CVE-2023-31893

Telefnica Brasil Vivo Play IPTV Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service DoS via DNS Recursion...

PT-2023-23505 · Telefônica Brasil · Telefônica Brasil Vivo Play

Name of the Vulnerable Software and Affected Versions: Telefnica Brasil Vivo Play IPTV Firmware version 2023.04.04.01.06.15 Description: The issue is related to a Denial of Service DoS via DNS Recursion. This means that the system can be made unavailable by exploiting its handling of DNS recursio...

Vivo Play 安全漏洞

Vivo Play is an app from the Chinese company Vivo. for anytime, anywhere access to sports, TV shows, movies, series and on-demand content. A security vulnerability exists in Vivo Play version 2023.04.04.01.06.15, which stems from vulnerability to DNS recursive denial of service DoS attacks...

An issue was discovered in Qt 5.x before 5.15.14 6.x before 6.2.9 and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server.

...

Insufficient randomness in generation of DNS query IDs in c-ares

...

AZL-26869 CVE-2023-31147 affecting package c-ares for versions less than 1.19.1-1

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand so will generate predictable output. Input from the random number generator i...

c-ares 缓冲区错误漏洞

c-ares is a C library for asynchronous DNS requests from the individual developers of c-ares. A security vulnerability exists in c-ares versions prior to 1.19.1 that stems from the presence of a buffer overflow...

SUSE CVE-2023-31147

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand so will generate predictable output. Input from the random number generator i...

PT-2023-23180

Name of the Vulnerable Software and Affected Versions c-ares versions prior to 1.19.1 Description The issue arises when /dev/urandom or RtlGenRandom are unavailable, and c-ares uses rand to generate random numbers for DNS query ids. This approach is not a Cryptographically Secure PseudoRandom...

CVE-2023-31442

In Lightbend Akka before 2.8.1, the async-dns resolver used by Discovery in DNS mode and transitively by Cluster Bootstrap uses predictable DNS transaction IDs when resolving DNS records, making DNS resolution subject to poisoning by an attacker. If the application performing discovery does not...

PT-2023-23330 · Lightbend · Akka Discovery +1

Name of the Vulnerable Software and Affected Versions: Lightbend Akka versions 2.5.14 through 2.8.0 Akka Discovery versions 2.5.14 through 2.8.0 Description: The async-dns resolver in Lightbend Akka uses predictable DNS transaction IDs when resolving DNS records, making DNS resolution subject to...

UBUNTU-CVE-2023-31137

MaraDNS is open-source software that implements the Domain Name System DNS. In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination...

bind: processing large delegations may severely degrade resolver performance

A flaw was found in bind. When flooding the target resolver with special queries, an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service...

MaraDNS 数字错误漏洞

MaraDNS is an open source implementation of the Domain Name System by the individual developer Sam Trenholme that can be used as a caching, recursive or authoritative name server. A numeric error vulnerability exists in MaraDNS 3.5.0024 and earlier versions, which stems from a remotely exploitabl...

PT-2023-7445 · Canon · I-Sensys Mf640C Series +10

Name of the Vulnerable Software and Affected Versions: Canon imageCLASS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware versions prior to Ver.11.05 Canon imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware versions prior to...

CVE-2023-28742

When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

New Decoy Dog Malware Toolkit Uncovered: Targeting Enterprise Networks

An analysis of over 70 billion DNS records has led to the discovery of a new sophisticated malware toolkit dubbed Decoy Dog targeting enterprise networks. Decoy Dog , as the name implies, is evasive and employs techniques like strategic domain aging and DNS query dribbling, wherein a series of...

SmartDNS 缓冲区错误漏洞

SmartDNS is a DNS server running locally by Nick Peng Personal Developer. A security vulnerability exists in SmartDNS version v41 and prior versions, which stems from the presence of a stack-based buffer overflow that allows out-of-bounds writes via specially crafted DNS requests...

The vulnerability of the DNS server Dnsmasq involves unlimited resource allocation, which allows attackers to cause service failures.

The vulnerability of the Dnsmasq DNS server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the DNS Server component of the Windows operating system, which allows a hacker to disclose protected information

The vulnerability of the DNS Server component of the Windows operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that should be protected...