An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade adns | Jul 30, 2024 | Jun 18, 2020 |
| Freebsd | — | Upgrade adns | Aug 21, 2020 | Aug 20, 2020 |
| Suse | — | suse-upgrade-adnssuse-upgrade-libadns-develsuse-upgrade-libadns-devel-32bitsuse-upgrade-libadns1suse-upgrade-libadns1-32bit | Jun 13, 2020 | Jun 12, 2020 |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | Jun 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub