34 matches found
CVE-2026-32945
CVE-2026-32945 PJSIP DNS 압축 포인터 힙 OOB 읽기 원격 DoS 설명 pjlib-util/src/pjlib-util/dns.c의 getnamelen 및 getname 함수는 두 바이트가 모두 패킷 버퍼 내에 있는지 확인하지 않고 pjmemcpy&offset, p, 2를 통해 2바이트 DNS 압축 포인터를 읽습니다. 0xC0 바이트압축 포인터 마커가 DNS 응답의 맨 마지막 바이트인 경우, memcpy는 힙 할당 경계를 1바이트 초과하여 읽습니다. 단일 20바이트로 조작된 DNS 응답은 OOB 읽기를 유발하...
AZL-98229 CVE-2026-80213 affecting package ruby for versions less than 3.3.5-9
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on t...
CVE-2026-80213
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on t...
CVE-2026-80213
CVE-2026-80213 affects the resolv gem (before 0.7.2 ) for Ruby. The vulnerability resides in Resolv::DNS::MessageEncoder , which wrote a DNS label's length into a single octet without range validation. Labels longer than 255 octets had their length stored modulo 256 while the label data was writt...
CVE-2026-80213
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on t...
CVE-2026-80213
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on t...
CVE-2026-80213
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on t...
CVE-2026-64194
Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack at least with...
CVE-2026-47180
CVE-2026-47180 affects the Zeroconf Python library. The vulnerability stems from DNSIncoming._decode_labels_at_offset recursing for each DNS-name compression pointer; a crafted mDNS packet with ~1500 chained pointers can cause unbounded recursion, escaping DNSIncoming.init and triggering sustaine...
PYSEC-2026-3436 zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service
Impact DNSIncoming.decodelabelsatoffset recurses once per DNS-name compression pointer RFC 1035 §4.1.4. Pointer cycles and label counts were capped, but the chain length of unique forward pointers was not. A single 3 kB mDNS packet carrying 1500 chained pointers drives the recursion past CPython'...
UBUNTU-CVE-2026-14461
mtr is vulnerable to Out-of-bound read vulnerability in ipinfolookup function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a crafted compression pointer in the answer NAME...
CVE-2026-14461 Out-of-bound read in mtr
mtr is vulnerable to Out-of-bound read vulnerability in ipinfolookup function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a crafted compression pointer in the answer NAME...
CVE-2026-14461
The CVE-2026-14461 entry affects mtr up to version 0.96, where ipinfo_lookup() performs DNS AS lookups and can be triggered by a TXT response larger than 512 bytes with a crafted compression pointer, causing an out-of-bounds read. The function uses the response length as the end-of-message bounda...
CVE-2026-14461 Out-of-bound read in mtr
mtr is vulnerable to Out-of-bound read vulnerability in ipinfolookup function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a crafted compression pointer in the answer NAME...
OPENSUSE-SU-2026:21175-1 Security update for python-zeroconf
This update for python-zeroconf fixes the following issues: Changes in python-zeroconf: - CVE-2026-47180: zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial of service bsc1268341 - CVE-2026-47183: zeroconf: Unbounded exception-dedup state retains pack...
EUVD-2017-18042
Malware in sbrugna...
Linux Distros Unpatched Vulnerability : CVE-2017-9104
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered. CVE-2017-9104 Note that Nessus relies on the...
SUSE CVE-2011-4315
Heap-based buffer overflow in compression-pointer processing in core/ngxresolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service daemon crash or possibly have unspecified other impact via a long response...
