Read the docs
TI-2015-06661 Aliases CVE-2015-8011GHSA-9f79-mcm7-48p3

Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before…

Priority MEDIUM 50CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 12 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-120 and the CVSS impact.

Summary

Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.

Why it matters now

EPSS 0.05473 92nd percentileScored 2026-11-07
Fix Partial Red Hat: 7 advisoriesRed Hat: 12 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:lldpd_project:lldpd:*:*:*:*:*:*:*:*0.5.6 to before 0.8.0VulnerableLldpd Project
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
  • cpe:2.3:a:lldpd_project:lldpd:*:*:*:*:*:*:*:* Versions 0.5.6 to before 0.8.0 Vulnerable ·Lldpd Project
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject

Remediation

Red Hat 7 advisories

  • RHSA-2021:2205 Released 2021-06-02 · Red Hat rating Important
    Red Hat OpenStack Platform 10.0 (openvswitch) security update
    • OpenStack 10.0 Tools for RHEL 7 openvswitch-2.9.9-1.el7fdp, openvswitch-test-2.9.9-1.el7fdp
    • Red Hat OpenStack Platform 10.0 openvswitch-2.9.9-1.el7fdp, openvswitch-devel-2.9.9-1.el7fdp, python-openvswitch-2.9.9-1.el7fdp
  • RHSA-2021:2077 Released 2021-05-20 · Red Hat rating Important
    openvswitch security update
    • Fast Datapath for Red Hat Enterprise Linux 7 openvswitch-2.9.9-1.el7fdp, openvswitch-devel-2.9.9-1.el7fdp, openvswitch-test-2.9.9-1.el7fdp +1
    • Red Hat Virtualization 4.2 Management Agent for RHEL 7.6 EUS Hosts openvswitch-2.9.9-1.el7fdp, openvswitch-devel-2.9.9-1.el7fdp, python-openvswitch-2.9.9-1.el7fdp
  • RHSA-2021:0988 Released 2021-03-25 · Red Hat rating Moderate
    rhvm-appliance security, bug fix, and enhancement update
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 rhvm-appliance-2:4.4-20210310.0.el8ev
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-2:4.4-20210310.0.el8ev
Show 4 more Red Hat advisories
  • RHSA-2021:0931 Released 2021-03-18 · Red Hat rating Important
    openvswitch2.11 and ovn2.11 security update
    • Red Hat OpenStack Platform 13.0 openvswitch-selinux-extra-policy-1.0-17.el7fdp, openvswitch2.11-2.11.3-77.el7fdp, openvswitch2.11-devel-2.11.3-77.el7fdp +6
  • RHSA-2021:0028 Released 2021-01-06 · Red Hat rating Important
    Red Hat Virtualization security, bug fix, and enhancement update
    • RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-virtualization-host-4.3.12-20201216.0.el7_9, redhat-virtualization-host-image-update-4.3.12-20201216.0.el7_9
    • RHV-M 4.3 openvswitch2.11-2.11.3-77.el7fdp, openvswitch2.11-devel-2.11.3-77.el7fdp, ovn2.11-2.11.1-56.el7fdp +3
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host-4.3.12-20201216.0.el7_9, redhat-virtualization-host-image-update-4.3.12-20201216.0.el7_9
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts openvswitch2.11-2.11.3-77.el7fdp, openvswitch2.11-devel-2.11.3-77.el7fdp, ovn2.11-2.11.1-56.el7fdp +3
  • RHSA-2020:5615 Released 2020-12-21 · Red Hat rating Important
    OpenShift Container Platform 4.6.9 packages and security update
    • Red Hat OpenShift Container Platform 4.6 network-scripts-openvswitch2.13-2.13.0-72.el8fdp, openvswitch2.13-2.13.0-72.el8fdp, openvswitch2.13-devel-2.13.0-72.el8fdp +2
  • RHSA-2020:5611 Released 2020-12-17 · Red Hat rating Important
    Red Hat Virtualization security, bug fix, and enhancement update
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.4.3-20201210.0.el8_3, redhat-virtualization-host-image-update-4.4.3-20201210.0.el8_3
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts cockpit-ovirt-0.14.15-1.el8ev, cockpit-ovirt-dashboard-0.14.15-1.el8ev

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Fast Datapath for RHEL 7AffectedNo fix planned: Out of support scope
Fast Datapath for RHEL 8AffectedNo fix planned: Out of support scope
Fast Datapath for Red Hat Enterprise Linux 7Fixed RHSA-2021:2077
Fast Datapath for Red Hat Enterprise Linux 8Fixed—
OpenStack 10.0 Tools for RHEL 7Fixed RHSA-2021:2205
RHEL 7-based RHEV-H for RHEV 4 (build requirements)Fixed RHSA-2021:0028
RHV-M 4.3Fixed RHSA-2021:0028
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2020:5615
Red Hat OpenStack Platform 10.0Fixed RHSA-2021:2205
Red Hat OpenStack Platform 13.0Fixed RHSA-2021:0931
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2021:0028
Red Hat Virtualization 4 Hypervisor for RHEL 8Fixed RHSA-2020:5611, RHSA-2021:0988
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2021:0028, RHSA-2021:0988
Red Hat Virtualization 4.2 Management Agent for RHEL 7.6 EUS HostsFixed RHSA-2021:2077
Not affected: 7 products
  • RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • Red Hat Enterprise Linux 8
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat Virtualization 4
  • Red Hat Virtualization 4 Hypervisor for RHEL 8
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-8011
  2. 2026-10-03 Alias added: GHSA-9f79-mcm7-48p3

References

Patch 3

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences