Security update for c-ares (moderate)

openSUSE Security Update: Security update for c-ares Announcement ID: openSUSE-SU-2020:2045-1 Rating: moderate References: 1178882 Cross-References: CVE-2020-8277 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for c-ares fix...

SUSE-SU-2020:3478-1 Security update for c-ares

This update for c-ares fixes the following issues: - Version update to 1.17.0 CVE-2020-8277: Fixed a Denial of Service through DNS request bsc1178882 For further details see https://c-ares.haxx.se/changelog.html...

Ubuntu: Security Advisory (USN-4638-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4638-1: c-ares vulnerability

It was discovered that c-ares incorrectly handled certain DNS requests. An attacker could possibly use this issue to cause a denial of service...

[ASA-202011-18] c-ares: denial of service

Arch Linux Security Advisory ASA-202011-18 ========================================== Severity: Medium Date : 2020-11-19 CVE-ID : CVE-2020-8277 Package : c-ares Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1280 Summary ======= The package c-ares before version...

Security fix for the ALT Linux 9 package c-ares version 1.16.1-alt2

1.16.1-alt2 built Nov. 19, 2020 Anton Farygin in task 261934 Nov. 17, 2020 Anton Farygin - added 0d252eb commit from upstream to resolve security issue fixes: CVE-2020-8277...

Ubuntu 20.10 : c-ares vulnerability (USN-4638-1)

The remote Ubuntu 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4638-1 advisory. c-ares could be made to denial of service if it received a specially crafted DNS request. Tenable has extracted the preceding description block directly from the Ubun...

Uncontrolled Resource Consumption

c-ares' aresparsea,aaaareply suffers from a Denial Of Service due to insufficient naddrttls validation...

curl: Data race conditions reported by helgrind when performing parallel DNS queries in libcurl

While running binary built from curl git repo file "docs/examples/10-at-a-time.c" under valgrind specifically with the helgrind tool, reports race condition in getaddrinfo calls. Using the latest curl/libcurl from github repo. From the valgrind documentation "Helgrind is a Valgrind tool for...

c-ares:ares_parse_reply_fuzzer: Use-of-uninitialized-value in ares_parse_caa_reply

Project: https://github.com/c-ares/c-ares.git Detailed Report: https://oss-fuzz.com/testcase?key=5149417215361024 Project: c-ares Fuzzing Engine: libFuzzer Fuzz Target: aresparsereplyfuzzer Job Type: libfuzzermsanc-ares Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cras...

SQL Injection Vulnerability in Taiwan Qualcomm's Website Builder System

Ares Internet is a company that specializes in Sheng Yuan interior design, real estate web design, web design, fast website, template, advertisement design, graphic design, and website building. A SQL injection vulnerability exists in the website builder system of Taiwan Ares Network, which can b...

CVE-2020-14354

A possible use-after-free and double-free in c-ares lib version 1.16.0 if aresdestroy is called prior to aresgetaddrinfo completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability...

c-ares 1.16.0 Use-After-Free Exploit

c-ares version 1.16.0 has an issue where aresdestroy with pending aresgetaddrinfo leads to a use-after-free condition. c-ares 1.16.0: aresdestroy with pending aresgetaddrinfo leads to use-after-free The following code was introduced in c-ares commit dbd4c441 first released in 1.16.0, which was...

OSV-2020-630 Use-of-uninitialized-value in ares__parse_into_addrinfo2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15379 Crash type: Use-of-uninitialized-value Crash state: aresparseintoaddrinfo2 aresparseaaaareply ares-test-fuzz.c...

OSV-2020-439 UNKNOWN WRITE in ares-test-fuzz.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15375 Crash type: UNKNOWN WRITE Crash state: ares-test-fuzz.c...

PT-2020-6913

Name of the Vulnerable Software and Affected Versions c-ares versions 1 16 1 through 1 17 0 Description The issue is related to a buffer overflow vulnerability in the ares parse soa reply function of the c-ares library, which handles asynchronous DNS requests. This vulnerability can be exploited ...

gcc security and bug fix update

8.3.1-5.0.3 - Fix Orabug 29838827 - provide an option to adjust the maximum depth of nested include This is the same bug as gcc upstream PR90581 from Gcc9: gcc9-pr90581.patch - Fix Orabug 29541051 - confusing error message when there is a problem with ASANOPTIONS 'ERROR: expected '='' This is the...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2020-1480)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 3.0.2.2 : c-ares (EulerOS-SA-2020-1480)

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Heap-based buffer overflow in the arescreatequery function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial o...

c-ares:ares_parse_reply_fuzzer: Heap-double-free in ares_parse_soa_reply

Project: https://github.com/c-ares/c-ares.git Detailed Report: https://oss-fuzz.com/testcase?key=5637790584012800 Project: c-ares Fuzzing Engine: afl Fuzz Target: aresparsereplyfuzzer Job Type: aflasanc-ares Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x603000007f70 Crash State...