Skip to content
Fencer Intel
critical 9.8

CVE-2015-8011 json

Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of s…

published 6y ago modified 4mo ago also EUVD-2015-7907

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.5%
EPSS 5.5% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.

Patch / fix

  • lldpd_project lldpd 0.8.0
  • lldpd Debian 14, Debian 13, Debian 12 0.7.19-1
  • openvswitch Debian 14, Debian 13, Debian 12 2.15.0~git20210104.def6eb1ea+dfsg1-1

debian advisories DEBIAN-CVE-2015-8011

  • openvswitch Ubuntu 16.04 LTS 2.5.9-0ubuntu0.16.04.2
  • openvswitch Ubuntu 18.04 LTS 2.9.7-0ubuntu0.18.04.2
  • openvswitch Ubuntu 20.04 LTS 2.13.1-0ubuntu0.20.04.3

ubuntu advisories UBUNTU-CVE-2015-8011

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cockpit-ovirt rhev hypervisor 4.4 0.14.15-1.el8ev
  • cockpit-ovirt-dashboard rhev hypervisor 4.4 0.14.15-1.el8ev
  • redhat-virtualization-host rhev hypervisor 4.4 4.4.3-20201210.0.el8_3
  • redhat-virtualization-host-image-update rhev hypervisor 4.4 4.4.3-20201210.0.el8_3
  • rhvm-appliance rhev hypervisor 4.4 2:4.4-20210310.0.el8ev
  • ovn2.11 openstack 13 2.11.1-57.el7fdp
  • openvswitch2.11 rhev manager 4.3, RHEL 7, openstack 13 2.11.3-77.el7fdp
  • ovn2.11-host openstack 13 2.11.1-57.el7fdp

red hat advisories RHSA-2020:5611RHSA-2021:0988RHSA-2021:0931RHSA-2021:2077RHSA-2021:0028RHSA-2020:5615

  • openvswitch Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 2.12.2-r0

alpine advisories ALPINE-CVE-2015-8011

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openvswitch Arch Linux 2.14.1-1

arch linux advisories AVG-1456

Is CVE-2015-8011 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-8011 updated cvss 9.8

lldpd: buffer overflow in the lldp_decode function in daemon/protocols/lldp.c

  • Red Hat Fast Datapath for RHEL 7 openvswitch2.10, openvswitch2.12, openvswitch2.10-test, openvswitch2.12-test, python-openvswitch2.10, python-openvswitch2.12, +4 more Red Hat Fast Datapath for RHEL 8 openvswitch2.12, openvswitch2.12-test, python3-openvswitch2.12, network-scripts-openvswitch2.12
    affected: workaround, no fix planned “When the lldpd source is compiled with source fortification enabled, the flaw becomes unexploitable and will just cause a crash.”
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 7 openvswitch 2.9.9-1.el7fdp, openvswitch-test 2.9.9-1.el7fdp, openvswitch2.11 2.11.3-77.el7fdp, openvswitch2.13 2.13.0-62.el7fdp, python-openvswitch 2.9.9-1.el7fdp, openvswitch2.11-test 2.11.3-77.el7fdp, +3 more
    fixed: vendor fix “When the lldpd source is compiled with source fortification enabled, the flaw becomes unexploitable and will just cause a crash.” RHSA-2021:2077
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8 openvswitch2.11 2.11.3-74.el8fdp, openvswitch2.13 2.13.0-71.el8fdp, openvswitch2.11-test 2.11.3-74.el8fdp, openvswitch2.13-test 2.13.0-71.el8fdp, python3-openvswitch2.11 2.11.3-74.el8fdp, python3-openvswitch2.13 2.13.0-71.el8fdp, +2 more
    fixed: vendor fix “When the lldpd source is compiled with source fortification enabled, the flaw becomes unexploitable and will just cause a crash.” RHBA-2020:5311
  • Red Hat OpenStack 10.0 Tools for RHEL 7 openvswitch 2.9.9-1.el7fdp, openvswitch-test 2.9.9-1.el7fdp
    fixed: vendor fix “When the lldpd source is compiled with source fortification enabled, the flaw becomes unexploitable and will just cause a crash.” RHSA-2021:2205
  • Red Hat OpenShift Container Platform 4.6 openvswitch2.13 2.13.0-72.el8fdp, openvswitch2.13-test 2.13.0-72.el8fdp, python3-openvswitch2.13 2.13.0-72.el8fdp, network-scripts-openvswitch2.13 2.13.0-72.el8fdp
    fixed: vendor fix “When the lldpd source is compiled with source fortification enabled, the flaw becomes unexploitable and will just cause a crash.” RHSA-2020:5615
  • Red Hat OpenStack Platform 10.0 openvswitch 2.9.9-1.el7fdp, python-openvswitch 2.9.9-1.el7fdp
    fixed: vendor fix “When the lldpd source is compiled with source fortification enabled, the flaw becomes unexploitable and will just cause a crash.” RHSA-2021:2205
  • Red Hat OpenStack Platform 13.0 ovn2.11 2.11.1-57.el7fdp, ovn2.11-host 2.11.1-57.el7fdp, ovn2.11-vtep 2.11.1-57.el7fdp, openvswitch2.11 2.11.3-77.el7fdp, ovn2.11-central 2.11.1-57.el7fdp, openvswitch2.11-test 2.11.3-77.el7fdp, +2 more
    fixed: vendor fix “When the lldpd source is compiled with source fortification enabled, the flaw becomes unexploitable and will just cause a crash.” RHSA-2021:0931
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.3.12-20201216.0.el7_9, redhat-virtualization-host-image-update 4.3.12-20201216.0.el7_9
    fixed: vendor fix “When the lldpd source is compiled with source fortification enabled, the flaw becomes unexploitable and will just cause a crash.” RHSA-2021:0028
show 5 more
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 rhvm-appliance 4.4-20210310.0.el8ev, redhat-virtualization-host 4.4.3-20201210.0.el8_3, redhat-virtualization-host-image-update 4.4.3-20201210.0.el8_3
    fixed: vendor fix “When the lldpd source is compiled with source fortification enabled, the flaw becomes unexploitable and will just cause a crash.” RHSA-2021:0988
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts ovn2.11 2.11.1-56.el7fdp, ovn2.11-host 2.11.1-56.el7fdp, ovn2.11-vtep 2.11.1-56.el7fdp, openvswitch2.11 2.11.3-77.el7fdp, rhvm-appliance 4.4-20210310.0.el8ev, python-openvswitch2.11 2.11.3-77.el7fdp
    fixed: vendor fix “When the lldpd source is compiled with source fortification enabled, the flaw becomes unexploitable and will just cause a crash.” RHSA-2021:0028
  • Red Hat Virtualization 4.2 Management Agent for RHEL 7.6 EUS Hosts openvswitch 2.9.9-1.el7fdp, python-openvswitch 2.9.9-1.el7fdp
    fixed: vendor fix “When the lldpd source is compiled with source fortification enabled, the flaw becomes unexploitable and will just cause a crash.” RHSA-2021:2077
  • Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-virtualization-host 4.3.12-20201216.0.el7_9, redhat-virtualization-host-image-update 4.3.12-20201216.0.el7_9 Red Hat RHV-M 4.3 ovn2.11 2.11.1-56.el7fdp, ovn2.11-vtep 2.11.1-56.el7fdp, openvswitch2.11 2.11.3-77.el7fdp, ovn2.11-central 2.11.1-56.el7fdp, python-openvswitch2.11 2.11.3-77.el7fdp
    fixed: vendor fix “When the lldpd source is compiled with source fortification enabled, the flaw becomes unexploitable and will just cause a crash.” RHSA-2021:0028
  • Red Hat Enterprise Linux 8 lldpd Red Hat OpenShift Container Platform 4.6 python-sushy 3.5.0-2.20201005161238.74b8111.el8, python3-sushy 3.5.0-2.20201005161238.74b8111.el8, python3-sushy-tests 3.5.0-2.20201005161238.74b8111.el8, openshift-clients 4.6.0-202012121455.p0.git.3800.80a13a6.el7, openshift-clients 4.6.0-202012121455.p0.git.3800.80a13a6.el8, openshift-clients-redistributable 4.6.0-202012121455.p0.git.3800.80a13a6.el7, +1 more Red Hat Virtualization 4 rhv-openvswitch, rhv-python-openvswitch, rhv-openvswitch-ovn-host, rhv-openvswitch-ovn-common, rhv-openvswitch-ovn-central Red Hat Virtualization 4 Hypervisor for RHEL 8 v2v-conversion-host 1.16.2-8.el8ev, v2v-conversion-host-ansible 1.16.2-8.el8ev, v2v-conversion-host-wrapper 1.16.2-8.el8ev Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts cockpit-ovirt 0.14.15-1.el8ev, v2v-conversion-host 1.16.2-8.el8ev, cockpit-ovirt-dashboard 0.14.15-1.el8ev, v2v-conversion-host-wrapper 1.16.2-8.el8ev Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.3.12-4.el7ev, redhat-virtualization-host-image-update-placeholder 4.3.12-4.el7ev
    +1 more products
    Red Hat RHEL 8-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.4.3-2.el8ev, redhat-virtualization-host-image-update-placeholder 4.4.3-2.el8ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-21-194-07 updated cvss 9.8

Siemens Industrial Products LLDP (Update D)

  • Siemens SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) <V3.3.46 Siemens SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) <V3.3.46
    affected: fixed in V3.3.46, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) <V2.2.28 Siemens SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) <V2.2.28
    affected: fixed in V2.2.28, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) <V3.0
    affected: fixed in V3.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) <V2.2.28
    affected: fixed in V2.2.28, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0) <V1.1
    affected: fixed in V1.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC HMI Unified Comfort Panels <V17
    affected: fixed in V17, mitigation support.industry.siemens.com
  • Siemens SINUMERIK ONE MCP <V2.0.1
    affected: fixed in V2.0.1, mitigation
  • Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) <V2.2.28 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) <V2.2.28 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) <V2.2.28
    affected: fixed in V2.2.28, mitigation support.industry.siemens.com
show 3 more
  • Siemens SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) <V3.0
    affected: fixed in V3.0, mitigation support.industry.siemens.com
  • Siemens SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) <V3.3.46 Siemens SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) <V3.3.46
    affected: fixed in V3.3.46, mitigation support.industry.siemens.com
  • Siemens SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) <V2.2 Siemens TIM 1531 IRC (6GK7543-1MX00-0XE0) <V2.2
    affected: fixed in V2.2, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

5.47% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.