The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejsUpgrade c-ares | Sep 20, 2017 | Jul 7, 2017 |
| Amazon_linux | — | Upgrade c-ares | Jul 25, 2017 | Jul 7, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 7, 2017 |
| Debian | — | Upgrade c-ares | Feb 25, 2019 | Jul 7, 2017 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jan 3, 2025 |
| Huawei Euleros 2_0_sp2 | — | Upgrade c-aresUpgrade c-ares-devel | Sep 12, 2019 | Jul 7, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade c-ares-develUpgrade c-ares | Sep 25, 2019 | Jul 7, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade c-aresUpgrade c-ares-devel | Aug 16, 2019 | Jul 7, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 20, 2017 |
| Suse | — | Upgrade firefox-libatk-1_0-0Upgrade nodejs8-docsUpgrade firefox-gtk3-immodule-multipressUpgrade nodejs8-develUpgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nss-toolsUpgrade firefox-libffi4Upgrade mozilla-nspr-develUpgrade firefox-glib2-langUpgrade libcares-develUpgrade firefox-atk-langUpgrade nodejs6-develUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-amharicUpgrade MozillaFirefox-translations-commonUpgrade nodejs8Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-libcairo-gobject2Upgrade firefox-gdk-pixbuf-langUpgrade libsoftokn3Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade libsoftokn3-32bitUpgrade npm8Upgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-dataUpgrade npm6Upgrade firefox-gtk3-langUpgrade firefox-gtk3-immodules-tigrignaUpgrade MozillaFirefoxUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-32bitUpgrade nodejs-commonUpgrade libcares2-32bitUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs4Upgrade libfirefox-gobject-2_0-0Upgrade c-ares-develUpgrade firefox-glib2-toolsUpgrade firefox-gio-branding-upstreamUpgrade firefox-libffi7Upgrade firefox-libgtk-3-0Upgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-toolsUpgrade MozillaFirefox-branding-SLEDUpgrade npm4Upgrade libfreebl3Upgrade mozilla-nssUpgrade mozilla-nss-certs-32bitUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gtk3-immodule-ximUpgrade nodejs4-docsUpgrade mozilla-nss-certsUpgrade libfirefox-glib-2_0-0Upgrade mozilla-nss-develUpgrade libfreebl3-32bitUpgrade nodejs4-develUpgrade nodejs6Upgrade libcares2Upgrade firefox-libpango-1_0-0Upgrade firefox-libcairo2Upgrade nodejs6-docsUpgrade libfirefox-gio-2_0-0Upgrade mozilla-nsprUpgrade mozilla-nspr-32bit | Jul 13, 2017 | Jul 6, 2017 |
| Ubuntu | — | Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade libc-ares2 | Aug 17, 2017 | Jul 7, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 7, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub