CVE-2015-5621

Publication date 31 July 2015

Last updated 8 December 2025

Ubuntu priority

Cvss 3 Severity Score

Description

The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
net-snmp	15.04 vivid	Fixed 5.7.2~dfsg-8.1ubuntu5.1
	14.04 LTS trusty	Fixed 5.7.2~dfsg-8.1ubuntu3.1
	12.04 LTS precise	Fixed 5.4.3~dfsg-2.4ubuntu1.3

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
net-snmp	Upstream: http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

USN-2711-1
Net-SNMP vulnerabilities
17 August 2015