dnsmasq security update

2017-10-02T23:34:13
ID CESA-2017:2838
Type centos
Reporter CentOS Project
Modified 2017-10-02T23:34:13

Description

CentOS Errata and Security Advisory CESA-2017:2838

The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.

Security Fix(es):

  • A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. (CVE-2017-14491)

Red Hat would like to thank Felix Wilhelm (Google Security Team), Fermin J. Serna (Google Security Team), Gabriel Campana (Google Security Team), Kevin Hamacher (Google Security Team), and Ron Bowes (Google Security Team) for reporting this issue.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2017-October/022554.html

Affected packages: dnsmasq dnsmasq-utils

Upstream details at: