{"id":"MGASA-2017-0367","summary":"Updated dnsmasq packages fix security vulnerabilities","details":"An audit by mozilla security found several vulnerability and potential\nvulnerability in dnsmasq:\n- Uninitialized buffer leads to memory leakage\n- Allocated memory is not cleared\n- Unchecked return value can lead to NULL pointer dereference\n- Hardcoded values in fscanf() format strings with aliased buffers \n\nCVE-2017-13704: Dnsmasq could be made to crash on a large DNS query: A\nDNS query received by UDP which exceeds 512 bytes (or the EDNS0 packet\nsize, if different.) is enough to cause SIGSEGV. (bug 21793)\n\nCVE-2017-14491: A heap buffer overflow was found in dnsmasq in the code\nresponsible for building DNS replies. An attacker could send crafted DNS\npackets to dnsmasq which would cause it to crash or, potentially,\nexecute arbitrary code.\n\nCVE-2017-14492: A heap buffer overflow was discovered in dnsmasq in the\nIPv6 router advertisement (RA) handling code. An attacker on the local\nnetwork segment could send crafted RAs to dnsmasq which would cause it\nto crash or, potentially, execute arbitrary code. This issue only\naffected configurations using one of these options: enable-ra, ra-only,\nslaac, ra-names, ra-advrouter, or ra-stateless.\n\nCVE-2017-14493: A stack buffer overflow was found in dnsmasq in the\nDHCPv6 code. An attacker on the local network could send a crafted\nDHCPv6 request to dnsmasq which would cause it to a crash or,\npotentially, execute arbitrary code.\n\nCVE-2017-14494: An information leak was found in dnsmasq in the\nDHCPv6 relay code. An attacker on the local network could send crafted\nDHCPv6 packets to dnsmasq causing it to forward the contents of process\nmemory, potentially leaking sensitive data.\n\nCVE-2017-14495: A memory exhaustion flaw was found in dnsmasq in the\nEDNS0 code. An attacker could send crafted DNS packets which would\ntrigger memory allocations which would never be freed, leading to\nunbounded memory consumption and eventually a crash. This issue only\naffected configurations using one of the options: add-mac, add-cpe-id,\nor add-subnet.\n\nCVE-2017-14496: An integer underflow flaw leading to a buffer\nover-read was found in dnsmasq in the EDNS0 code. An attacker could\nsend crafted DNS packets to dnsmasq which would cause it to crash.\nThis issue only affected configurations using one of the options:\nadd-mac, add-cpe-id, or add-subnet.\n","modified":"2026-04-16T06:26:24.876060983Z","published":"2017-10-09T09:51:10Z","upstream":["CVE-2017-13704","CVE-2017-14491","CVE-2017-14492","CVE-2017-14493","CVE-2017-14494","CVE-2017-14495","CVE-2017-14496"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2017-0367.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=19528"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=21793"},{"type":"WEB","url":"https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf"},{"type":"WEB","url":"https://docs.google.com/document/d/14y2kiXgB69fLBY0xuMeqc-YiZg4UDCw2xd4-mZspoP8"},{"type":"WEB","url":"http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2017q3/011692.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4TK6DWC53WSU6633EVZL7H4PCWBYHMHK/"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2017:2836"},{"type":"WEB","url":"https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"}],"affected":[{"package":{"name":"dnsmasq","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/dnsmasq?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.77-1.1.mga5"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2017-0367.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}