CVE-2017-15650 musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.c does not restrict the number of addresses, and thus an attacker can provide an...
HighCVSS 7.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.c does not restrict the number of addresses, and thus an attacker can provide an unexpected number by sending A records in a reply to an AAAA query.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/musl(Debian:12) | < 1.1.17-1 | 1.1.17-1 |
| debian/musl(Debian:13) | < 1.1.17-1 | 1.1.17-1 |
| debian/musl(Debian:14) | < 1.1.17-1 | 1.1.17-1 |
| musl-libc musl | <= 1.1.6 | No fix listed |
| alpine/musl(Alpine:v3.2) | < 1.1.11-r5 | 1.1.11-r5 |
| alpine/musl(Alpine:v3.3) | < 1.1.12-r8 | 1.1.12-r8 |
| alpine/musl(Alpine:v3.4) | < 1.1.14-r16 | 1.1.14-r16 |
| alpine/musl(Alpine:v3.5) | < 1.1.15-r8 | 1.1.15-r8 |
| alpine/musl(Alpine:v3.6) | < 1.1.16-r14 | 1.1.16-r14 |
References
- Debian Security Tracker CVE-2017-15650 vendor-advisory
- git.musl-libc.org vendor-advisory
- git.musl-libc.org vendor-advisory
- openwall.com mailing-list mitigation third-party-advisory
- security.alpinelinux.org vendor-advisory