A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.

🗓️ 30 Jun 2024 14:00:00Reported by MicrosoftType

Avahi flaw 0.8-5 lets a local attacker crash the service via invalid hostname resolutions through socket or interprocess bus.

Reporter	Title	Published	Views	Family All 49
attackerkb	CVE-2021-3502	7 May 202112:15	–	attackerkb
AlpineLinux	CVE-2021-3502	7 May 202111:46	–	alpinelinux
AlmaLinux	Moderate: avahi security update	7 Nov 202300:00	–	almalinux
Information Security Automation	Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs	30 Dec 202218:03	–	avleonov
BDU FSTEC	The vulnerability of the avahi_s_host_name_resolver_start function in the Avahi service discovery system in local networks allows a attacker to trigger a service failure. This vulnerability is related to pointer arithmetic errors.	20 Sep 202100:00	–	bdu_fstec
CBLMariner	CVE-2021-3502 affecting package avahi for versions less than 0.8-1	19 Mar 202417:21	–	cbl_mariner
Tenable Nessus	Rocky Linux 9.2 [CIQ] Security Update: avahi / avahi-autoipd / avahi-autoipd-debuginfo / avahi-compat-howl / etc Multiple Vulnerabilities (ciqsa-2026_0387)	1 Oct 202600:00	–	nessus
Tenable Nessus	MiracleLinux 9 : avahi-0.8-15.el9 (AXSA:2023-6723:02)	20 Jan 202600:00	–	nessus
Tenable Nessus	Oracle Linux 9 : avahi (ELSA-2023-6707)	16 Nov 202300:00	–	nessus
Tenable Nessus	RHEL 9 : avahi (RHSA-2023:6707)	7 Nov 202300:00	–	nessus