVE-2015-8011

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/10/16/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/10/30/2Mailing List, Patch, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf
https://github.com/vincentbernat/lldpd/commit/dd4f16e7e816f2165fba76e3d162cd8d2978dcb2Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00032.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJ4DXFJWMZ325ECZXPZOSK7BOEDJZHPR/
https://us-cert.cisa.gov/ics/advisories/icsa-21-194-07
https://www.debian.org/security/2021/dsa-4836Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/10/16/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/10/30/2Mailing List, Patch, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf
https://github.com/vincentbernat/lldpd/commit/dd4f16e7e816f2165fba76e3d162cd8d2978dcb2Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00032.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJ4DXFJWMZ325ECZXPZOSK7BOEDJZHPR/
https://us-cert.cisa.gov/ics/advisories/icsa-21-194-07
https://www.debian.org/security/2021/dsa-4836Third Party Advisory

Timeline

Published: Jan 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-80127.5lldpd before 0.8.0 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via a malformed packet.CVE-2015-80137.5s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass a CVE-2015-80197.8The skb_copy_and_csum_datagram_iovec function in net/core/datagram.c in the Linux kernel 3.14.54 and 3.18.22 does not accept a length argume CVE-2015-80203.7Clustered Data ONTAP versions 8.0, 8.3.1, and 8.3.2 contain a default privileged account which under certain conditions can be used for unau CVE-2015-80214.3Incomplete blacklist vulnerability in the Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, Link Controller, and PSM 11.x be CVE-2015-80227.5The Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, and Link Controller 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.CVE-2015-80235.0The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not pro CVE-2015-80249.3McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC)CVE-2015-80252.1driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate att CVE-2015-80267.8Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a d CVE-2015-80277.5Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, whic CVE-2015-80286.8Multiple buffer overflows in SAP 3D Visual Enterprise Viewer (VEV) allow remote attackers to execute arbitrary code via a crafted (1) 3DM or