Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-14492 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Dnsmasq

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-122 — Heap-based Buffer Overflow12 documents9 sources
Severity
9.8CRITICALNVD
EPSS
92.8%
top 0.23%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
6
Thekelleys DnsmasqCanonical Ubuntu LinuxDebian Linux+3 more
Timeline
PublishedOct 3
Latest updateMay 14

Description

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶Debianthekelleys/dnsmasq< 2.78-1+3

Also affects: Debian Linux 7.0, 7.1, 9.0, Ubuntu Linux 14.04, 16.04, 17.04

Patches

Patch: access.redhat.com ↗Patch: access.redhat.com ↗Patch: access.redhat.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-6wc4-q6rh-cfvh: Heap-based buffer overflow in dnsmasq before 2↗2022-05-14
▶
OSV
CVE-2017-14492: Heap-based buffer overflow in dnsmasq before 2↗2017-10-03
▶
CVEList
CVE-2017-14492: Heap-based buffer overflow in dnsmasq before 2↗2017-10-02
▶
OSV
dnsmasq vulnerabilities↗2017-10-02
▶

💥Exploits & PoCs

1
Exploit-DB
Dnsmasq < 2.78 - Heap Overflow↗2017-10-02
▶

📋Vendor Advisories

4
Ubuntu
Dnsmasq vulnerabilities↗2017-10-03
▶
Ubuntu
Dnsmasq vulnerabilities↗2017-10-02
▶
Red Hat
dnsmasq: heap overflow in the IPv6 router advertisement code↗2017-10-02
▶
Debian
CVE-2017-14492: dnsmasq - Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cau...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-14491 CVE-2017-14492 CVE-2017-14493 CVE-2017-14494 CVE-2017-14495 CVE-2017-14496 dnsmasq: various flaws [fedora-all]↗2017-10-02
▶
Bugzilla
CVE-2017-14492 dnsmasq: heap overflow in the IPv6 router advertisement code↗2017-09-26
▶
CVE-2017-14492 — Thekelleys Dnsmasq vulnerability | cvebase