9.8

CVE-2017-14493

Exploit
Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version17.04
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version7.1
Debian ≫ Debian Linux Version9.0
Opensuse ≫ Leap Version42.2
Opensuse ≫ Leap Version42.3
Thekelleys ≫ Dnsmasq Version <= 2.77
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 83.64% 0.997
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://thekelleys.org.uk/dnsmasq/CHANGELOG
Vendor Advisory
Release Notes
http://nvidia.custhelp.com/app/answers/detail/a_id/4561
Third Party Advisory
http://www.securityfocus.com/bid/101085
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039474
Third Party Advisory
VDB Entry
https://access.redhat.com/security/vulnerabilities/3199382
Third Party Advisory
Issue Tracking
https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html
Third Party Advisory
https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html
https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html
https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html
Third Party Advisory
Mailing List
Issue Tracking
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt
http://www.debian.org/security/2017/dsa-3989
Third Party Advisory
http://www.ubuntu.com/usn/USN-3430-1
Third Party Advisory
http://www.ubuntu.com/usn/USN-3430-2
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2836
Patch
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2837
Patch
Third Party Advisory
https://security.gentoo.org/glsa/201710-27
Third Party Advisory
https://www.kb.cert.org/vuls/id/973527
Third Party Advisory
US Government Resource
http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=3d4ff1ba8419546490b464418223132529514033
https://www.exploit-db.com/exploits/42943/
Third Party Advisory
Exploit
VDB Entry