The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade c-aresUpgrade nodejsUpgrade nodejs-current | Sep 20, 2017 | Jul 7, 2017 |
| Amazon_linux | — | Upgrade c-ares | Jul 25, 2017 | Jul 7, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 7, 2017 |
| Debian | — | Upgrade c-ares | Feb 25, 2019 | Jul 7, 2017 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jan 3, 2025 |
| Huawei Euleros 2_0_sp2 | — | Upgrade c-aresUpgrade c-ares-devel | Sep 12, 2019 | Jul 7, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade c-ares-develUpgrade c-ares | Sep 25, 2019 | Jul 7, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade c-aresUpgrade c-ares-devel | Aug 16, 2019 | Jul 7, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 20, 2017 |
| Suse | — | Upgrade firefox-gtk3-branding-upstreamUpgrade nodejs6Upgrade libcares2Upgrade firefox-gtk3-toolsUpgrade nodejs4Upgrade firefox-libgtk-3-0Upgrade nodejs-commonUpgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozillafirefox-branding-sledUpgrade libfirefox-gobject-2_0-0Upgrade c-ares-develUpgrade firefox-libcairo2Upgrade libcares2-32bitUpgrade firefox-libffi7Upgrade firefox-glib2-toolsUpgrade libfirefox-gio-2_0-0Upgrade libfirefox-glib-2_0-0Upgrade mozilla-nss-32bitUpgrade mozillafirefox-translations-commonUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-develUpgrade firefox-gdk-pixbuf-query-loadersUpgrade nodejs4-docsUpgrade mozilla-nss-certsUpgrade mozillafirefoxUpgrade libfreebl3-32bitUpgrade libfirefox-gmodule-2_0-0Upgrade mozilla-nss-certs-32bitUpgrade mozilla-nssUpgrade firefox-gtk3-immodule-ximUpgrade firefox-libpango-1_0-0Upgrade mozilla-nsprUpgrade nodejs4-develUpgrade libfreebl3Upgrade npm4Upgrade nodejs6-docsUpgrade firefox-gtk3-immodules-tigrignaUpgrade nodejs8-develUpgrade mozilla-nspr-develUpgrade mozillafirefox-translations-otherUpgrade nodejs8-docsUpgrade firefox-libcairo-gobject2Upgrade libsoftokn3-32bitUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-thaiUpgrade libcares-develUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodule-multipressUpgrade nodejs8Upgrade libsoftokn3Upgrade npm6Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-immodule-inuktitutUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-dataUpgrade firefox-glib2-langUpgrade nodejs6-develUpgrade npm8Upgrade firefox-libffi4Upgrade firefox-atk-langUpgrade firefox-gtk3-langUpgrade firefox-gdk-pixbuf-lang | Jul 13, 2017 | Jul 6, 2017 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade libc-ares2 | Aug 17, 2017 | Jul 7, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 7, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub