Most recent entries from all

ALSA-2023:7207 — Moderate: c-ares security update

Affected: AlmaLinux:8: c-ares, AlmaLinux:8: c-ares-devel

The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API.

Security Fix(es):

* c-ares: Heap buffer over read in ares_parse_soa_reply (CVE-2020-22217) * c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-05898

EUVD-2026-192056

fkie_cve-2020-22217

Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.

GHSA-88q4-8vpj-fqpg

Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.

gsd-2020-22217

msrc_CVE-2020-22217 — Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_r…

msrc_CVE-2020-22217

RHSA-2023:7207 — Red Hat Security Advisory: c-ares security update

c-ares: Heap buffer over read in ares_parse_soa_reply c-ares: Buffer Underwrite in ares_inet_net_pton()

RHSA-2024:0419 — Red Hat Security Advisory: c-ares security update

c-ares: Heap buffer over read in ares_parse_soa_reply

SSA-202008 — SSA-202008: Multiple Vulnerabilities in Ruggedcom Rox Before V2.17.0

An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…

SUSE-SU-2023:3690-1 — Security update for libcares2

Security update for libcares2

UBUNTU-CVE-2020-22217

Affected: Ubuntu:Pro:16.04:LTS: c-ares, Ubuntu:Pro:18.04:LTS: c-ares, Ubuntu:20.04:LTS: c-ares

Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.

WID-SEC-W-2024-0218 — Red Hat Enterprise Linux's oniguruma, tcpslice, c-ares: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, beliebigen Code auszuführen oder sensible Informationen offenzulegen.