A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-c-aresalma-upgrade-c-ares-develalma-upgrade-nodejsalma-upgrade-nodejs-develalma-upgrade-nodejs-docsalma-upgrade-nodejs-full-i18nalma-upgrade-nodejs-libsalma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packagingalma-upgrade-nodejs-packaging-bundleralma-upgrade-npm | Apr 21, 2023 | Mar 6, 2023 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-c-aresamazon-linux-ami-2-upgrade-c-ares-debuginfoamazon-linux-ami-2-upgrade-c-ares-devel | Jan 10, 2024 | Mar 6, 2023 | |
| Amazon_linux | — | amazon-linux-upgrade-c-ares | Jul 20, 2023 | Feb 23, 2023 |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-c-aresamazon-linux-2023-upgrade-c-ares-debuginfoamazon-linux-2023-upgrade-c-ares-debugsourceamazon-linux-2023-upgrade-c-ares-develamazon-linux-2023-upgrade-nodejsamazon-linux-2023-upgrade-nodejs-debuginfoamazon-linux-2023-upgrade-nodejs-debugsourceamazon-linux-2023-upgrade-nodejs-develamazon-linux-2023-upgrade-nodejs-docsamazon-linux-2023-upgrade-nodejs-full-i18namazon-linux-2023-upgrade-nodejs-libsamazon-linux-2023-upgrade-nodejs-libs-debuginfoamazon-linux-2023-upgrade-npmamazon-linux-2023-upgrade-v8-devel | Feb 17, 2025 | Dec 13, 2022 | |
| Centos_linux | — | centos-upgrade-c-arescentos-upgrade-c-ares-debuginfocentos-upgrade-c-ares-debugsourcecentos-upgrade-c-ares-develcentos-upgrade-nodejscentos-upgrade-nodejs-debuginfocentos-upgrade-nodejs-debugsourcecentos-upgrade-nodejs-develcentos-upgrade-nodejs-docscentos-upgrade-nodejs-full-i18ncentos-upgrade-nodejs-libscentos-upgrade-nodejs-libs-debuginfocentos-upgrade-nodejs-nodemoncentos-upgrade-nodejs-packagingcentos-upgrade-nodejs-packaging-bundlercentos-upgrade-npm | Apr 10, 2023 | Mar 6, 2023 |
| Debian | debian-upgrade-c-ares | Feb 21, 2023 | Feb 21, 2023 | |
| Dell Powerstore Dsa2023366 | dell-powerstoreos-upgrade-latest | Oct 23, 2025 | Oct 5, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-net-dns-c-ares | Jan 8, 2024 | Mar 6, 2023 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-c-ares | May 18, 2023 | Mar 6, 2023 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-c-ares | Jul 5, 2023 | Mar 6, 2023 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-c-ares | May 10, 2023 | Mar 6, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-c-aresoracle-linux-upgrade-c-ares-develoracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-libsoracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-nodejs-packaging-bundleroracle-linux-upgrade-npm | Apr 5, 2023 | Dec 13, 2022 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-c-aresredhat-upgrade-c-ares-debuginforedhat-upgrade-c-ares-debugsourceredhat-upgrade-c-ares-develredhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-libsredhat-upgrade-nodejs-libs-debuginforedhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-nodejs-packaging-bundlerredhat-upgrade-npm | Apr 3, 2023 | Mar 6, 2023 | |
| Rocky_linux | rocky-upgrade-nodejsrocky-upgrade-nodejs-debuginforocky-upgrade-nodejs-debugsourcerocky-upgrade-nodejs-develrocky-upgrade-nodejs-full-i18nrocky-upgrade-nodejs-libsrocky-upgrade-nodejs-libs-debuginforocky-upgrade-npm | Mar 5, 2024 | Mar 6, 2023 | |
| Suse | — | suse-upgrade-c-ares-develsuse-upgrade-c-ares-utilssuse-upgrade-libcares-develsuse-upgrade-libcares2suse-upgrade-libcares2-32bit | Feb 24, 2023 | Feb 23, 2023 |
| Ubuntu | ubuntu-upgrade-libc-ares2 | Mar 22, 2023 | Mar 6, 2023 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Mar 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub