c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-c-aresalma-upgrade-c-ares-develalma-upgrade-nodejsalma-upgrade-nodejs-develalma-upgrade-nodejs-docsalma-upgrade-nodejs-full-i18nalma-upgrade-nodejs-libsalma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packagingalma-upgrade-nodejs-packaging-bundleralma-upgrade-npm | May 13, 2024 | Feb 23, 2024 | |
| Alpine Linux | alpine-linux-upgrade-c-ares | Mar 26, 2024 | Feb 23, 2024 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-c-aresamazon-linux-ami-2-upgrade-c-ares-debuginfoamazon-linux-ami-2-upgrade-c-ares-devel | Mar 19, 2024 | Feb 23, 2024 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-c-aresamazon-linux-2023-upgrade-c-ares-debuginfoamazon-linux-2023-upgrade-c-ares-debugsourceamazon-linux-2023-upgrade-c-ares-develamazon-linux-2023-upgrade-nodejsamazon-linux-2023-upgrade-nodejs20amazon-linux-2023-upgrade-nodejs20-debuginfoamazon-linux-2023-upgrade-nodejs20-debugsourceamazon-linux-2023-upgrade-nodejs20-develamazon-linux-2023-upgrade-nodejs20-docsamazon-linux-2023-upgrade-nodejs20-full-i18namazon-linux-2023-upgrade-nodejs20-libsamazon-linux-2023-upgrade-nodejs20-libs-debuginfoamazon-linux-2023-upgrade-nodejs20-npmamazon-linux-2023-upgrade-nodejs-debuginfoamazon-linux-2023-upgrade-nodejs-debugsourceamazon-linux-2023-upgrade-nodejs-develamazon-linux-2023-upgrade-nodejs-docsamazon-linux-2023-upgrade-nodejs-full-i18namazon-linux-2023-upgrade-nodejs-libsamazon-linux-2023-upgrade-nodejs-libs-debuginfoamazon-linux-2023-upgrade-nodejs-npmamazon-linux-2023-upgrade-v8-10-2-develamazon-linux-2023-upgrade-v8-11-3-devel | Feb 17, 2025 | Feb 23, 2024 | |
| Debian | no-fix-debian-deb-package | May 15, 2025 | Feb 23, 2024 | |
| Freebsd | freebsd-upgrade-package-c-ares | Feb 25, 2024 | Feb 23, 2024 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-c-ares | Nov 11, 2024 | Feb 23, 2024 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-c-ares | Oct 9, 2024 | Feb 23, 2024 | |
| Huawei Euleros 2_0_sp12 | huawei-euleros-2_0_sp12-upgrade-c-ares | Oct 9, 2024 | Feb 23, 2024 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-c-areshuawei-euleros-2_0_sp8-upgrade-c-ares-devel | Jul 23, 2024 | Feb 23, 2024 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-c-ares | Nov 11, 2024 | Feb 23, 2024 | |
| Oracle_linux | — | oracle-linux-upgrade-c-aresoracle-linux-upgrade-c-ares-develoracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-libsoracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-nodejs-packaging-bundleroracle-linux-upgrade-npm | May 9, 2024 | Feb 23, 2024 |
| Redhat_linux | redhat-upgrade-c-aresredhat-upgrade-c-ares-debuginforedhat-upgrade-c-ares-debugsourceredhat-upgrade-c-ares-develredhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-libsredhat-upgrade-nodejs-libs-debuginforedhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-nodejs-packaging-bundlerredhat-upgrade-npm | May 13, 2024 | Feb 23, 2024 | |
| Rocky_linux | rocky-upgrade-c-aresrocky-upgrade-c-ares-debuginforocky-upgrade-c-ares-debugsourcerocky-upgrade-c-ares-develrocky-upgrade-nodejsrocky-upgrade-nodejs-debuginforocky-upgrade-nodejs-debugsourcerocky-upgrade-nodejs-develrocky-upgrade-nodejs-full-i18nrocky-upgrade-nodejs-libsrocky-upgrade-nodejs-libs-debuginforocky-upgrade-npm | May 13, 2024 | Feb 23, 2024 | |
| Suse | — | suse-upgrade-c-ares-develsuse-upgrade-c-ares-utilssuse-upgrade-libcares-develsuse-upgrade-libcares2suse-upgrade-libcares2-32bit | Apr 9, 2024 | Feb 23, 2024 |
| Ubuntu | ubuntu-pro-upgrade-libc-ares2ubuntu-upgrade-libc-ares2 | Mar 7, 2024 | Feb 23, 2024 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Feb 23, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub