The process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to cause a denial of service (stack-based buffer over-read and crash) via unspecified vectors.
http://www.ubuntu.com/usn/USN-1257-1
http://www.openwall.com/lists/oss-security/2011/10/06/3