The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade c-aresUpgrade nodejsUpgrade nodejs-current | Sep 20, 2017 | Jul 7, 2017 |
| Amazon_linux | — | Upgrade c-ares | Jul 25, 2017 | Jul 7, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 7, 2017 |
| Debian | — | Upgrade c-ares | Feb 25, 2019 | Jul 7, 2017 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jan 3, 2025 |
| Huawei Euleros 2_0_sp2 | — | Upgrade c-ares-develUpgrade c-ares | Sep 12, 2019 | Jul 7, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade c-ares-develUpgrade c-ares | Sep 25, 2019 | Jul 7, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade c-ares-develUpgrade c-ares | Aug 16, 2019 | Jul 7, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 20, 2017 |
| Suse | — | Upgrade mozilla-nss-develUpgrade firefox-gio-branding-upstreamUpgrade firefox-libcairo2Upgrade nodejs6-docsUpgrade firefox-gtk3-immodule-ximUpgrade firefox-libpango-1_0-0Upgrade nodejs6Upgrade libfirefox-gmodule-2_0-0Upgrade libfreebl3Upgrade firefox-libgtk-3-0Upgrade firefox-gtk3-branding-upstreamUpgrade mozillafirefoxUpgrade libfreebl3-32bitUpgrade mozillafirefox-translations-commonUpgrade libfirefox-glib-2_0-0Upgrade libcares2Upgrade mozilla-nss-certs-32bitUpgrade firefox-glib2-toolsUpgrade mozilla-nss-certsUpgrade mozilla-nssUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-toolsUpgrade libfirefox-gobject-2_0-0Upgrade mozillafirefox-branding-sledUpgrade nodejs4Upgrade nodejs4-docsUpgrade mozilla-nss-32bitUpgrade firefox-libffi7Upgrade c-ares-develUpgrade nodejs4-develUpgrade mozilla-nspr-32bitUpgrade libfirefox-gio-2_0-0Upgrade nodejs-commonUpgrade npm4Upgrade libcares2-32bitUpgrade mozilla-nsprUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodules-tigrignaUpgrade libsoftokn3Upgrade nodejs8-develUpgrade libcares-develUpgrade firefox-libcairo-gobject2Upgrade mozilla-nss-toolsUpgrade nodejs8-docsUpgrade firefox-gtk3-immodule-thaiUpgrade libsoftokn3-32bitUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade npm6Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-libatk-1_0-0Upgrade mozillafirefox-translations-otherUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-multipressUpgrade nodejs6-develUpgrade firefox-glib2-langUpgrade npm8Upgrade firefox-gtk3-langUpgrade firefox-atk-langUpgrade firefox-gdk-pixbuf-langUpgrade firefox-libffi4Upgrade firefox-gtk3-dataUpgrade nodejs8Upgrade mozilla-nspr-devel | Jul 13, 2017 | Jul 6, 2017 |
| Ubuntu | — | Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade libc-ares2 | Aug 17, 2017 | Jul 7, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 7, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub