This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2016-10377 →

DEBIAN-CVE-2016-10377

In Open vSwitch (OvS) 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer underflow...

Original description

The description as published by the source.

In Open vSwitch (OvS) 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer underflow in lib/flow.c in the function miniflow_extract, permitting remote bypass of the access control list enforced by the switch.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 openvswitch

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+git20161123-1"}]}]

Debian:13 openvswitch

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+git20161123-1"}]}]

Debian:14 openvswitch

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+git20161123-1"}]}]

References

advisory security-tracker.debian.org