CVE-2017-9108: Buffer Overflow
An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-9108?
CVE-2017-9108 is a vulnerability in adns before version 1.5.2 that mishandles a missing final newline on a stdin read.
What is the severity of CVE-2017-9108?
CVE-2017-9108 has a severity rating of 7.5 (High).
Which software versions are affected by CVE-2017-9108?
GNU adns up to version 1.5.2, openSUSE Leap 15.1, Fedoraproject Fedora 31, and Fedoraproject Fedora 32 are affected by CVE-2017-9108.
How can I fix CVE-2017-9108?
To fix CVE-2017-9108, you should update to adns version 1.5.2 or later.
Where can I find more information about CVE-2017-9108?
More information about CVE-2017-9108 can be found at the following references: [1] [2] [3].