CVE-2016-5180

CWE-787 — Out-of-bounds WriteCWE-193CWE-122 — Heap-based Buffer Overflow19 documents10 sources
Severity
9.8CRITICAL
EPSS
18.2%
top 4.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Nodejs Node.jsC-ares C-aresC-ares Project C-ares+2 more
Timeline
PublishedOct 3
Latest updateMay 14

Description

Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶Debianc-ares< 1.12.0-1+3
▶NVDc-ares/c-ares23 versions+22
▶NVDnodejs/node.js0.10.0 — 0.10.48+2

Also affects: Debian Linux 8.0, Ubuntu Linux 12.04, 14.04, 16.04, 16.10

🔴Vulnerability Details

3
GHSA
GHSA-29hr-5wcr-whpc: Heap-based buffer overflow in the ares_create_query function in c-ares 1↗2022-05-14
▶
OSV
CVE-2016-5180: Heap-based buffer overflow in the ares_create_query function in c-ares 1↗2016-10-03
▶
CVEList
CVE-2016-5180: Heap-based buffer overflow in the ares_create_query function in c-ares 1↗2016-10-03
▶

💥Exploits & PoCs

1
Exploit-DB
Adobe Connect 9.5.7 - Cross-Site Scripting↗2016-11-09
▶

📋Vendor Advisories

4
Android
CVE-2016-5180: Android Security Bulletin 2017-01-01 CVE: CVE-2016-5180 Severity: HIGH Affected AOSP versions: 7↗2017-01-01
▶
Ubuntu
c-ares vulnerability↗2016-11-30
▶
Red Hat
c-ares: Single byte out of buffer write↗2016-09-29
▶
Debian
CVE-2016-5180: c-ares - Heap-based buffer overflow in the ares_create_query function in c-ares 1.x befor...↗2016
▶

💬Community

10
Bugzilla
CVE-2017-1000381 c-ares: NAPTR parser out of bounds access↗2017-06-20
▶
Bugzilla
CVE-2016-5180 nodejs: c-ares: Single byte out of buffer write [epel-all]↗2016-10-27
▶
Bugzilla
CVE-2016-5180 nodejs: c-ares: Single byte out of buffer write [fedora-all]↗2016-10-27
▶
Bugzilla
CVE-2016-5180 mingw-c-ares: c-ares: Single byte out of buffer write [epel-7]↗2016-09-30
▶
Bugzilla
CVE-2016-5180 mingw-c-ares: c-ares: Single byte out of buffer write [epel-6]↗2016-09-29
▶
CVE-2016-5180 (CRITICAL CVSS 9.8) | Heap-based buffer overflow in the a | cvebase.io