C-ares Project : Security Vulnerabilities, CVEs, (Memory corruption) CVSS score >= 6
c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.
Max CVSS
6.4
EPSS Score
0.04%
Published
2023-05-25
Updated
2023-10-31
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.
Max CVSS
9.8
EPSS Score
4.52%
Published
2016-10-03
Updated
2023-09-15
2 vulnerabilities found