CVE-2017-1000381

The c-ares function aresparsenaptrreply, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way...

CVE-2017-1000381

The c-ares function "aresparsenaptrreply", which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way...

CVE-2017-1000381

The c-ares function aresparsenaptrreply, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way...

CVE-2017-1000381: Exposure of Sensitive Information to an Unauthorized Actor

The c-ares function aresparsenaptrreply, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way...

UBUNTU-CVE-2017-1000381

The c-ares function aresparsenaptrreply, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way...

Fedora Update for c-ares FEDORA-2017-ba1399832b

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 25 : c-ares (2017-ba1399832b)

CVE-2017-1000381: c-ares NAPTR parser out of bounds access Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Debian DLA-998-1 : c-ares security update

CVE-2017-1000381 The c-ares function aresparsenaptrreply, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. For Debian 7 'Wheezy', these problems have been fixed in...

[SECURITY] [DLA 998-1] c-ares security update

Package : c-ares Version : 1.9.1-3+deb7u2 CVE ID : CVE-2017-1000381 CVE-2017-1000381 The c-ares function aresparsenaptrreply, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a...

DLA-998-1 c-ares - security update

Bulletin has no description...

c-ares NAPTR parser out-of-bounds access vulnerability

c-ares is a C library for asynchronous execution of DNS requests and name resolution. A security vulnerability exists in c-ares versions 1.8.0 through 1.12.0. An attacker could exploit the vulnerability to obtain sensitive information or cause a denial of service...

PT-2017-3341

Name of the Vulnerable Software and Affected Versions c-ares affected versions not specified Description The issue is related to the ares parse naptr reply function in the c-ares library, which is used for parsing NAPTR responses. This function could be triggered to read memory outside of the giv...

GLSA-201701-28 : c-ares: Heap-based buffer overflow

The remote host is affected by the vulnerability described in GLSA-201701-28 c-ares: Heap-based buffer overflow A hostname with an escaped trailing dot such as hello. would have its size calculated incorrectly leading to a single byte written beyond the end of a buffer on the heap. Impact : A...

c-ares: Heap-based buffer overflow

Background c-ares is a C library for asynchronous DNS requests including name resolves. Description A hostname with an escaped trailing dot such as “hello\.” would have its size calculated incorrectly leading to a single byte written beyond the end of a buffer on the heap. Impact A remote...

c-ares: Single byte out of buffer write

A vulnerability was found in c-ares. A hostname with an escaped trailing dot such as "hello." would have its size calculated incorrectly, leading to a single byte written beyond the end of a buffer on the heap. An attacker able to provide such a hostname to an application using c-ares, could...

Important: Red Hat Security Advisory: rh-nodejs4-nodejs and rh-nodejs4-http-parser security update

An update for rh-nodejs4-nodejs and rh-nodejs4-http-parser is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Chrome OS exploit: one byte overflow and symlinks

The following article is an guest blog post from an external researcher i.e. the author is not a Project Zero or Google researcher. This post is about a Chrome OS exploit I reported to Chrome VRP in September. The Project Zero folks were nice to let me do a guest post about it, so here goes. The...

Fedora Update for c-ares FEDORA-2016-e523c37b4d

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for mingw-c-ares FEDORA-2016-4f34f26649

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : nodejs4 (openSUSE-2016-1403)

This update for nodejs4 fixes the following issues : Security issues fixed : - CVE-2016-5180: c-ares: Fix for single-byte buffer overwrite bsc1007728. Bug fixes : - bsc1009011: npm4 should provide versioned nodejs-npm and npm allowing nodejs-packaging to continue to function properly in Leap 42.2...