https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:53:06 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:4459 <p><strong>Affected:</strong> AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-libs, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: nodejs-packaging-bundler, AlmaLinux:8: npm, AlmaLinux:8: v8-12.4-devel</p> <p>Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.</p> <p>Security Fix(es):</p> <p>* c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498) * SQLite: integer overflow in SQLite (CVE-2025-3277)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-libs, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: nodejs-packaging-bundler, AlmaLinux:8: npm, AlmaLinux:8: v8-12.4-devel</p> <p>Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.</p> <p>Security Fix(es):</p> <p>* c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498) * SQLite: integer overflow in SQLite (CVE-2025-3277)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:4459 https://cve.radiocsirt.org/vuln/bdu:2025-04858 bdu:2025-04858 https://cve.radiocsirt.org/vuln/bdu:2025-04858 https://cve.radiocsirt.org/vuln/bell-cve-2025-31498 <p><strong>Affected:</strong> Alpaquita:stream: c-ares, BellSoft Hardened Containers:stream: c-ares</p> <p><strong>Affected:</strong> Alpaquita:stream: c-ares, BellSoft Hardened Containers:stream: c-ares</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-31498 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0969 certfr-2025-avi-0969 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0969 https://cve.radiocsirt.org/vuln/cleanstart-2025-jx38595 <p><strong>Affected:</strong> CleanStart: c-ares</p> <p>Security vulnerability affects the c-ares package. c-ares is an asynchronous resolver library.</p> <p><strong>Affected:</strong> CleanStart: c-ares</p> <p>Security vulnerability affects the c-ares package. c-ares is an asynchronous resolver library.</p> https://cve.radiocsirt.org/vuln/cleanstart-2025-jx38595 https://cve.radiocsirt.org/vuln/euvd-2026-227803 EUVD-2026-227803 https://cve.radiocsirt.org/vuln/euvd-2026-227803 https://cve.radiocsirt.org/vuln/fkie_cve-2025-31498 <p>c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.</p> <p>c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-31498 https://cve.radiocsirt.org/vuln/msrc_cve-2025-31498 msrc_CVE-2025-31498 https://cve.radiocsirt.org/vuln/msrc_cve-2025-31498 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14977-1 <p>c-ares-devel-1.34.5-1.1 on GA media</p> <p>c-ares-devel-1.34.5-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14977-1 https://cve.radiocsirt.org/vuln/rhsa-2025:7502 <p>c-ares: c-ares has a use-after-free in read_answers()</p> <p>c-ares: c-ares has a use-after-free in read_answers()</p> https://cve.radiocsirt.org/vuln/rhsa-2025:7502 https://cve.radiocsirt.org/vuln/suse-su-2026:23364-1 <p>Security update for c-ares</p> <p>Security update for c-ares</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23364-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-31498 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:25.04: c-ares</p> <p>c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:25.04: c-ares</p> <p>c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-31498 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0943 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen, oder beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen, oder beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0943