CVE-2016-5180: Buffer Overflow
Published Oct 3, 2016
·Updated
Heap-based buffer overflow in the arescreatequery function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.
Affected Software
33 affected components
Google Android
c-ares c-ares=1.0.0
c-ares c-ares=1.1.0
c-ares c-ares=1.2.0
c-ares c-ares=1.2.1
c-ares c-ares=1.3.0
c-ares c-ares=1.3.1
c-ares c-ares=1.3.2
c-ares c-ares=1.4.0
c-ares c-ares=1.5.0
c-ares c-ares=1.5.1
c-ares c-ares=1.5.2
c-ares c-ares=1.5.3
c-ares c-ares=1.6.0
c-ares c-ares=1.7.0
c-ares c-ares=1.7.1
c-ares c-ares=1.7.2
c-ares c-ares=1.7.3
c-ares c-ares=1.7.4
c-ares c-ares=1.7.5
c-ares c-ares=1.8.0
c-ares c-ares=1.9.0
c-ares c-ares=1.9.1
c-ares c-ares=1.10.0
C-ares Project C-ares=1.11.0
Debian Debian Linux=8.0
Nodejs Node.js>=0.10.0<0.10.48
Nodejs Node.js>=0.12.0<0.12.17
Nodejs Node.js>=4.0.0<4.6.1
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=16.10
Remediation
Patch Available
Event History
Oct 3, 2016
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-5180?
CVE-2016-5180 has a medium severity level due to its potential for denial of service and arbitrary code execution.
2
How do I fix CVE-2016-5180?
To fix CVE-2016-5180, upgrade c-ares to version 1.12.0 or later.
3
Which software versions are affected by CVE-2016-5180?
CVE-2016-5180 affects c-ares versions 1.0.0 through 1.11.0, as well as certain versions of Google Android and Node.js.
4
What type of vulnerability is CVE-2016-5180?
CVE-2016-5180 is a heap-based buffer overflow vulnerability.
5
Can CVE-2016-5180 lead to remote code execution?
Yes, CVE-2016-5180 can potentially allow remote attackers to execute arbitrary code.