[Forgot Password]
Login  Register Subscribe

30480

 
 

423868

 
 

253390

 
 

909

 
 

197257

 
 

282

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2017-9108Date: (C)2020-06-19   (M)2023-12-22


An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : 7.5CVSS Score : 5.0
Exploit Score: 3.9Exploit Score: 10.0
Impact Score: 3.6Impact Score: 2.9
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: NETWORKAccess Vector: NETWORK
Attack Complexity: LOWAccess Complexity: LOW
Privileges Required: NONEAuthentication: NONE
User Interaction: NONEConfidentiality: NONE
Scope: UNCHANGEDIntegrity: NONE
Confidentiality: NONEAvailability: PARTIAL
Integrity: NONE 
Availability: HIGH 
  
Reference:
FEDORA-2020-530188bf36
FEDORA-2020-e59bcaf702
http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git
http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog
https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html

CWE    1
CWE-119
OVAL    4
oval:org.secpod.oval:def:89002935
oval:org.secpod.oval:def:118403
oval:org.secpod.oval:def:118411
oval:org.secpod.oval:def:89000028
...

© SecPod Technologies