CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2017-9108
https://notcve.org/view.php?id=CVE-2017-9108
An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte. Se detectó un problema en adns versiones anteriores a 1.5.2. adnshost maneja inapropiadamente una falta de una nueva línea final en una lectura estándar. • http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-9109
https://notcve.org/view.php?id=CVE-2017-9109
An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00037.html http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ https://www.chiark.greenend.org.uk/piper • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.4EPSS: 1%CPEs: 14EXPL: 1CVE-2008-4100
https://notcve.org/view.php?id=CVE-2008-4100
GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. NOTE: the vendor reports that this is intended behavior and is compatible with the product's intended role in a trusted environment. GNU adns 1.4 y versiones anteriores que utilizan un puerto de origen fijo e IDs de transacciones secuenciales, el cual hace más fácil a los atacantes remotos envenenar las repuestas DNS, diferente vulnerabilidad que CVE-2008-1447. NOTA: el fabricante anuncia que este comportamiento previsto es compatible con la función prevista del producto en un entorno seguro. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492698 http://www.openwall.com/lists/oss-security/2008/09/11/1 http://www.openwall.com/lists/oss-security/2008/09/16/4 https://www.exploit-db.com/exploits/6197 • CWE-16: Configuration •