CVE-2016-7069
CVE-2016-7069
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash.
CVSS 5.9 · Medium · EPSS 4.6% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
dnsdist
- Versions
- 1.2.0: Affected
No fix published
dnsdist Debian:12
- Affected ranges
- ECOSYSTEM: < 1.2.0-1
Update to 1.2.0-1
dnsdist Debian:13
- Affected ranges
- ECOSYSTEM: < 1.2.0-1
Update to 1.2.0-1
dnsdist Debian:14
- Affected ranges
- ECOSYSTEM: < 1.2.0-1
Update to 1.2.0-1
dnsdist Ubuntu:16.04:LTS
- Versions
- 1.0.0~alpha2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published