VDB
CISA-2015-5621
CISA-2015-5621
PUBLISHED
CVSS 7.5 HIGH
Reported by mitre · Published August 19, 2015
The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| n/a | n/a | n/a, * |
Timeline
- Aug 19, 2015 CVE Published
- Dec 4, 2025 CVE Updated
- Mar 26, 2026 Distribution Patch
- Mar 26, 2026 Distribution Patch
- Mar 26, 2026 Security Advisory
- Mar 26, 2026 Security Advisory
References
- openSUSE-SU-2015:1502 vendor-advisoryx_refsource_SUSE
- 45547 exploitx_refsource_EXPLOIT-DB
- x_refsource_CONFIRM
- RHSA-2015:1636 vendor-advisoryx_refsource_REDHAT
- 1033304 vdb-entryx_refsource_SECTRACK
- x_refsource_CONFIRM
- USN-2711-1 vendor-advisoryx_refsource_UBUNTU
- [oss-security] 20150416 Re: net-snmp snmp_pdu_parse() function incompletely initializaition vulnerability mailing-listx_refsource_MLIST
- [oss-security] 20150413 net-snmp snmp_pdu_parse() function incompletely initializaition vulnerability mailing-listx_refsource_MLIST
- x_refsource_CONFIRM
- DSA-4154 vendor-advisoryx_refsource_DEBIAN
- [oss-security] 20150731 Re: net-snmp snmp_pdu_parse() function incompletely initializaition vulnerability mailing-listx_refsource_MLIST
- x_refsource_CONFIRM
- 76380 vdb-entryx_refsource_BID
- x_refsource_CONFIRM