dnsmasq vulnerabilities

An integer underflow in the add_pseudoheader function in dnsmasq before version 2.78 allows remote attackers to cause a denial of service via a crafted DNS request when the --add-mac, --add-cpe-id, or --add-subnet option is specified.

A memory leak in dnsmasq before version 2.78 occurs when the --add-mac, --add-cpe-id, or --add-subnet option is specified. This allows remote attackers to cause a denial of service through DNS response creation manipulation.

In dnsmasq before version 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zeros, causing dnsmasq to crash.

Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.

A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

The DNSSEC validation in dnsmasq has a denial of service (DoS) vulnerability. A remote attacker can send a crafted DNS packet, causing the service to crash.

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

A stack-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.

Heap-based buffer overflow in dnsmasq before version 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.

A flow in the dnssec.c library causes an infinite loop in the dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.

A buffer overflow in dnsmasq's extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record's end.

Heap-based out-of-bounds write in dnsmasq DHCPv6 allows local attackers to execute code as root.

The extract_name() function in dnsmasq is vulnerable to a heap buffer overflow, allowing an attacker to inject false DNS cache entries. This can result in DNS lookups being redirected to an attacker-controlled IP address or cause a denial of service (DoS).