CVE-2016-5180

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-5180
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2017-0002.html
http://www.debian.org/security/2016/dsa-3682
http://www.securityfocus.com/bid/93243
http://www.ubuntu.com/usn/USN-3143-1
https://c-ares.haxx.se/CVE-2016-5180.patch
https://c-ares.haxx.se/adv_20160929.html
https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html
https://security.gentoo.org/glsa/201701-28
https://source.android.com/security/bulletin/2017-01-01.html
http://rhn.redhat.com/errata/RHSA-2017-0002.html
http://www.debian.org/security/2016/dsa-3682
http://www.securityfocus.com/bid/93243
http://www.ubuntu.com/usn/USN-3143-1
https://c-ares.haxx.se/CVE-2016-5180.patch
https://c-ares.haxx.se/adv_20160929.html
https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html
https://security.gentoo.org/glsa/201701-28
https://source.android.com/security/bulletin/2017-01-01.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:c-ares:c-ares:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.2:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.3:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.4:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.5:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.9.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.11.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*
History

21 Nov 2024, 02:53

Type Values Removed Values Added
References () http://rhn.redhat.com/errata/RHSA-2017-0002.html - () http://rhn.redhat.com/errata/RHSA-2017-0002.html -
References () http://www.debian.org/security/2016/dsa-3682 - () http://www.debian.org/security/2016/dsa-3682 -
References () http://www.securityfocus.com/bid/93243 - () http://www.securityfocus.com/bid/93243 -
References () http://www.ubuntu.com/usn/USN-3143-1 - () http://www.ubuntu.com/usn/USN-3143-1 -
References () https://c-ares.haxx.se/CVE-2016-5180.patch - () https://c-ares.haxx.se/CVE-2016-5180.patch -
References () https://c-ares.haxx.se/adv_20160929.html - () https://c-ares.haxx.se/adv_20160929.html -
References () https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html - () https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html -
References () https://security.gentoo.org/glsa/201701-28 - () https://security.gentoo.org/glsa/201701-28 -
References () https://source.android.com/security/bulletin/2017-01-01.html - () https://source.android.com/security/bulletin/2017-01-01.html -

16 Aug 2022, 13:17

Type Values Removed Values Added
CPE cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
References (CONFIRM) https://c-ares.haxx.se/CVE-2016-5180.patch - Patch (CONFIRM) https://c-ares.haxx.se/CVE-2016-5180.patch - Patch, Third Party Advisory
References (UBUNTU) http://www.ubuntu.com/usn/USN-3143-1 - (UBUNTU) http://www.ubuntu.com/usn/USN-3143-1 - Third Party Advisory
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2017-0002.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2017-0002.html - Third Party Advisory
References (CONFIRM) https://source.android.com/security/bulletin/2017-01-01.html - (CONFIRM) https://source.android.com/security/bulletin/2017-01-01.html - Third Party Advisory
References (BID) http://www.securityfocus.com/bid/93243 - Broken Link (BID) http://www.securityfocus.com/bid/93243 - Broken Link, Third Party Advisory, VDB Entry
References (GENTOO) https://security.gentoo.org/glsa/201701-28 - (GENTOO) https://security.gentoo.org/glsa/201701-28 - Third Party Advisory
Information

Published : 2016-10-03 15:59

Updated : 2024-11-21 02:53

NVD link : CVE-2016-5180

Mitre link : CVE-2016-5180

CVE.ORG link : CVE-2016-5180

JSON object : View

Products Affected

debian

  • debian_linux

nodejs

  • node.js

canonical

  • ubuntu_linux

c-ares_project

  • c-ares

c-ares

  • c-ares
CWE
CWE-787

Out-of-bounds Write