The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade c-aresUpgrade nodejs-currentUpgrade nodejs | Sep 20, 2017 | Jul 7, 2017 |
| Amazon_linux | — | Upgrade c-ares | Jul 25, 2017 | Jul 7, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 7, 2017 |
| Debian | — | Upgrade c-ares | Feb 25, 2019 | Jul 7, 2017 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jan 3, 2025 |
| Huawei Euleros 2_0_sp2 | — | Upgrade c-aresUpgrade c-ares-devel | Sep 12, 2019 | Jul 7, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade c-ares-develUpgrade c-ares | Sep 25, 2019 | Jul 7, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade c-ares-develUpgrade c-ares | Aug 16, 2019 | Jul 7, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 20, 2017 |
| Suse | — | Upgrade libcares-develUpgrade firefox-libatk-1_0-0Upgrade nodejs8-docsUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodule-vietnameseUpgrade libsoftokn3-32bitUpgrade firefox-atk-langUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade libsoftokn3Upgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-immodules-tigrignaUpgrade npm6Upgrade nodejs8Upgrade firefox-gtk3-immodule-thaiUpgrade MozillaFirefoxUpgrade mozilla-nspr-develUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nss-toolsUpgrade firefox-gdk-pixbuf-langUpgrade nodejs6-develUpgrade firefox-gtk3-langUpgrade firefox-libffi4Upgrade nodejs8-develUpgrade npm8Upgrade MozillaFirefox-translations-commonUpgrade firefox-gtk3-dataUpgrade firefox-glib2-langUpgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-immodule-ximUpgrade c-ares-develUpgrade libfirefox-gmodule-2_0-0Upgrade nodejs4-docsUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfreebl3Upgrade mozilla-nss-certsUpgrade mozilla-nssUpgrade libfreebl3-32bitUpgrade libcares2-32bitUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nsprUpgrade nodejs-commonUpgrade mozilla-nspr-32bitUpgrade libfirefox-glib-2_0-0Upgrade firefox-libffi7Upgrade firefox-glib2-toolsUpgrade libfirefox-gobject-2_0-0Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-gio-branding-upstreamUpgrade nodejs6Upgrade libcares2Upgrade firefox-gtk3-branding-upstreamUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-develUpgrade nodejs4-develUpgrade npm4Upgrade libfirefox-gio-2_0-0Upgrade mozilla-nss-32bitUpgrade firefox-libcairo2Upgrade nodejs4Upgrade nodejs6-docsUpgrade firefox-gtk3-toolsUpgrade firefox-libgtk-3-0Upgrade firefox-gdk-pixbuf-thumbnailer | Jul 13, 2017 | Jul 6, 2017 |
| Ubuntu | — | Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade libc-ares2 | Aug 17, 2017 | Jul 7, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 7, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub