CVE-2022-37032

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.suse.com/show_bug.cgi?id=1202023Exploit, Issue Tracking, Third Party Advisory
https://github.com/FRRouting/frr/commit/6d58272b4cf96f0daa846210dd2104877900f921Patch
https://github.com/FRRouting/frr/commit/ff6db1027f8f36df657ff2e5ea167773752537edPatch
https://lists.debian.org/debian-lts-announce/2022/11/msg00039.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2023/dsa-5362Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1202023Exploit, Issue Tracking, Third Party Advisory
https://github.com/FRRouting/frr/commit/6d58272b4cf96f0daa846210dd2104877900f921Patch
https://github.com/FRRouting/frr/commit/ff6db1027f8f36df657ff2e5ea167773752537edPatch
https://lists.debian.org/debian-lts-announce/2022/11/msg00039.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2023/dsa-5362Third Party Advisory

Timeline

Published: Sep 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-370336.5In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF acces CVE-2022-370345.3In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file CVE-2022-370358.1An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a CVE-2022-37045.4A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_di CVE-2022-370417.5An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The value of the X-Fo CVE-2022-370429.8Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypa CVE-2022-370435.7An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not CVE-2022-370446.1In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partiall CVE-2022-370477.8The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_ipv6_next at common/get.c:713. NO CVE-2022-370487.8The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_l2len_protocol at common/get.c:34 CVE-2022-370497.8The component tcpprep in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in parse_mpls at common/get.c:150. NOTE: th CVE-2022-37057.5A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix