What’s Vulnerable › Vulnerabilities

CVE-2015-8011

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-28 · updated 2026-06-17
• Weakness: CWE-120

Description

Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.

Affected products

• Debian Linux: 9.0, 10.0
• Fedoraproject Fedora: 33
• lldpd: from 0.5.6 before 0.8.0 — fixed in 0.8.0

How to fix

Upgrade to a fixed version: lldpd 0.8.0. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2015/10/16/2
• http://www.openwall.com/lists/oss-security/2015/10/30/2
• https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf
• https://github.com/vincentbernat/lldpd/commit/dd4f16e7e816f2165fba76e3d162cd8d2978dcb2
• https://lists.debian.org/debian-lts-announce/2021/02/msg00032.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJ4DXFJWMZ325ECZXPZOSK7BOEDJZHPR/
• https://us-cert.cisa.gov/ics/advisories/icsa-21-194-07
• https://www.debian.org/security/2021/dsa-4836
• http://www.openwall.com/lists/oss-security/2015/10/16/2
• http://www.openwall.com/lists/oss-security/2015/10/30/2
• https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf
• https://github.com/vincentbernat/lldpd/commit/dd4f16e7e816f2165fba76e3d162cd8d2978dcb2

Get alerted when CVE-2015-8011 or the next vulnerability affects your stack