CVE-2023-50434
CriticalSummary
The emdns_resolve_raw function in emdns.c in emdns up to fbd1eef calls strlen on input that may not be null-terminated, leading to a stack-based buffer over-read. This can be triggered remotely by sending DNS requests to the emdns server.
Risk Assessment
The risk includes potential memory information disclosure or service crash, depending on system libraries, compiler, and processor architecture.
Recommendation
It is recommended to update the emdns library to a version after be565c3, which contains the fix for this vulnerability.
Original NVD description (English source)
emdns_resolve_raw in emdns.c in emdns through fbd1eef calls strlen with an input that may not be '\0' terminated, leading to a stack-based buffer over-read. This can be triggered by a remote adversary that can send DNS requests to the emdns server. The impact could vary depending on the system libraries, compiler, and processor architecture. Code before be565c3 is unaffected.