CVE-2017-9108

published 2020-06-18

CVE-2017-9108: An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r…

Priority P3 38 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	adns	< adns 1.6.0-2 (bookworm)	adns 1.6.0-2 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
gnu	adns	< 1.5.2	1.5.2
gnu	adns	>= 0 < 1.6.0-2	1.6.0-2
gnu	adns	>= 0 < 1.6.0-2	1.6.0-2
gnu	adns	>= 0 < 1.6.0-2	1.6.0-2
gnu	adns	>= 0 < 1.6.0-2	1.6.0-2
opensuse	leap	—	—

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:N/A:P

osv 7.5 HIGH

vendor_debian 7.5 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119