CVE-2015-3294
Fixed in a distro release EPSS 5%
The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request.
Products: thekelleys dnsmasq, oracle solaris
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | dnsmasq | 2.72-3.1 |
| Debian 13 | dnsmasq | 2.72-3.1 |
| Debian 14 | dnsmasq | 2.72-3.1 |
| Debian 6.0 | dnsmasq | 2.55-2+deb6u1 |
| Debian 7 | dnsmasq | 2.62-3+deb7u2 |
| Debian 8 | dnsmasq | 2.72-3+deb8u1 |
| SUSE Cloud Compute Node for SUSE Linux Enterprise 12 5 | dnsmasq | 2.71-4.1 |
| SUSE Linux Enterprise Desktop 12 | dnsmasq | 2.71-4.1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | dnsmasq | 2.78-0.16.5.1 |
| SUSE Linux Enterprise Server 11 SP3-LTSS | dnsmasq | 2.78-0.16.5.1 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | dnsmasq | 2.78-0.16.5.1 |
| SUSE Linux Enterprise Server 11 SP4 | dnsmasq | 2.78-0.17.5.1 |
| SUSE Linux Enterprise Server 12 | dnsmasq | 2.71-4.1 |
| SUSE Linux Enterprise Server 12-LTSS | dnsmasq | 2.78-6.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | dnsmasq | 2.78-0.17.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | dnsmasq | 2.71-4.1 |
| Ubuntu 14.04 LTS | dnsmasq | 2.68-1ubuntu0.1 |
| openSUSE Tumbleweed | dnsmasq | 2.76-1.3 |