Debian: DSA-3682-1: c-ares security update

Date 30 Sep 2016

Category Debian Linux Distribution - Security Advisories

146

Posted By LinuxSecurity Advisories

Gzob Qq discovered that the query-building functions in c-ares, an asynchronous DNS request library would not correctly process crafted query names, resulting in a heap buffer overflow and potentially leading to arbitrary code execution.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3682-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.
https://www.debian.org/security/                           Florian Weimer
September 30, 2016                    https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : c-ares
CVE ID         : CVE-2016-5180
Debian Bug     : 839151

Gzob Qq discovered that the query-building functions in c-ares, an
asynchronous DNS request library would not correctly process crafted
query names, resulting in a heap buffer overflow and potentially
leading to arbitrary code execution.

For the stable distribution (jessie), this problem has been fixed in
version 1.10.0-2+deb8u1.

For the unstable distribution (sid), this problem has been fixed in
version 1.12.0-1.

We recommend that you upgrade your c-ares packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.