c-ares: Heap-based buffer overflow

c-ares: Heap-based buffer overflow A heap-based buffer overflow in c-ares might allow remote attackers to cause a Denial of Service condition. c-ares 2017-01-11 2017-01-11 595536 remote 1.12.0 1.12.0

c-ares is a C library for asynchronous DNS requests (including name resolves).

A hostname with an escaped trailing dot (such as “hello\.”) would have its size calculated incorrectly leading to a single byte written beyond the end of a buffer on the heap.

A remote attacker, able to provide a specially crafted hostname to an application using c-ares, could potentially cause a Denial of Service condition.

There is no known workaround at this time.

All c-ares users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=net-dns/c-ares-1.12.0"

CVE-2016-5180 whissi whissi