rpm package
suse/adns&distro=SUSE Linux Enterprise Server 12 SP2-LTSS
pkg:rpm/suse/adns&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2017-9104 | Cri | 9.8 | < 1.4-103.3.1 | 1.4-103.3.1 | Jun 18, 2020 | An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered. | |
| CVE-2017-9103 | Cri | 9.8 | < 1.4-103.3.1 | 1.4-103.3.1 | Jun 18, 2020 | An issue was discovered in adns before 1.5.2. pap_mailbox822 does not properly check st from adns__findlabel_next. Without this, an uninitialised stack value can be used as the first label length. Depending on the circumstances, an attacker might be able to trick adns into crashi | |
| CVE-2017-9109 | Cri | 9.8 | < 1.4-103.3.1 | 1.4-103.3.1 | Jun 18, 2020 | An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME t | |
| CVE-2017-9108 | Hig | 7.5 | < 1.4-103.3.1 | 1.4-103.3.1 | Jun 18, 2020 | An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix | |
| CVE-2017-9107 | Hig | 7.5 | < 1.4-103.3.1 | 1.4-103.3.1 | Jun 18, 2020 | An issue was discovered in adns before 1.5.2. It overruns reading a buffer if a domain ends with backslash. If the query domain ended with \, and adns_qf_quoteok_query was specified, qdparselabel would read additional bytes from the buffer and try to treat them as the escape sequ | |
| CVE-2017-9106 | Hig | 7.5 | < 1.4-103.3.1 | 1.4-103.3.1 | Jun 18, 2020 | An issue was discovered in adns before 1.5.2. adns_rr_info mishandles a bogus *datap. The general pattern for formatting integers is to sprintf into a fixed-size buffer. This is correct if the input is in the right range; if it isn't, the buffer may be overrun (depending on the s | |
| CVE-2017-9105 | Hig | 8.8 | < 1.4-103.3.1 | 1.4-103.3.1 | Jun 18, 2020 | An issue was discovered in adns before 1.5.2. It corrupts a pointer when a nameserver speaks first because of a wrong number of pointer dereferences. This bug may well be exploitable as a remote code execution. |
- affected < 1.4-103.3.1fixed 1.4-103.3.1
An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered.
- affected < 1.4-103.3.1fixed 1.4-103.3.1
An issue was discovered in adns before 1.5.2. pap_mailbox822 does not properly check st from adns__findlabel_next. Without this, an uninitialised stack value can be used as the first label length. Depending on the circumstances, an attacker might be able to trick adns into crashi
- affected < 1.4-103.3.1fixed 1.4-103.3.1
An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME t
- affected < 1.4-103.3.1fixed 1.4-103.3.1
An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix
- affected < 1.4-103.3.1fixed 1.4-103.3.1
An issue was discovered in adns before 1.5.2. It overruns reading a buffer if a domain ends with backslash. If the query domain ended with \, and adns_qf_quoteok_query was specified, qdparselabel would read additional bytes from the buffer and try to treat them as the escape sequ
- affected < 1.4-103.3.1fixed 1.4-103.3.1
An issue was discovered in adns before 1.5.2. adns_rr_info mishandles a bogus *datap. The general pattern for formatting integers is to sprintf into a fixed-size buffer. This is correct if the input is in the right range; if it isn't, the buffer may be overrun (depending on the s
- affected < 1.4-103.3.1fixed 1.4-103.3.1
An issue was discovered in adns before 1.5.2. It corrupts a pointer when a nameserver speaks first because of a wrong number of pointer dereferences. This bug may well be exploitable as a remote code execution.