Homepage

Improper Input Validation Affecting dnsmasq package, versions <2.78-1

Severity

 Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
62.96% (99th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN13-DNSMASQ-5674420
  • published3 Oct 2017
  • disclosed3 Oct 2017
Report a new vulnerability Found a mistake?

Introduced: 3 Oct 2017

CVE-2017-13704  (opens in a new tab)
CWE-20  (opens in a new tab)

How to fix?

Upgrade Debian:13 dnsmasq to version 2.78-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream dnsmasq package and not the dnsmasq package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.

References