Security update for frr

Announcement ID:	SUSE-SU-2026:1057-1
Release Date:	2026-03-26T08:58:49Z
Rating:	moderate
References:	bsc#1252761 bsc#1252810 bsc#1252811 bsc#1252812 bsc#1252813 bsc#1252829 bsc#1252833 bsc#1252835 bsc#1252838
Cross-References:	CVE-2025-61099 CVE-2025-61100 CVE-2025-61101 CVE-2025-61102 CVE-2025-61103 CVE-2025-61104 CVE-2025-61105 CVE-2025-61106 CVE-2025-61107
CVSS scores:	CVE-2025-61099 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61099 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61099 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61100 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61100 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61100 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61101 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61101 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61101 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61102 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61102 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61102 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61103 ( SUSE ): 6.0 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61103 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61103 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61104 ( SUSE ): 6.0 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61104 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61104 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61105 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61105 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61105 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61106 ( SUSE ): 6.0 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61106 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61106 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61107 ( SUSE ): 6.0 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2025-61107 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61107 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security SUSE Linux Enterprise Server for SAP Applications 12 SP5

An update that solves nine vulnerabilities can now be installed.

Description:

This update for frr fixes the following issues:

• CVE-2025-61099: NULL Pointer Dereference in FRRouting (bsc#1252838).
• CVE-2025-61100: NULL Pointer Dereference in FRRouting (bsc#1252829).
• CVE-2025-61101: NULL Pointer Dereference in FRRouting (bsc#1252833).
• CVE-2025-61102: NULL Pointer Dereference in FRRouting (bsc#1252835).
• CVE-2025-61103: NULL pointer dereference in show_vty_ext_link_lan_adj_sid() in ospf_ext.c (bsc#1252810).
• CVE-2025-61104: NULL pointer dereference in show_vty_unknown_tlv() in ospf_ext.c (bsc#1252811).
• CVE-2025-61105: NULL pointer dereference in show_vty_link_info() in ospf_ext.c (bsc#1252761).
• CVE-2025-61106: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252812).
• CVE-2025-61107: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252813).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-1057=1

Package List:

• SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)
  • libfrrcares0-8.5.6-8.9.1
  • libfrrospfapiclient0-debuginfo-8.5.6-8.9.1
  • frr-debuginfo-8.5.6-8.9.1
  • frr-devel-8.5.6-8.9.1
  • libfrr0-debuginfo-8.5.6-8.9.1
  • frr-debugsource-8.5.6-8.9.1
  • libfrrcares0-debuginfo-8.5.6-8.9.1
  • libfrr0-8.5.6-8.9.1
  • libfrrospfapiclient0-8.5.6-8.9.1
  • frr-8.5.6-8.9.1
  • libfrrsnmp0-8.5.6-8.9.1
  • libfrrsnmp0-debuginfo-8.5.6-8.9.1

References:

• https://www.suse.com/security/cve/CVE-2025-61099.html
• https://www.suse.com/security/cve/CVE-2025-61100.html
• https://www.suse.com/security/cve/CVE-2025-61101.html
• https://www.suse.com/security/cve/CVE-2025-61102.html
• https://www.suse.com/security/cve/CVE-2025-61103.html
• https://www.suse.com/security/cve/CVE-2025-61104.html
• https://www.suse.com/security/cve/CVE-2025-61105.html
• https://www.suse.com/security/cve/CVE-2025-61106.html
• https://www.suse.com/security/cve/CVE-2025-61107.html
• https://bugzilla.suse.com/show_bug.cgi?id=1252761
• https://bugzilla.suse.com/show_bug.cgi?id=1252810
• https://bugzilla.suse.com/show_bug.cgi?id=1252811
• https://bugzilla.suse.com/show_bug.cgi?id=1252812
• https://bugzilla.suse.com/show_bug.cgi?id=1252813
• https://bugzilla.suse.com/show_bug.cgi?id=1252829
• https://bugzilla.suse.com/show_bug.cgi?id=1252833
• https://bugzilla.suse.com/show_bug.cgi?id=1252835
• https://bugzilla.suse.com/show_bug.cgi?id=1252838