CVE-2017-1000381
Fixed in a distro release EPSS 3%
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.
Products: c-ares, c-ares_project c-ares, nodejs node.js
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | nodejs | 6.11.1-r0 |
| Alpine 3.11 | nodejs | 6.11.1-r0 |
| Alpine 3.12 | nodejs | 6.11.1-r0 |
| Alpine 3.13 | nodejs | 6.11.1-r0 |
| Alpine 3.14 | nodejs | 6.11.1-r0 |
| Alpine 3.15 | nodejs | 6.11.1-r0 |
| Alpine 3.16 | nodejs | 6.11.1-r0 |
| Alpine 3.17 | nodejs | 6.11.1-r0 |
| Alpine 3.18 | nodejs | 6.11.1-r0 |
| Alpine 3.19 | nodejs | 6.11.1-r0 |
| Alpine 3.20 | nodejs | 6.11.1-r0 |
| Alpine 3.21 | nodejs | 6.11.1-r0 |
| Alpine 3.22 | nodejs | 6.11.1-r0 |
| Alpine 3.23 | nodejs | 6.11.1-r0 |
| Alpine 3.24 | nodejs | 6.11.1-r0 |
| Alpine 3.3 | c-ares | 1.12.0-r1 |
| Alpine 3.4 | c-ares | 1.12.0-r1 |
| Alpine 3.4 | nodejs | 6.7.0-r1 |
| Alpine 3.5 | c-ares | 1.12.0-r1 |
| Alpine 3.5 | nodejs | 6.9.5-r1 |
| Alpine 3.6 | c-ares | 1.12.0-r1 |
| Alpine 3.6 | nodejs | 6.10.3-r1 |
| Alpine 3.7 | nodejs | 6.11.1-r0 |
| Alpine 3.8 | nodejs | 6.11.1-r0 |
| Alpine 3.9 | nodejs | 6.11.1-r0 |
| Arch Linux | c-ares | 1.13.0-1 |
| Debian 12 | c-ares | 1.12.0-4 |
| Debian 13 | c-ares | 1.12.0-4 |
| Debian 14 | c-ares | 1.12.0-4 |
| Debian 7 | c-ares | 1.9.1-3+deb7u2 |
| Red Hat rhel software collections 2 | rh-nodejs6-nodejs | 0:6.11.3-2.el6 |
| Red Hat rhel software collections 2 | rh-nodejs6-nodejs | 0:6.11.3-2.el7 |
| Red Hat rhel software collections 2 | rh-nodejs6-nodejs-debuginfo | 0:6.11.3-2.el7 |
| Red Hat rhel software collections 2 | rh-nodejs6-nodejs-debuginfo | 0:6.11.3-2.el6 |
| Red Hat rhel software collections 2 | rh-nodejs6-nodejs-devel | 0:6.11.3-2.el6 |
| Red Hat rhel software collections 2 | rh-nodejs6-nodejs-devel | 0:6.11.3-2.el7 |
| Red Hat rhel software collections 2 | rh-nodejs6-nodejs-docs | 0:6.11.3-2.el6 |
| Red Hat rhel software collections 2 | rh-nodejs6-nodejs-docs | 0:6.11.3-2.el7 |
| SUSE Enterprise Storage 4 | nodejs-common | 1.0-2.1 |
| SUSE Enterprise Storage 4 | nodejs4 | 4.8.4-15.5.1 |
| SUSE Enterprise Storage 4 | nodejs6 | 6.11.1-11.5.1 |
| SUSE Linux Enterprise Desktop 12 SP2 | libcares2 | 1.9.1-8.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs-common | 1.0-2.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs4 | 4.8.4-15.5.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs6 | 6.11.1-11.5.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox | 68.2.0-78.51.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox-branding-SLED | 68-21.9.8 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-atk | 2.26.1-2.8.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-cairo | 1.15.10-2.13.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-gdk-pixbuf | 2.36.11-2.8.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-glib2 | 2.54.3-2.14.7 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-gtk3 | 3.10.9-2.15.3 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-harfbuzz | 1.7.5-2.7.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-libffi | 3.2.1.git259-2.3.3 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-pango | 1.40.14-2.7.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mozilla-nspr | 4.21-29.6.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mozilla-nss | 3.45-38.9.3 |
| SUSE Linux Enterprise Server 12 SP2 | libcares2 | 1.9.1-8.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | libcares2 | 1.9.1-8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | libcares2 | 1.9.1-8.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | libcares2 | 1.9.1-8.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP2 | libcares2 | 1.9.1-8.1 |
| SUSE OpenStack Cloud 7 | nodejs-common | 1.0-2.1 |
| SUSE OpenStack Cloud 7 | nodejs6 | 6.11.1-11.5.1 |
| Ubuntu 14.04 LTS | c-ares | 1.10.0-2ubuntu0.2 |
| Ubuntu 16.04 LTS | c-ares | 1.10.0-3ubuntu0.2 |
| Ubuntu Pro 14.04 LTS | nodejs | 0.10.25~dfsg2-2ubuntu1.2+esm1 |
| Ubuntu Pro 16.04 LTS | nodejs | 4.2.6~dfsg-1ubuntu4.2+esm1 |
| Ubuntu Pro 18.04 LTS | nodejs | 8.10.0~dfsg-2ubuntu0.4+esm1 |
| openSUSE Tumbleweed | c-ares | 1.17.2-2.2 |