SQL Injection Vulnerability in Taiwan Qualcomm's Website Builder System

Ares Internet is a company that specializes in Sheng Yuan interior design, real estate web design, web design, fast website, template, advertisement design, graphic design, and website building. A SQL injection vulnerability exists in the website builder system of Taiwan Ares Network, which can b...

CVE-2020-14354

A possible use-after-free and double-free in c-ares lib version 1.16.0 if aresdestroy is called prior to aresgetaddrinfo completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability...

c-ares 1.16.0 Use-After-Free Exploit

c-ares version 1.16.0 has an issue where aresdestroy with pending aresgetaddrinfo leads to a use-after-free condition. c-ares 1.16.0: aresdestroy with pending aresgetaddrinfo leads to use-after-free The following code was introduced in c-ares commit dbd4c441 first released in 1.16.0, which was...

OSV-2020-630 Use-of-uninitialized-value in ares__parse_into_addrinfo2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15379 Crash type: Use-of-uninitialized-value Crash state: aresparseintoaddrinfo2 aresparseaaaareply ares-test-fuzz.c...

OSV-2020-439 UNKNOWN WRITE in ares-test-fuzz.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15375 Crash type: UNKNOWN WRITE Crash state: ares-test-fuzz.c...

PT-2020-6913

Name of the Vulnerable Software and Affected Versions c-ares versions 1 16 1 through 1 17 0 Description The issue is related to a buffer overflow vulnerability in the ares parse soa reply function of the c-ares library, which handles asynchronous DNS requests. This vulnerability can be exploited ...

gcc security and bug fix update

8.3.1-5.0.3 - Fix Orabug 29838827 - provide an option to adjust the maximum depth of nested include This is the same bug as gcc upstream PR90581 from Gcc9: gcc9-pr90581.patch - Fix Orabug 29541051 - confusing error message when there is a problem with ASANOPTIONS 'ERROR: expected '='' This is the...

EulerOS Virtualization 3.0.2.2 : c-ares (EulerOS-SA-2020-1480)

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Heap-based buffer overflow in the arescreatequery function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial o...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2020-1480)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

c-ares:ares_parse_reply_fuzzer: Heap-double-free in ares_parse_soa_reply

Project: https://github.com/c-ares/c-ares.git Detailed Report: https://oss-fuzz.com/testcase?key=5637790584012800 Project: c-ares Fuzzing Engine: afl Fuzz Target: aresparsereplyfuzzer Job Type: aflasanc-ares Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x603000007f70 Crash State...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2019-1838)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2019-1805)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2019-2017)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2019-1950)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Rethinking cyber scenarios—learning (and training) as you defend

In two recent posts I discussed with Circadence the increasing importance of gamification for cybersecurity learning and how to get started as a practitioner while being supported by an enterprise learning officer or security team lead. In this third and final post in the series, Keenan and I...

Rethinking cyber learning—consider gamification

As promised, I’m back with a follow-up to my recent post, Rethinking how we learn security, on how we need modernize the learning experience for cybersecurity professionals by gamifying training to make learning fun. Some of you may have attended the recent Microsoft Ignite events in Orlando and...

CVE-2017-1000381

The c-ares function aresparsenaptrreply, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way...

Rethinking how we learn security

A couple of years ago, I wrote an article on the relative lack of investor and startup interest in addressing a crucial CISO priority—the preparedness of employees on the security team. Considering what seems to be a steady stream of news about breaches, what can be done to encourage more people ...

EulerOS 2.0 SP3 : c-ares (EulerOS-SA-2019-2017)

According to the versions of the c-ares packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in c-ares. A hostname with an escaped trailing dot such as 'hello.' would have its size calculated incorrectly, leadin...

EulerOS 2.0 SP2 : c-ares (EulerOS-SA-2019-1838)

According to the versions of the c-ares packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in c-ares. A hostname with an escaped trailing dot such as 'hello.' would have its size calculated incorrectly, leadin...