Critical severity9.8NVD Advisory· Published Oct 4, 2017· Updated May 13, 2026
CVE-2017-14491
CVE-2017-14491
Description
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
Affected products
37cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*
- cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*
- cpe:2.3:a:suse:linux_enterprise_point_of_sale:11:sp3:*:*:*:*:*:*
- cpe:2.3:a:synology:router_manager:1.1:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*+ 4 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:huawei:honor_v9_play_firmware:*:*:*:*:*:*:*:*Range: <jimmy-al00ac00b135
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:siemens:ruggedcom_rm1224_firmware:*:*:*:*:*:*:*:*Range: <5.0
- cpe:2.3:o:siemens:scalance_m-800_firmware:*:*:*:*:*:*:*:*Range: <5.0
- cpe:2.3:o:siemens:scalance_s615_firmware:*:*:*:*:*:*:*:*Range: <5.0
- cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*Range: <6.5.1.5
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:ltss:*:*:*+ 2 more
- cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:ltss:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:12:*:*:*:ltss:*:*:*
cpe:2.3:o:synology:diskstation_manager:5.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:synology:diskstation_manager:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:synology:diskstation_manager:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:synology:diskstation_manager:6.1:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
39- cert-portal.siemens.com/productcert/pdf/ssa-689071.pdfnvdPatchThird Party Advisory
- packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.htmlnvdExploitThird Party AdvisoryVDB Entry
- www.exploit-db.com/exploits/42941/nvdExploitThird Party AdvisoryVDB Entry
- lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.htmlnvdMailing ListThird Party Advisory
- nvidia.custhelp.com/app/answers/detail/a_id/4560nvdThird Party Advisory
- nvidia.custhelp.com/app/answers/detail/a_id/4561nvdThird Party Advisory
- thekelleys.org.uk/dnsmasq/CHANGELOGnvdRelease NotesVendor Advisory
- www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txtnvdThird Party Advisory
- www.debian.org/security/2017/dsa-3989nvdThird Party Advisory
- www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-ennvdThird Party Advisory
- www.ubuntu.com/usn/USN-3430-1nvdThird Party Advisory
- www.ubuntu.com/usn/USN-3430-2nvdThird Party Advisory
- www.ubuntu.com/usn/USN-3430-3nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:2836nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:2837nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:2838nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:2839nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:2840nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2017:2841nvdThird Party Advisory
- access.redhat.com/security/vulnerabilities/3199382nvdThird Party Advisory
- security.gentoo.org/glsa/201710-27nvdThird Party Advisory
- security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.htmlnvdThird Party Advisory
- www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30nvdMitigationThird Party Advisory
- www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449nvdThird Party Advisory
- www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/nvdThird Party Advisory
- www.debian.org/security/2017/dsa-3989nvdThird Party Advisory
- www.kb.cert.org/vuls/id/973527nvdThird Party AdvisoryUS Government Resource
- www.synology.com/support/security/Synology_SA_17_59_DnsmasqnvdThird Party Advisory
- www.securityfocus.com/bid/101085nvdBroken Link
- www.securityfocus.com/bid/101977nvdBroken Link
- www.securitytracker.com/id/1039474nvdBroken Link
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/nvd
- www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.htmlnvd
- www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.htmlnvd
News mentions
0No linked articles in our index yet.