CVE Catalog
CVE-2016-5180
CriticalSummary
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a hostname with an escaped trailing dot.
Risk Assessment
An attacker could exploit this vulnerability to remotely trigger a denial of service or execute malicious code, potentially leading to severe security implications.
Recommendation
It is recommended to upgrade c-ares to version 1.12.0 or later to mitigate this vulnerability.
Original NVD description (English source)
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.