CVE-2019-25034
unbound: integer overflow in sldns_str2wire_dname_buf_origin can lead to an out-of-bounds write
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited
** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un desbordamiento de enteros en la función sldns_str2wire_dname_buf_origin, conllevando a una escritura fuera de límites. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instalación de Unbound en funcionamiento no puede ser explotada de forma remota o local
A flaw was found in unbound. An integer overflow in the sldns_str2wire_dname_buf_origin function may lead to a buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-04-27 CVE Reserved
- 2021-04-27 CVE Published
- 2024-05-14 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-190: Integer Overflow or Wraparound
- CWE-787: Out-of-bounds Write
CAPEC
References (5)
URL | Tag | Source |
---|---|---|
https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html | Mailing List | |
https://security.netapp.com/advisory/ntap-20210507-0007 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results | 2024-05-17 |
URL | Date | SRC |
---|---|---|
https://access.redhat.com/security/cve/CVE-2019-25034 | 2022-02-22 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1954778 | 2022-02-22 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Nlnetlabs Search vendor "Nlnetlabs" | Unbound Search vendor "Nlnetlabs" for product "Unbound" | < 1.9.5 Search vendor "Nlnetlabs" for product "Unbound" and version " < 1.9.5" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
|