Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-14493 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Dnsmasq

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-121 — Stack-based Buffer Overflow11 documents9 sources
Severity
9.8CRITICALNVD
EPSS
5.3%
top 9.92%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
7
Thekelleys DnsmasqCanonical Ubuntu LinuxDebian Linux+4 more
Timeline
PublishedOct 3
Latest updateMay 14

Description

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages6 packages

▶Debianthekelleys/dnsmasq< 2.78-1+3
▶NVDopensuse/leap42.2, 42.3+1

Also affects: Debian Linux 7.0, 7.1, 9.0, Ubuntu Linux 14.04, 16.04, 17.04

Patches

Patch: access.redhat.com ↗Patch: access.redhat.com ↗Patch: access.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-7mpq-366q-m6vq: Stack-based buffer overflow in dnsmasq before 2↗2022-05-14
▶
OSV
CVE-2017-14493: Stack-based buffer overflow in dnsmasq before 2↗2017-10-03
▶
CVEList
CVE-2017-14493: Stack-based buffer overflow in dnsmasq before 2↗2017-10-02
▶

💥Exploits & PoCs

1
Exploit-DB
Dnsmasq < 2.78 - Stack Overflow↗2017-10-02
▶

📋Vendor Advisories

4
Ubuntu
Dnsmasq vulnerabilities↗2017-10-03
▶
Red Hat
dnsmasq: stack buffer overflow in the DHCPv6 code↗2017-10-02
▶
Ubuntu
Dnsmasq vulnerabilities↗2017-10-02
▶
Debian
CVE-2017-14493: dnsmasq - Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to ca...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-14491 CVE-2017-14492 CVE-2017-14493 CVE-2017-14494 CVE-2017-14495 CVE-2017-14496 dnsmasq: various flaws [fedora-all]↗2017-10-02
▶
Bugzilla
CVE-2017-14493 dnsmasq: stack buffer overflow in the DHCPv6 code↗2017-09-26
▶
CVE-2017-14493 — Thekelleys Dnsmasq vulnerability | cvebase