CVE-2024-25629mediumCWE-127

CVE-2024-25629: falha de média gravidade em c-ares

c-ares out of bounds read in ares__read_line()

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar c-ares+ Monitorar c-ares

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.4epss 0.4%
c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
c-ares · c-ares
CVEs relacionadas — c-ares

No mesmo produto, das mais perigosas para as menos.

CVE-2023-32067HIGH0-byte UDP payload DoS in c-aresEPSS 1.6%CVE-2023-31124LOWAutoTools does not set CARES_RANDOM_FILE during cross compilationEPSS 0.9%CVE-2023-31147MEDIUMInsufficient randomness in generation of DNS query IDs in c-aresEPSS 0.9%CVE-2026-33630HIGHc-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCPEPSS 0.8%CVE-2025-31498HIGHc-ares has a use-after-free in read_answers()EPSS 0.6%CVE-2026-69184HIGHc-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chainsEPSS 0.5%