Vulnerability CVE-2017-14493: Information

Description

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-14493

Published: Oct. 3, 2017

Modified: Nov. 7, 2023

Error type identifier: CWE-119

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
dnsmasq	sisyphus	2.78-alt1	2.90-alt1	ALT-PU-2017-2387-1	190404	Fixed
dnsmasq	p10	2.78-alt1	2.90-alt1	ALT-PU-2017-2387-1	190404	Fixed
dnsmasq	p9	2.78-alt1	2.85-alt2.p9.1	ALT-PU-2017-2387-1	190404	Fixed
dnsmasq	p8	2.78-alt0.M80P.1	2.78-alt0.M80P.1	ALT-PU-2017-2399-1	190531	Fixed
dnsmasq	c10f1	2.78-alt1	2.90-alt1	ALT-PU-2017-2387-1	190404	Fixed
dnsmasq	c9f2	2.78-alt1	2.90-alt1	ALT-PU-2017-2387-1	190404	Fixed
dnsmasq	c7	2.72-alt1.M70C.2	2.72-alt1.M70C.2	ALT-PU-2017-2408-1	190552	Fixed
dnsmasq	p11	2.78-alt1	2.90-alt1	ALT-PU-2017-2387-1	190404	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html	Third Party Advisory
http://thekelleys.org.uk/dnsmasq/CHANGELOG	Release Notes Vendor Advisory
1039474	Third Party Advisory VDB Entry
42943	Exploit Third Party Advisory VDB Entry
101085	Third Party Advisory VDB Entry
VU#973527	Third Party Advisory US Government Resource
https://access.redhat.com/security/vulnerabilities/3199382	Issue Tracking Third Party Advisory
RHSA-2017:2837	Patch Third Party Advisory
RHSA-2017:2836	Patch Third Party Advisory
USN-3430-2	Third Party Advisory
USN-3430-1	Third Party Advisory
DSA-3989	Third Party Advisory
openSUSE-SU-2017:2633	Issue Tracking Mailing List Third Party Advisory
http://nvidia.custhelp.com/app/answers/detail/a_id/4561	Third Party Advisory
GLSA-201710-27	Third Party Advisory
https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq	Third Party Advisory
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt
http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=3d4ff1ba8419546490b464418223132529514033
[dnsmasq-discuss] 20171002 Announce: dnsmasq-2.78.
[dnsmasq-discuss] 20171002 IMPORTANT SECURITY INFORMATION.

Affected configurations:
1. Configuration 1
  cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
  cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  cpe:2.3:o:debian:debian_linux:7.1:*:*:*:*:*:*:*
  cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*
  cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*
  cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*
  
  Configuration 2
  cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*
  End including
  2.77

Version: v24.5.3

Vulnerability CVE-2017-14493: Information

Description

Fixed packages

References to Advisories, Solutions, and Tools

Configuration 1

Configuration 2