{"id":"CVE-2016-5180","details":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.","modified":"2026-07-08T05:49:12.385055698Z","published":"2016-10-03T15:59:03.270Z","related":["SUSE-SU-2016:2898-1","SUSE-SU-2016:3286-1","SUSE-SU-2016:3287-1","openSUSE-SU-2024:10147-1","openSUSE-SU-2024:10247-1"],"database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"},{"introduced":"1.3.0"},{"last_affected":"1.3.0"}],"source":"CPE_STRING","vendor_product":"c-ares:c-ares","cpes":["cpe:2.3:a:c-ares:c-ares:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.3.0:*:*:*:*:*:*:*"]},{"extracted_events":[{"introduced":"12.04"},{"last_affected":"12.04"},{"introduced":"14.04"},{"last_affected":"14.04"},{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"16.10"},{"last_affected":"16.10"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux","cpes":["cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*"]},{"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"http://www.securityfocus.com/bid/93243"},{"type":"WEB","url":"https://c-ares.haxx.se/CVE-2016-5180.patch"},{"type":"WEB","url":"https://c-ares.haxx.se/adv_20160929.html"},{"type":"WEB","url":"https://source.android.com/security/bulletin/2017-01-01.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-0002.html"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3682"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-3143-1"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201701-28"},{"type":"ARTICLE","url":"https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/c-ares/c-ares","events":[{"introduced":"7325b5ca07a6ca9d1875df1a396a4016eae42598"},{"last_affected":"e7fe2744db383c4489b7adc2b74f8ec3069367e4"}],"database_specific":{"extracted_events":[{"introduced":"1.1.0"},{"last_affected":"1.1.0"},{"introduced":"1.2.0"},{"last_affected":"1.2.0"},{"introduced":"1.2.1"},{"last_affected":"1.2.1"},{"introduced":"1.3.1"},{"last_affected":"1.3.1"},{"introduced":"1.3.2"},{"last_affected":"1.3.2"},{"introduced":"1.4.0"},{"last_affected":"1.4.0"},{"introduced":"1.5.0"},{"last_affected":"1.5.0"},{"introduced":"1.5.1"},{"last_affected":"1.5.1"},{"introduced":"1.5.2"},{"last_affected":"1.5.2"},{"introduced":"1.5.3"},{"last_affected":"1.5.3"},{"introduced":"1.6.0"},{"last_affected":"1.6.0"},{"introduced":"1.7.0"},{"last_affected":"1.7.0"},{"introduced":"1.7.1"},{"last_affected":"1.7.1"},{"introduced":"1.7.2"},{"last_affected":"1.7.2"},{"introduced":"1.7.3"},{"last_affected":"1.7.3"},{"introduced":"1.7.4"},{"last_affected":"1.7.4"},{"introduced":"1.7.5"},{"last_affected":"1.7.5"},{"introduced":"1.8.0"},{"last_affected":"1.8.0"},{"introduced":"1.9.0"},{"last_affected":"1.9.0"},{"introduced":"1.9.1"},{"last_affected":"1.9.1"},{"introduced":"1.10.0"},{"last_affected":"1.10.0"},{"introduced":"1.11.0"},{"last_affected":"1.11.0"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:c-ares:c-ares:1.1.0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.2.0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.3.2:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.5.0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.5.1:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.5.2:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.5.3:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.6.0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.7.0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.7.1:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.7.2:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.7.3:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.7.4:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.7.5:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.8.0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.9.0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c-ares:1.10.0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares_project:c-ares:1.11.0:*:*:*:*:*:*:*"]}}],"versions":["1.1.0","1.10.0","1.11.0","1.2.0","1.2.1","1.3.1","1.3.2","1.4.0","1.5.0","1.5.1","1.5.2","1.5.3","1.6.0","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.8.0","1.9.0","1.9.1","cares-1_11_0","cares-1_11_0-rc1","cares-1_10_0","cares-1_9_1","cares-1_9_0","cares-1_8_0","cares-1_7_5","cares-1_7_4","cares-1_7_3","cares-1_7_2","cares-1_7_1","curl-7_20_0","cares-1_7_0","curl-7_19_7","curl-7_19_6","curl-7_19_5","curl-7_19_4","curl-7_19_3","cares-1_6_0","curl-7_19_2","curl-7_19_0","cares-1_5_3","curl-7_18_2","cares-1_5_2","curl-7_18_1","curl-7_18_0","cares-1_5_1","cares-1_5_0","curl-7_17_1","curl-7_17_0","curl-7_16_4","curl-7_16_3","cares-1_4_0","curl-7_16_2","curl-7_16_1","cares-1_3_2","curl-7_16_0","curl-7_15_6-prepipeline","curl-7_15_5","cares-1_3_1","curl-7_15_4","curl-7_15_3","curl-7_15_1","curl-7_15_0","curl-7_14_1","curl-7_14_0","curl-7_13_2","curl-7_13_1","curl-7_13_0","cares-1_2_1","curl-7_12_2","curl-7_12_1","curl-7_12_0","c-ares-1_2_0","curl-7_11_1","cares-1_1_0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5180.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/nodejs/node","events":[{"introduced":"163ca274230fce536afe76c64676c332693ad7c1"},{"fixed":"262dd62a9248d7021966a9d00cd6632ea1f087bc"},{"introduced":"2b18916ff054309a07408719b62e2b6a4f1e056a"},{"fixed":"1da5ccffbcaf126d34442b55194cde86c8a583a4"},{"introduced":"f9f837885343a2a3f5ba2b8c510eaac395c8c865"},{"fixed":"f0052e40cdee7371bd209e84554f0bb43357aa14"}],"database_specific":{"extracted_events":[{"introduced":"0.10.0"},{"fixed":"0.10.48"},{"introduced":"0.12.0"},{"fixed":"0.12.17"},{"introduced":"4.0.0"},{"fixed":"4.6.1"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"}}],"versions":["v4.6.0","v4.5.0","v4.4.7","v4.4.6","v4.4.5","v4.4.4","v4.4.3","v4.4.2","v4.4.1","v4.4.0","v4.3.2","v4.3.1","v4.3.0","v4.2.6","v4.2.5","v4.2.4","v4.2.3","v4.2.2","v4.2.1","v4.2.0","v4.1.2","v4.1.1","v4.1.0","v4.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5180.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}