| Snyk

Threat Intelligence

62.96% (99^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Input Validation vulnerabilities in an interactive lesson.

Start learning

Snyk IDSNYK-ALPINE320-DNSMASQ-7008821
published23 May 2024
disclosed3 Oct 2017

Report a new vulnerability Found a mistake?

Introduced: 3 Oct 2017

CVE-2017-13704 (opens in a new tab) CWE-20 (opens in a new tab)

How to fix?

Upgrade Alpine:3.20 dnsmasq to version 2.78-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream dnsmasq package and not the dnsmasq package as distributed by Alpine. See How to fix? for Alpine:3.20 relevant fixed versions and status.

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.

Improper Input Validation Affecting dnsmasq package, versions <2.78-r0

Severity