c-ares project vulnerabilities and exploits

(subscribe to this query)

c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an malicious user to ...

C-ares Project C-ares Fedoraproject Fedora 37 Fedoraproject Fedora 38

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the ra...

C-ares Project C-ares Fedoraproject Fedora 37 Fedoraproject Fedora 38

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

C-ares Project C-ares Redhat Enterprise Linux 8.0 Redhat Software Collections -Redhat Enterprise Linux 9.0 Fedoraproject Fedora 36

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 lengt...

C-ares Project C-ares Fedoraproject Fedora 37 Fedoraproject Fedora 38 Debian Debian Linux 10.0 Debian Debian Linux 11.0

c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would r...

C-ares Project C-ares Fedoraproject Fedora 37 Fedoraproject Fedora 38 Debian Debian Linux 10.0 Debian Debian Linux 11.0

A Node.js application that allows an malicious user to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. ...

Nodejs Node.js Fedoraproject Fedora 32 Fedoraproject Fedora 33 Oracle Graalvm 19.3.4 Oracle Graalvm 20.3.0 Oracle Retail Xstore Point Of Service 16.0.6 Oracle Retail Xstore Point Of Service 17.0.4 Oracle Retail Xstore Point Of Service 18.0.3 Oracle Retail Xstore Point Of Service 19.0.2 Oracle Jd Edwards Enterpriseone Tools Oracle Mysql Cluster Oracle Blockchain Platform C-ares Project C-ares

2 Github repositories

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality ...

C-ares Project C-ares Fedoraproject Fedora 33 Fedoraproject Fedora 34 Redhat Enterprise Linux 7.0 Redhat Enterprise Linux 8.0 Redhat Enterprise Linux Eus 7.7 Redhat Enterprise Linux 7.7 Redhat Enterprise Linux Eus 8.1 Redhat Enterprise Linux Eus 8.2 Redhat Enterprise Linux Server Tus 8.2 Redhat Enterprise Linux Server Aus 8.2 Redhat Enterprise Linux Tus 8.4 Redhat Enterprise Linux Server Tus 8.4 Redhat Enterprise Linux Eus 8.4 Redhat Enterprise Linux Server Aus 8.4 Redhat Enterprise Linux Server Update Services For Sap Solutions 8.2 Redhat Enterprise Linux Server Update Services For Sap Solutions 8.4 Redhat Enterprise Linux Server Update Services For Sap Solutions 8.1 Redhat Enterprise Linux For Power Little Endian Eus 8.2 Redhat Enterprise Linux For Ibm Z Systems Eus 8.2 Redhat Enterprise Linux For Ibm Z Systems Eus 8.1 Redhat Enterprise Linux For Power Little Endian Eus 8.1

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook