Debian Dnsmasq vulnerabilities

CVE-2023-28450 [HIGH] CVE-2023-28450: dnsmasq - An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP p... An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. Scope: local bookworm: resolved (fixed in 2.90-4~deb12u1) bullseye: resolved (fixed in 2.85-1+deb11u1) forky: resolved (fixed in 2.90-1) sid: resolved (fixed in 2.90-1) trixie: resolved (fixed in 2.90-1)

CVE-2015-8899 [HIGH] CVE-2015-8899: dnsmasq - Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) v... Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally. Scope: local bookworm: resolved (fixed in 2.76-1) bullseye: resolved (fixed in 2.76-1) forky: resolved (fixed in 2.76-1) sid: resolved (fixed in 2.76-1) trixie: resolved (fixed in 2.76-1)

CVE-2008-3214 [HIGH] CVE-2008-3214: dnsmasq - dnsmasq 2.25 allows remote attackers to cause a denial of service (daemon crash)... dnsmasq 2.25 allows remote attackers to cause a denial of service (daemon crash) by (1) renewing a nonexistent lease or (2) sending a DHCPREQUEST for an IP address that is not in the same network, related to the DHCP NAK response from the daemon. Scope: local bookworm: resolved (fixed in 2.26-1) bullseye: resolved (fixed in 2.26-1) forky: resolved (fixed in 2.26-1) si

CVE-2015-3294 [MEDIUM] CVE-2015-3294: dnsmasq - The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the ... The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request. Scope: local bookworm: resolved (fixed in 2.72-3.1) bullseye: resolved (fixed in 2.72-3.1) forky: resol

CVE-2020-14312 [MEDIUM] CVE-2020-14312: dnsmasq - A flaw was found in the default configuration of dnsmasq, as shipped with Fedora... A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an op

CVE-2005-0877 [HIGH] CVE-2005-0877: dnsmasq - Dnsmasq before 2.21 allows remote attackers to poison the DNS cache via answers ... Dnsmasq before 2.21 allows remote attackers to poison the DNS cache via answers to queries that were not made by Dnsmasq. Scope: local bookworm: resolved (fixed in 2.21) bullseye: resolved (fixed in 2.21) forky: resolved (fixed in 2.21) sid: resolved (fixed in 2.21) trixie: resolved (fixed in 2.21)

CVE-2012-3411 [MEDIUM] CVE-2012-3411: dnsmasq - Dnsmasq before 2.63test1, when used with certain libvirt configurations, replies... Dnsmasq before 2.63test1, when used with certain libvirt configurations, replies to requests from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed DNS query. Scope: local bookworm: resolved (fixed in 2.63-1) bullseye: resolved (fixed in 2.63-1) forky: resolved (fixed in 2.63-1) sid: resolved (fix

CVE-2021-3448 [MEDIUM] CVE-2021-3448: dnsmasq - A flaw was found in dnsmasq in versions before 2.85. When configured to use a sp... A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a D

CVE-2020-25686 [LOW] CVE-2020-25686: dnsmasq - A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq... A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substa

CVE-2013-0198 [MEDIUM] CVE-2013-0198: dnsmasq - Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies... Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via spoofed TCP based DNS queries. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3411. Scope: local bookworm: resolved (fixed in 2.66-1)

CVE-2020-25684 [LOW] CVE-2020-25684: dnsmasq - A flaw was found in dnsmasq before version 2.83. When getting a reply from a for... A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the net

CVE-2008-3350 [HIGH] CVE-2008-3350: dnsmasq - dnsmasq 2.43 allows remote attackers to cause a denial of service (daemon crash)... dnsmasq 2.43 allows remote attackers to cause a denial of service (daemon crash) by (1) sending a DHCPINFORM while lacking a DHCP lease, or (2) attempting to renew a nonexistent DHCP lease for an invalid subnet as an "unknown client," a different vulnerability than CVE-2008-3214. Scope: local bookworm: resolved (fixed in 2.44-1) bullseye: resolved (fixed in 2.44-1) fo

CVE-2020-37127 [MEDIUM] CVE-2020-37127: dnsmasq - Dnsmasq-utils 2.79-1 contains a buffer overflow vulnerability in the dhcp_releas... Dnsmasq-utils 2.79-1 contains a buffer overflow vulnerability in the dhcp_release utility that allows attackers to cause a denial of service by supplying excessive input. Attackers can trigger a core dump and terminate the dhcp_release process by sending a crafted input string longer than 16 characters. Scope: local bookworm: resolved (fixed in 2.80-1) bullseye: r

CVE-2020-25685 [LOW] CVE-2020-25685: dnsmasq - A flaw was found in dnsmasq before version 2.83. When getting a reply from a for... A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find s

CVE-2005-0876 [MEDIUM] CVE-2005-0876: dnsmasq - Off-by-one buffer overflow in Dnsmasq before 2.21 may allow attackers to execute... Off-by-one buffer overflow in Dnsmasq before 2.21 may allow attackers to execute arbitrary code via the DHCP lease file. Scope: local bookworm: resolved (fixed in 2.21) bullseye: resolved (fixed in 2.21) forky: resolved (fixed in 2.21) sid: resolved (fixed in 2.21) trixie: resolved (fixed in 2.21)

CVE-2006-2017 [MEDIUM] CVE-2006-2017: dnsmasq - Dnsmasq 2.29 allows remote attackers to cause a denial of service (application c... Dnsmasq 2.29 allows remote attackers to cause a denial of service (application crash) via a DHCP client broadcast reply request. Scope: local bookworm: resolved (fixed in 2.30-1) bullseye: resolved (fixed in 2.30-1) forky: resolved (fixed in 2.30-1) sid: resolved (fixed in 2.30-1) trixie: resolved (fixed in 2.30-1)

CVE-2019-14834 [LOW] CVE-2019-14834: dnsmasq - A vulnerability was found in dnsmasq before version 2.81, where the memory leak ... A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via vectors involving DHCP response creation. Scope: local bookworm: resolved (fixed in 2.81-1) bullseye: resolved (fixed in 2.81-1) forky: resolved (fixed in 2.81-1) sid: resolved (fixed in 2.81-1) trixie: resolved