CVE-2016-5180
CriticalSummary
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a hostname with an escaped trailing dot.
Risk Assessment
An attacker could exploit this vulnerability to remotely trigger a denial of service or execute malicious code, potentially leading to severe security implications.
Recommendation
It is recommended to upgrade c-ares to version 1.12.0 or later to mitigate this vulnerability.
Other vulnerabilities in c-ares
See all- CVE-2017-1000381High
The `ares_parse_naptr_reply()` function in the c-ares library may read memory outside of the given input buffer if the passed DNS response packet is crafted in a specific way.
- CVE-2026-33630High
c-ares is an asynchronous resolver library. From version 1.32.3 until 1.34.7, a use-after-free / double-free vulnerability exists in query-completion handling. The same flaw is present at multiple points in the resend/finish path.
Original NVD description (English source)
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.