CVE-2017-9109

Katalog CVE

CVSS 9.8 · Critical EPSS 2,0%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada gnu adns, opensuse leap +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct.

Rincian

Terbit di NVD

18 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00037.html mailing list · advisory pihak ketiga
• http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git advisory pihak ketiga
• https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html release notes · advisory pihak ketiga
• http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWA...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK...