CVE-2022-4904

A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity...

Improper Input Validation

A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity...

Ubuntu: Security Advisory (USN-5907-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5907-1: c-ares vulnerability

It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could use this issue to cause c-ares to crash, resulting in a denial of service, or possibly execute arbitrary code...

USN-5907-1 c-ares vulnerability

It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could use this issue to cause c-ares to crash, resulting in a denial of service, or possibly execute arbitrary code...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : c-ares vulnerability (USN-5907-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5907-1 advisory. It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could use this issue to cause c-ares to cras...

Updated c-ares packages fix security vulnerability

The configsortlist function is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow and thus may cause a denial of service. CVE-2022-4904...

MGASA-2023-0069 Updated c-ares packages fix security vulnerability

The configsortlist function is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow and thus may cause a denial of service. CVE-2022-4904...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : c-ares (SUSE-SU-2023:0486-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0486-1 advisory. Updated to version 1.19.0: - CVE-2022-4904: Fixed missing string length check in configsortlist bsc120806...

Fedora: Security Advisory for c-ares (FEDORA-2023-b121bd62a9)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2023:0486-1 Security update for c-ares

This update for c-ares fixes the following issues: Updated to version 1.19.0: - CVE-2022-4904: Fixed missing string length check in configsortlist bsc1208067...

Fedora 37 : c-ares (2023-b121bd62a9)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-b121bd62a9 advisory. Update to 1.19.0. Fixes CVE-2022-4904. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

OESA-2023-1110 c-ares security update

Security Fixes: In aressetsortlist, it calls configsortlist..., sortstr to parse the input str and initialize a sortlist configuration. However, aressetsortlist has not any checks about the validity of the input str. It is very easy to create an arbitrary length stack overflow with the unchecked...

c-ares 输入验证错误漏洞

c-ares is a C library for asynchronous DNS requests from the individual developer of c-ares. A security vulnerability exists in c-ares that stems from a lack of checking the validity of input strings, which could be exploited by an attacker to cause a denial of service due to an arbitrarily long...

Debian dla-3323 : libc-ares-dev - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3323 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3323-1 [email protected] https://www.debian.org/lts/security/...

Debian: Security Advisory (DLA-3323-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3323-1] c-ares security update

Debian LTS Advisory DLA-3323-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany February 18, 2023 https://wiki.debian.org/LTS Package : c-ares Version : 1.14.0-1+deb10u2 CVE ID : CVE-2022-4904 Debian Bug : 1031525 It was discovered that in c-ares, an asynchronous...

DLA-3323-1 c-ares - security update

Bulletin has no description...

CVE-2022-4904

A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity...

SUSE CVE-2016-5180

Heap-based buffer overflow in the arescreatequery function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service out-of-bounds write or possibly execute arbitrary code via a hostname with an escaped trailing dot...