Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2017-14491 (GCVE-0-2017-14491)
Vulnerability from cvelistv5 – Published: 2017-10-02 21:00 – Updated: 2024-08-05 19:27
VLAI
EPSS
Summary
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
40 references
Date Public
2017-10-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T19:27:40.755Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1039474",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1039474"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq"
},
{
"name": "DSA-3989",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2017/dsa-3989"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"name": "101085",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/101085"
},
{
"name": "USN-3430-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-3430-1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=0549c73b7ea6b22a3c49beb4d432f185a81efcbc"
},
{
"name": "101977",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/101977"
},
{
"name": "RHSA-2017:2838",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2838"
},
{
"name": "VU#973527",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://www.kb.cert.org/vuls/id/973527"
},
{
"name": "GLSA-201710-27",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201710-27"
},
{
"name": "RHSA-2017:2840",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2840"
},
{
"name": "USN-3430-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-3430-2"
},
{
"name": "RHSA-2017:2839",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2839"
},
{
"name": "[dnsmasq-discuss] 20171002 Announce: dnsmasq-2.78.",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html"
},
{
"name": "RHSA-2017:2836",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4561"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt"
},
{
"name": "RHSA-2017:2837",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2837"
},
{
"name": "42941",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/42941/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://thekelleys.org.uk/dnsmasq/CHANGELOG"
},
{
"name": "RHSA-2017:2841",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2841"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4560"
},
{
"name": "openSUSE-SU-2017:2633",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
},
{
"name": "[dnsmasq-discuss] 20171002 IMPORTANT SECURITY INFORMATION.",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf"
},
{
"name": "FEDORA-2017-515264ae24",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/"
},
{
"name": "FEDORA-2017-24f067299e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/"
},
{
"name": "USN-3430-3",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-3430-3"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html"
},
{
"name": "SUSE-SU-2017:2619",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449"
},
{
"name": "FEDORA-2017-7106a157f5",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/"
},
{
"name": "SUSE-SU-2017:2616",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html"
},
{
"name": "SUSE-SU-2017:2617",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html"
},
{
"name": "DSA-3989",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2017/dsa-3989"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-10-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-08T11:42:39.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1039474",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1039474"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq"
},
{
"name": "DSA-3989",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2017/dsa-3989"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"name": "101085",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/101085"
},
{
"name": "USN-3430-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-3430-1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=0549c73b7ea6b22a3c49beb4d432f185a81efcbc"
},
{
"name": "101977",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/101977"
},
{
"name": "RHSA-2017:2838",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2838"
},
{
"name": "VU#973527",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://www.kb.cert.org/vuls/id/973527"
},
{
"name": "GLSA-201710-27",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201710-27"
},
{
"name": "RHSA-2017:2840",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2840"
},
{
"name": "USN-3430-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-3430-2"
},
{
"name": "RHSA-2017:2839",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2839"
},
{
"name": "[dnsmasq-discuss] 20171002 Announce: dnsmasq-2.78.",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html"
},
{
"name": "RHSA-2017:2836",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4561"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt"
},
{
"name": "RHSA-2017:2837",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2837"
},
{
"name": "42941",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/42941/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://thekelleys.org.uk/dnsmasq/CHANGELOG"
},
{
"name": "RHSA-2017:2841",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2841"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4560"
},
{
"name": "openSUSE-SU-2017:2633",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
},
{
"name": "[dnsmasq-discuss] 20171002 IMPORTANT SECURITY INFORMATION.",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf"
},
{
"name": "FEDORA-2017-515264ae24",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/"
},
{
"name": "FEDORA-2017-24f067299e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/"
},
{
"name": "USN-3430-3",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-3430-3"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html"
},
{
"name": "SUSE-SU-2017:2619",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449"
},
{
"name": "FEDORA-2017-7106a157f5",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/"
},
{
"name": "SUSE-SU-2017:2616",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html"
},
{
"name": "SUSE-SU-2017:2617",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html"
},
{
"name": "DSA-3989",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2017/dsa-3989"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-14491",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1039474",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1039474"
},
{
"name": "https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq",
"refsource": "CONFIRM",
"url": "https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq"
},
{
"name": "DSA-3989",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3989"
},
{
"name": "https://access.redhat.com/security/vulnerabilities/3199382",
"refsource": "CONFIRM",
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"name": "101085",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101085"
},
{
"name": "USN-3430-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3430-1"
},
{
"name": "http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=0549c73b7ea6b22a3c49beb4d432f185a81efcbc",
"refsource": "CONFIRM",
"url": "http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=0549c73b7ea6b22a3c49beb4d432f185a81efcbc"
},
{
"name": "101977",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101977"
},
{
"name": "RHSA-2017:2838",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:2838"
},
{
"name": "VU#973527",
"refsource": "CERT-VN",
"url": "https://www.kb.cert.org/vuls/id/973527"
},
{
"name": "GLSA-201710-27",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201710-27"
},
{
"name": "RHSA-2017:2840",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:2840"
},
{
"name": "USN-3430-2",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3430-2"
},
{
"name": "RHSA-2017:2839",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:2839"
},
{
"name": "[dnsmasq-discuss] 20171002 Announce: dnsmasq-2.78.",
"refsource": "MLIST",
"url": "https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg11665.html"
},
{
"name": "RHSA-2017:2836",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
},
{
"name": "http://nvidia.custhelp.com/app/answers/detail/a_id/4561",
"refsource": "CONFIRM",
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4561"
},
{
"name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt",
"refsource": "CONFIRM",
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt"
},
{
"name": "RHSA-2017:2837",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:2837"
},
{
"name": "42941",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/42941/"
},
{
"name": "http://thekelleys.org.uk/dnsmasq/CHANGELOG",
"refsource": "CONFIRM",
"url": "http://thekelleys.org.uk/dnsmasq/CHANGELOG"
},
{
"name": "RHSA-2017:2841",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:2841"
},
{
"name": "http://nvidia.custhelp.com/app/answers/detail/a_id/4560",
"refsource": "CONFIRM",
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4560"
},
{
"name": "openSUSE-SU-2017:2633",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html"
},
{
"name": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html",
"refsource": "MISC",
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
},
{
"name": "[dnsmasq-discuss] 20171002 IMPORTANT SECURITY INFORMATION.",
"refsource": "MLIST",
"url": "https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg11664.html"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf"
},
{
"name": "FEDORA-2017-515264ae24",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/"
},
{
"name": "FEDORA-2017-24f067299e",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/"
},
{
"name": "USN-3430-3",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3430-3"
},
{
"name": "http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html"
},
{
"name": "SUSE-SU-2017:2619",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html"
},
{
"name": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/",
"refsource": "CONFIRM",
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/"
},
{
"name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en",
"refsource": "CONFIRM",
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en"
},
{
"name": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449",
"refsource": "CONFIRM",
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449"
},
{
"name": "FEDORA-2017-7106a157f5",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/"
},
{
"name": "SUSE-SU-2017:2616",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html"
},
{
"name": "SUSE-SU-2017:2617",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html"
},
{
"name": "DSA-3989",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2017/dsa-3989"
},
{
"name": "https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30",
"refsource": "MISC",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-14491",
"datePublished": "2017-10-02T21:00:00.000Z",
"dateReserved": "2017-09-15T00:00:00.000Z",
"dateUpdated": "2024-08-05T19:27:40.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2017-14491",
"date": "2026-05-27",
"epss": "0.49785",
"percentile": "0.97851"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"2.77\", \"matchCriteriaId\": \"B85D7A28-8CBA-4D77-AD30-DB3CA49F2F98\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"33C068A4-3780-4EAB-A937-6082DF847564\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9BBCD86A-E6C7-4444-9D74-F861084090F0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"51EF4996-72F4-4FA4-814F-F5991E7A8318\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E5ED5807-55B7-47C5-97A6-03233F4FBC3A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"825ECE2D-E232-46E0-A047-074B34DB1E97\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*\", \"matchCriteriaId\": \"CB66DB75-2B16-4EBF-9B93-CE49D8086E41\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*\", \"matchCriteriaId\": \"B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\", \"matchCriteriaId\": \"B5A6F2F3-4894-4392-8296-3B8DD2679084\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*\", \"matchCriteriaId\": \"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"588D4F37-0A56-47A4-B710-4D5F3D214FB9\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"16F59A04-14CF-49E2-9973-645477EA09DA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:7.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7B21E9A8-CE63-42C2-A11A-94D977A96DF1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1EA337A3-B9A3-4962-B8BD-8E0C7C5B28EB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5F65DAB0-3DAD-49FF-BC73-3581CC3D5BF3\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*\", \"matchCriteriaId\": \"58D3B6FD-B474-4B09-B644-A8634A629280\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*\", \"matchCriteriaId\": \"F892F1B0-514C-42F7-90AE-12ACDFDC1033\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:suse:linux_enterprise_point_of_sale:11:sp3:*:*:*:*:*:*\", \"matchCriteriaId\": \"0FC411C9-9A8A-49D0-B704-2207674778CB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:ltss:*:*:*\", \"matchCriteriaId\": \"B12243B2-D726-404C-ABFF-F1AB51BA1783\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*\", \"matchCriteriaId\": \"55C5561F-BE86-4EEA-99D4-8697F8BD9DFE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:suse:linux_enterprise_server:12:*:*:*:ltss:*:*:*\", \"matchCriteriaId\": \"B2F3699A-38E4-4E9D-9414-411F71D9E371\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:nvidia:linux_for_tegra:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"r21.6\", \"matchCriteriaId\": \"54DF7A22-DF8B-4272-8EC6-48173E8860B8\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:nvidia:jetson_tk1:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"810B05A3-29CF-464F-9E63-8238AA0651AF\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:nvidia:linux_for_tegra:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"r24.2.2\", \"matchCriteriaId\": \"22159717-67FD-4A10-9F65-4434FEC1F922\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:nvidia:jetson_tx1:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"86D1FDAD-C594-43D9-9BF6-F7461177AB91\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:nvidia:geforce_experience:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndExcluding\": \"3.10.0.55\", \"matchCriteriaId\": \"5454038C-F1F0-4061-8B5C-04A8CF1658C6\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:honor_v9_play_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"jimmy-al00ac00b135\", \"matchCriteriaId\": \"CF744446-5C60-4C66-BE6B-DD108487B46C\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:huawei:honor_v9_play:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B543AF24-5D59-4A46-AC76-0EFF314E3D1A\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"4.15\", \"matchCriteriaId\": \"E861FF18-4E42-4092-81B6-0BB32679B2CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.16\", \"versionEndExcluding\": \"4.16.13m\", \"matchCriteriaId\": \"E2DED50F-C1ED-43EB-9E63-B65F4F287F41\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.17\", \"versionEndExcluding\": \"4.17.8m\", \"matchCriteriaId\": \"B5F144E5-EFB1-47E7-A2D2-28DEE6045CF6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.18\", \"versionEndIncluding\": \"4.18.4.2f\", \"matchCriteriaId\": \"8F1A3AF8-D105-4F13-8921-D94DCC7DE1AF\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:siemens:ruggedcom_rm1224_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.0\", \"matchCriteriaId\": \"63C108C5-0EF5-4C6D-8D83-ADB5EED24A6F\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:siemens:ruggedcom_rm1224:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"284DF779-D900-48B4-A177-7281CD445AB5\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:siemens:scalance_m-800_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.0\", \"matchCriteriaId\": \"E25B682B-83F5-4903-9138-16907DC7A859\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:siemens:scalance_m-800:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DFB9921A-5204-40A3-88AB-B7755F5C6875\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:siemens:scalance_s615_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.0\", \"matchCriteriaId\": \"E8B2D681-1FBF-4013-B223-9878F4F1DB27\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:siemens:scalance_s615:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E917CBBB-EF41-4113-B0CA-EB91889235E7\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.5.1.5\", \"matchCriteriaId\": \"AE55F796-FA73-4992-9826-57A00F77F6CA\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:siemens:scalance_w1750d:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FBC30055-239F-4BB1-B2D1-E5E35F0D8911\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.3.1\", \"versionEndExcluding\": \"6.3.1.25\", \"matchCriteriaId\": \"CFE6B116-71BB-49BF-A5EF-4460D9089511\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.4.4.0\", \"versionEndExcluding\": \"6.4.4.16\", \"matchCriteriaId\": \"193354A0-B108-4CA4-A1C3-F5F23147A295\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.5.0.0\", \"versionEndExcluding\": \"6.5.1.9\", \"matchCriteriaId\": \"47D1AB4F-0922-49AF-9AE5-AEB4019E652C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.5.3.0\", \"versionEndExcluding\": \"6.5.3.3\", \"matchCriteriaId\": \"8F5D03FA-CE4E-4888-88E2-384986A890BA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.5.4.0\", \"versionEndExcluding\": \"6.5.4.2\", \"matchCriteriaId\": \"E39B25F2-C65B-457F-A36E-14FC8285A004\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.1.0.0\", \"versionEndExcluding\": \"8.1.0.4\", \"matchCriteriaId\": \"00E53FE9-EA96-456A-B522-FC81DD0CCE3E\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:synology:diskstation_manager:5.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"416E0865-B437-493B-AE38-C24B6037B78E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:synology:diskstation_manager:6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"048C2114-ECF7-422E-B68C-84BF193F59C8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:synology:diskstation_manager:6.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"752FBED9-088B-495C-ACF2-F281C0A8F807\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:synology:router_manager:1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"46261C28-E276-4639-BA3D-A735B02599F8\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.\"}, {\"lang\": \"es\", \"value\": \"Un desbordamiento de b\\u00fafer basado en memoria din\\u00e1mica (heap) en dnsmasq en versiones anteriores a la 2.78 permite a los atacantes provocar una denegaci\\u00f3n de servicio (cierre inesperado) o ejecutar c\\u00f3digo arbitrario utilizando una respuesta DNS manipulada.\"}]",
"id": "CVE-2017-14491",
"lastModified": "2024-11-21T03:12:53.717",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2017-10-04T01:29:02.870",
"references": "[{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://nvidia.custhelp.com/app/answers/detail/a_id/4560\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://nvidia.custhelp.com/app/answers/detail/a_id/4561\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://thekelleys.org.uk/dnsmasq/CHANGELOG\", \"source\": \"cve@mitre.org\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=0549c73b7ea6b22a3c49beb4d432f185a81efcbc\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.debian.org/security/2017/dsa-3989\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/101085\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.securityfocus.com/bid/101977\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.securitytracker.com/id/1039474\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.ubuntu.com/usn/USN-3430-1\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.ubuntu.com/usn/USN-3430-2\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.ubuntu.com/usn/USN-3430-3\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2836\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2837\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2838\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2839\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2840\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2841\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/security/vulnerabilities/3199382\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://security.gentoo.org/glsa/201710-27\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2017/dsa-3989\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.exploit-db.com/exploits/42941/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://www.kb.cert.org/vuls/id/973527\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://nvidia.custhelp.com/app/answers/detail/a_id/4560\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://nvidia.custhelp.com/app/answers/detail/a_id/4561\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://thekelleys.org.uk/dnsmasq/CHANGELOG\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=0549c73b7ea6b22a3c49beb4d432f185a81efcbc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.debian.org/security/2017/dsa-3989\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/101085\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.securityfocus.com/bid/101977\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.securitytracker.com/id/1039474\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.ubuntu.com/usn/USN-3430-1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.ubuntu.com/usn/USN-3430-2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.ubuntu.com/usn/USN-3430-3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2836\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2837\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2838\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2839\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2840\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2017:2841\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/security/vulnerabilities/3199382\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/201710-27\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2017/dsa-3989\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.exploit-db.com/exploits/42941/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://www.kb.cert.org/vuls/id/973527\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2017-14491\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-10-04T01:29:02.870\",\"lastModified\":\"2026-05-13T00:24:29.033\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.\"},{\"lang\":\"es\",\"value\":\"Un desbordamiento de b\u00fafer basado en memoria din\u00e1mica (heap) en dnsmasq en versiones anteriores a la 2.78 permite a los atacantes provocar una denegaci\u00f3n de servicio (cierre inesperado) o ejecutar c\u00f3digo arbitrario utilizando una respuesta DNS manipulada.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.77\",\"matchCriteriaId\":\"B85D7A28-8CBA-4D77-AD30-DB3CA49F2F98\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33C068A4-3780-4EAB-A937-6082DF847564\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BBCD86A-E6C7-4444-9D74-F861084090F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51EF4996-72F4-4FA4-814F-F5991E7A8318\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5ED5807-55B7-47C5-97A6-03233F4FBC3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"825ECE2D-E232-46E0-A047-074B34DB1E97\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"CB66DB75-2B16-4EBF-9B93-CE49D8086E41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B5A6F2F3-4894-4392-8296-3B8DD2679084\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"588D4F37-0A56-47A4-B710-4D5F3D214FB9\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F59A04-14CF-49E2-9973-645477EA09DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7B21E9A8-CE63-42C2-A11A-94D977A96DF1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EA337A3-B9A3-4962-B8BD-8E0C7C5B28EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F65DAB0-3DAD-49FF-BC73-3581CC3D5BF3\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*\",\"matchCriteriaId\":\"58D3B6FD-B474-4B09-B644-A8634A629280\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F892F1B0-514C-42F7-90AE-12ACDFDC1033\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:suse:linux_enterprise_point_of_sale:11:sp3:*:*:*:*:*:*\",\"matchCriteriaId\":\"0FC411C9-9A8A-49D0-B704-2207674778CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:ltss:*:*:*\",\"matchCriteriaId\":\"B12243B2-D726-404C-ABFF-F1AB51BA1783\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*\",\"matchCriteriaId\":\"55C5561F-BE86-4EEA-99D4-8697F8BD9DFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise_server:12:*:*:*:ltss:*:*:*\",\"matchCriteriaId\":\"B2F3699A-38E4-4E9D-9414-411F71D9E371\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nvidia:linux_for_tegra:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"r21.6\",\"matchCriteriaId\":\"54DF7A22-DF8B-4272-8EC6-48173E8860B8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nvidia:jetson_tk1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"810B05A3-29CF-464F-9E63-8238AA0651AF\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nvidia:linux_for_tegra:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"r24.2.2\",\"matchCriteriaId\":\"22159717-67FD-4A10-9F65-4434FEC1F922\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nvidia:jetson_tx1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"86D1FDAD-C594-43D9-9BF6-F7461177AB91\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nvidia:geforce_experience:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"3.10.0.55\",\"matchCriteriaId\":\"5454038C-F1F0-4061-8B5C-04A8CF1658C6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:honor_v9_play_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"jimmy-al00ac00b135\",\"matchCriteriaId\":\"CF744446-5C60-4C66-BE6B-DD108487B46C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:huawei:honor_v9_play:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B543AF24-5D59-4A46-AC76-0EFF314E3D1A\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.15\",\"matchCriteriaId\":\"E861FF18-4E42-4092-81B6-0BB32679B2CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.16\",\"versionEndExcluding\":\"4.16.13m\",\"matchCriteriaId\":\"E2DED50F-C1ED-43EB-9E63-B65F4F287F41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.17\",\"versionEndExcluding\":\"4.17.8m\",\"matchCriteriaId\":\"B5F144E5-EFB1-47E7-A2D2-28DEE6045CF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.18\",\"versionEndIncluding\":\"4.18.4.2f\",\"matchCriteriaId\":\"8F1A3AF8-D105-4F13-8921-D94DCC7DE1AF\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:ruggedcom_rm1224_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.0\",\"matchCriteriaId\":\"63C108C5-0EF5-4C6D-8D83-ADB5EED24A6F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:ruggedcom_rm1224:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"284DF779-D900-48B4-A177-7281CD445AB5\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:scalance_m-800_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.0\",\"matchCriteriaId\":\"E25B682B-83F5-4903-9138-16907DC7A859\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:scalance_m-800:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DFB9921A-5204-40A3-88AB-B7755F5C6875\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:scalance_s615_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.0\",\"matchCriteriaId\":\"E8B2D681-1FBF-4013-B223-9878F4F1DB27\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:scalance_s615:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E917CBBB-EF41-4113-B0CA-EB91889235E7\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.5.1.5\",\"matchCriteriaId\":\"AE55F796-FA73-4992-9826-57A00F77F6CA\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:scalance_w1750d:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FBC30055-239F-4BB1-B2D1-E5E35F0D8911\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3.1\",\"versionEndExcluding\":\"6.3.1.25\",\"matchCriteriaId\":\"CFE6B116-71BB-49BF-A5EF-4460D9089511\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.4.0\",\"versionEndExcluding\":\"6.4.4.16\",\"matchCriteriaId\":\"193354A0-B108-4CA4-A1C3-F5F23147A295\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5.0.0\",\"versionEndExcluding\":\"6.5.1.9\",\"matchCriteriaId\":\"47D1AB4F-0922-49AF-9AE5-AEB4019E652C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5.3.0\",\"versionEndExcluding\":\"6.5.3.3\",\"matchCriteriaId\":\"8F5D03FA-CE4E-4888-88E2-384986A890BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5.4.0\",\"versionEndExcluding\":\"6.5.4.2\",\"matchCriteriaId\":\"E39B25F2-C65B-457F-A36E-14FC8285A004\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.1.0.0\",\"versionEndExcluding\":\"8.1.0.4\",\"matchCriteriaId\":\"00E53FE9-EA96-456A-B522-FC81DD0CCE3E\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:synology:router_manager:1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46261C28-E276-4639-BA3D-A735B02599F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:synology:diskstation_manager:5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"01527614-8A68-48DC-B0A0-F4AA99489221\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:synology:diskstation_manager:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"65372FA7-B54B-4298-99BF-483E9FEBA253\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:synology:diskstation_manager:6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D04EA1A-F8E0-415B-8786-1C8C0F08E132\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://nvidia.custhelp.com/app/answers/detail/a_id/4560\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://nvidia.custhelp.com/app/answers/detail/a_id/4561\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://thekelleys.org.uk/dnsmasq/CHANGELOG\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=0549c73b7ea6b22a3c49beb4d432f185a81efcbc\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2017/dsa-3989\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/101085\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.securityfocus.com/bid/101977\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.securitytracker.com/id/1039474\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-3430-1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-3430-2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-3430-3\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2836\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2837\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2838\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2839\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2840\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2841\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/security/vulnerabilities/3199382\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.gentoo.org/glsa/201710-27\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2017/dsa-3989\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/42941/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.kb.cert.org/vuls/id/973527\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://nvidia.custhelp.com/app/answers/detail/a_id/4560\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://nvidia.custhelp.com/app/answers/detail/a_id/4561\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://thekelleys.org.uk/dnsmasq/CHANGELOG\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=0549c73b7ea6b22a3c49beb4d432f185a81efcbc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2017/dsa-3989\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/101085\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.securityfocus.com/bid/101977\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.securitytracker.com/id/1039474\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-3430-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-3430-2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-3430-3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2836\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2837\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2838\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2839\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2840\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2017:2841\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/security/vulnerabilities/3199382\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/201710-27\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2017/dsa-3989\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/42941/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.kb.cert.org/vuls/id/973527\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
CERTFR-2022-AVI-267
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans Juniper Networks Junos Space. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Juniper Networks | Junos Space | Juniper Networks Junos Space versions antérieures à 21.1R1 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Juniper Networks Junos Space versions ant\u00e9rieures \u00e0 21.1R1",
"product": {
"name": "Junos Space",
"vendor": {
"name": "Juniper Networks",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-13078",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13078"
},
{
"name": "CVE-2017-13077",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13077"
},
{
"name": "CVE-2017-13080",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13080"
},
{
"name": "CVE-2017-13082",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13082"
},
{
"name": "CVE-2017-13088",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13088"
},
{
"name": "CVE-2017-13086",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13086"
},
{
"name": "CVE-2017-13087",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13087"
},
{
"name": "CVE-2017-5715",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5715"
},
{
"name": "CVE-2018-3639",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-3639"
},
{
"name": "CVE-2007-1351",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-1351"
},
{
"name": "CVE-2007-1352",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-1352"
},
{
"name": "CVE-2007-6284",
"url": "https://www.cve.org/CVERecord?id=CVE-2007-6284"
},
{
"name": "CVE-2008-2935",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2935"
},
{
"name": "CVE-2008-3281",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3281"
},
{
"name": "CVE-2008-3529",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-3529"
},
{
"name": "CVE-2008-4226",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-4226"
},
{
"name": "CVE-2008-4225",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-4225"
},
{
"name": "CVE-2009-2414",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2414"
},
{
"name": "CVE-2009-2416",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2416"
},
{
"name": "CVE-2008-5161",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-5161"
},
{
"name": "CVE-2010-4008",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-4008"
},
{
"name": "CVE-2011-0411",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-0411"
},
{
"name": "CVE-2011-1720",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-1720"
},
{
"name": "CVE-2011-0216",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-0216"
},
{
"name": "CVE-2011-2834",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-2834"
},
{
"name": "CVE-2011-2895",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-2895"
},
{
"name": "CVE-2011-3905",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-3905"
},
{
"name": "CVE-2011-3919",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-3919"
},
{
"name": "CVE-2012-0841",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-0841"
},
{
"name": "CVE-2011-1944",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-1944"
},
{
"name": "CVE-2012-2807",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2807"
},
{
"name": "CVE-2012-2870",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2870"
},
{
"name": "CVE-2012-5134",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-5134"
},
{
"name": "CVE-2011-3102",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-3102"
},
{
"name": "CVE-2013-2877",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2877"
},
{
"name": "CVE-2013-0338",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0338"
},
{
"name": "CVE-2012-6139",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6139"
},
{
"name": "CVE-2013-2566",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2566"
},
{
"name": "CVE-2013-6462",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6462"
},
{
"name": "CVE-2014-0211",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0211"
},
{
"name": "CVE-2014-3660",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3660"
},
{
"name": "CVE-2015-1803",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-1803"
},
{
"name": "CVE-2015-1804",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-1804"
},
{
"name": "CVE-2015-1802",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-1802"
},
{
"name": "CVE-2015-2716",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-2716"
},
{
"name": "CVE-2015-5352",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5352"
},
{
"name": "CVE-2015-2808",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-2808"
},
{
"name": "CVE-2014-8991",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8991"
},
{
"name": "CVE-2014-7185",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-7185"
},
{
"name": "CVE-2014-9365",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-9365"
},
{
"name": "CVE-2015-6838",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-6838"
},
{
"name": "CVE-2015-6837",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-6837"
},
{
"name": "CVE-2015-7995",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7995"
},
{
"name": "CVE-2015-8035",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8035"
},
{
"name": "CVE-2015-7499",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7499"
},
{
"name": "CVE-2015-8242",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8242"
},
{
"name": "CVE-2015-7500",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7500"
},
{
"name": "CVE-2016-1762",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1762"
},
{
"name": "CVE-2015-5312",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5312"
},
{
"name": "CVE-2016-1839",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1839"
},
{
"name": "CVE-2016-1833",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1833"
},
{
"name": "CVE-2016-1837",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1837"
},
{
"name": "CVE-2016-1834",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1834"
},
{
"name": "CVE-2016-1840",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1840"
},
{
"name": "CVE-2016-1836",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1836"
},
{
"name": "CVE-2016-1838",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1838"
},
{
"name": "CVE-2016-1684",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1684"
},
{
"name": "CVE-2016-1683",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1683"
},
{
"name": "CVE-2016-4448",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-4448"
},
{
"name": "CVE-2016-4447",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-4447"
},
{
"name": "CVE-2016-4449",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-4449"
},
{
"name": "CVE-2016-5131",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-5131"
},
{
"name": "CVE-2015-0975",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0975"
},
{
"name": "CVE-2016-4658",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-4658"
},
{
"name": "CVE-2016-2183",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-2183"
},
{
"name": "CVE-2016-3627",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3627"
},
{
"name": "CVE-2016-3115",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3115"
},
{
"name": "CVE-2016-5636",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-5636"
},
{
"name": "CVE-2017-7375",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7375"
},
{
"name": "CVE-2017-7376",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7376"
},
{
"name": "CVE-2017-7773",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7773"
},
{
"name": "CVE-2017-7772",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7772"
},
{
"name": "CVE-2017-7778",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7778"
},
{
"name": "CVE-2017-7771",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7771"
},
{
"name": "CVE-2017-7774",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7774"
},
{
"name": "CVE-2017-7776",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7776"
},
{
"name": "CVE-2017-7777",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7777"
},
{
"name": "CVE-2017-7775",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7775"
},
{
"name": "CVE-2017-6463",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6463"
},
{
"name": "CVE-2017-6462",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6462"
},
{
"name": "CVE-2017-6464",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6464"
},
{
"name": "CVE-2017-14492",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14492"
},
{
"name": "CVE-2017-14496",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14496"
},
{
"name": "CVE-2017-14491",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14491"
},
{
"name": "CVE-2017-14493",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14493"
},
{
"name": "CVE-2017-14494",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14494"
},
{
"name": "CVE-2017-14495",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14495"
},
{
"name": "CVE-2017-5130",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5130"
},
{
"name": "CVE-2017-3736",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-3736"
},
{
"name": "CVE-2017-3735",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-3735"
},
{
"name": "CVE-2017-15412",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-15412"
},
{
"name": "CVE-2017-3738",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-3738"
},
{
"name": "CVE-2017-3737",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-3737"
},
{
"name": "CVE-2017-17807",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-17807"
},
{
"name": "CVE-2018-0739",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0739"
},
{
"name": "CVE-2017-16931",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-16931"
},
{
"name": "CVE-2018-11214",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-11214"
},
{
"name": "CVE-2015-9019",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-9019"
},
{
"name": "CVE-2017-18258",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18258"
},
{
"name": "CVE-2017-16932",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-16932"
},
{
"name": "CVE-2016-9318",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9318"
},
{
"name": "CVE-2018-1000120",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000120"
},
{
"name": "CVE-2018-1000007",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000007"
},
{
"name": "CVE-2018-1000121",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000121"
},
{
"name": "CVE-2018-1000122",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000122"
},
{
"name": "CVE-2018-0732",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0732"
},
{
"name": "CVE-2018-6914",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-6914"
},
{
"name": "CVE-2017-0898",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-0898"
},
{
"name": "CVE-2018-8778",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8778"
},
{
"name": "CVE-2017-14033",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14033"
},
{
"name": "CVE-2018-8780",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8780"
},
{
"name": "CVE-2017-17742",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-17742"
},
{
"name": "CVE-2017-10784",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-10784"
},
{
"name": "CVE-2017-17405",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-17405"
},
{
"name": "CVE-2018-8779",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8779"
},
{
"name": "CVE-2017-14064",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14064"
},
{
"name": "CVE-2018-8777",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8777"
},
{
"name": "CVE-2018-16395",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-16395"
},
{
"name": "CVE-2018-0737",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0737"
},
{
"name": "CVE-2018-16396",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-16396"
},
{
"name": "CVE-2018-0495",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0495"
},
{
"name": "CVE-2018-0734",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0734"
},
{
"name": "CVE-2018-5407",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5407"
},
{
"name": "CVE-2018-1126",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1126"
},
{
"name": "CVE-2018-7858",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7858"
},
{
"name": "CVE-2018-1124",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1124"
},
{
"name": "CVE-2018-10897",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10897"
},
{
"name": "CVE-2018-1064",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1064"
},
{
"name": "CVE-2018-5683",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5683"
},
{
"name": "CVE-2017-13672",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13672"
},
{
"name": "CVE-2018-11212",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-11212"
},
{
"name": "CVE-2017-18267",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18267"
},
{
"name": "CVE-2018-13988",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-13988"
},
{
"name": "CVE-2018-20169",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20169"
},
{
"name": "CVE-2018-19985",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-19985"
},
{
"name": "CVE-2019-1559",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1559"
},
{
"name": "CVE-2019-6133",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6133"
},
{
"name": "CVE-2018-18311",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-18311"
},
{
"name": "CVE-2018-12127",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-12127"
},
{
"name": "CVE-2018-12130",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-12130"
},
{
"name": "CVE-2019-11091",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11091"
},
{
"name": "CVE-2018-12126",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-12126"
},
{
"name": "CVE-2019-9503",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9503"
},
{
"name": "CVE-2019-10132",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10132"
},
{
"name": "CVE-2019-11190",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11190"
},
{
"name": "CVE-2019-11884",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11884"
},
{
"name": "CVE-2019-11487",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11487"
},
{
"name": "CVE-2019-12382",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12382"
},
{
"name": "CVE-2018-7191",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7191"
},
{
"name": "CVE-2019-5953",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5953"
},
{
"name": "CVE-2019-12614",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12614"
},
{
"name": "CVE-2019-11729",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11729"
},
{
"name": "CVE-2019-11727",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11727"
},
{
"name": "CVE-2019-11719",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11719"
},
{
"name": "CVE-2018-1060",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1060"
},
{
"name": "CVE-2018-12327",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-12327"
},
{
"name": "CVE-2018-1061",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1061"
},
{
"name": "CVE-2019-10639",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10639"
},
{
"name": "CVE-2019-10638",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10638"
},
{
"name": "CVE-2018-20836",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20836"
},
{
"name": "CVE-2019-13233",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13233"
},
{
"name": "CVE-2019-14283",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14283"
},
{
"name": "CVE-2019-13648",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13648"
},
{
"name": "CVE-2019-10207",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10207"
},
{
"name": "CVE-2015-9289",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-9289"
},
{
"name": "CVE-2019-14816",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14816"
},
{
"name": "CVE-2019-15239",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15239"
},
{
"name": "CVE-2019-15917",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15917"
},
{
"name": "CVE-2017-18551",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18551"
},
{
"name": "CVE-2019-15217",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15217"
},
{
"name": "CVE-2019-14821",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14821"
},
{
"name": "CVE-2019-11068",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11068"
},
{
"name": "CVE-2018-18066",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-18066"
},
{
"name": "CVE-2019-15903",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15903"
},
{
"name": "CVE-2019-17666",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17666"
},
{
"name": "CVE-2019-17133",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17133"
},
{
"name": "CVE-2018-12207",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-12207"
},
{
"name": "CVE-2019-11135",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11135"
},
{
"name": "CVE-2019-0154",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-0154"
},
{
"name": "CVE-2019-17055",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17055"
},
{
"name": "CVE-2019-17053",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17053"
},
{
"name": "CVE-2019-16746",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16746"
},
{
"name": "CVE-2019-0155",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-0155"
},
{
"name": "CVE-2019-16233",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16233"
},
{
"name": "CVE-2019-15807",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15807"
},
{
"name": "CVE-2019-16231",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16231"
},
{
"name": "CVE-2019-11756",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11756"
},
{
"name": "CVE-2019-11745",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11745"
},
{
"name": "CVE-2019-19058",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19058"
},
{
"name": "CVE-2019-14895",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14895"
},
{
"name": "CVE-2019-19046",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19046"
},
{
"name": "CVE-2019-15916",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15916"
},
{
"name": "CVE-2019-18660",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18660"
},
{
"name": "CVE-2019-19063",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19063"
},
{
"name": "CVE-2019-19062",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19062"
},
{
"name": "CVE-2018-14526",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14526"
},
{
"name": "CVE-2019-13734",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13734"
},
{
"name": "CVE-2019-19530",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19530"
},
{
"name": "CVE-2019-19534",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19534"
},
{
"name": "CVE-2019-19524",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19524"
},
{
"name": "CVE-2019-14901",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14901"
},
{
"name": "CVE-2019-19537",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19537"
},
{
"name": "CVE-2019-19523",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19523"
},
{
"name": "CVE-2019-19338",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19338"
},
{
"name": "CVE-2019-19332",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19332"
},
{
"name": "CVE-2019-19527",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19527"
},
{
"name": "CVE-2019-18808",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18808"
},
{
"name": "CVE-2019-19767",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19767"
},
{
"name": "CVE-2019-19807",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19807"
},
{
"name": "CVE-2019-19055",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19055"
},
{
"name": "CVE-2019-17023",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17023"
},
{
"name": "CVE-2019-9824",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9824"
},
{
"name": "CVE-2019-9636",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9636"
},
{
"name": "CVE-2019-12749",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12749"
},
{
"name": "CVE-2019-19447",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19447"
},
{
"name": "CVE-2019-20095",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20095"
},
{
"name": "CVE-2019-20054",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20054"
},
{
"name": "CVE-2019-18634",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18634"
},
{
"name": "CVE-2019-14898",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14898"
},
{
"name": "CVE-2019-16994",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16994"
},
{
"name": "CVE-2019-18282",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-18282"
},
{
"name": "CVE-2020-2732",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-2732"
},
{
"name": "CVE-2019-19059",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19059"
},
{
"name": "CVE-2019-3901",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-3901"
},
{
"name": "CVE-2020-9383",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-9383"
},
{
"name": "CVE-2020-8647",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8647"
},
{
"name": "CVE-2020-8649",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8649"
},
{
"name": "CVE-2020-1749",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1749"
},
{
"name": "CVE-2019-9458",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9458"
},
{
"name": "CVE-2020-10942",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10942"
},
{
"name": "CVE-2019-9454",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9454"
},
{
"name": "CVE-2020-11565",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11565"
},
{
"name": "CVE-2020-10690",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10690"
},
{
"name": "CVE-2020-10751",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10751"
},
{
"name": "CVE-2020-12826",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12826"
},
{
"name": "CVE-2020-12654",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12654"
},
{
"name": "CVE-2020-10732",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10732"
},
{
"name": "CVE-2019-20636",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20636"
},
{
"name": "CVE-2019-20811",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20811"
},
{
"name": "CVE-2020-12653",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12653"
},
{
"name": "CVE-2020-10757",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10757"
},
{
"name": "CVE-2020-12770",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12770"
},
{
"name": "CVE-2020-12888",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12888"
},
{
"name": "CVE-2020-12402",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12402"
},
{
"name": "CVE-2018-16881",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-16881"
},
{
"name": "CVE-2018-19519",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-19519"
},
{
"name": "CVE-2020-10713",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10713"
},
{
"name": "CVE-2020-14311",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14311"
},
{
"name": "CVE-2020-14309",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14309"
},
{
"name": "CVE-2020-15706",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15706"
},
{
"name": "CVE-2020-14308",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14308"
},
{
"name": "CVE-2020-14310",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14310"
},
{
"name": "CVE-2020-15705",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15705"
},
{
"name": "CVE-2020-15707",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15707"
},
{
"name": "CVE-2020-14331",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14331"
},
{
"name": "CVE-2020-10769",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10769"
},
{
"name": "CVE-2020-14364",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14364"
},
{
"name": "CVE-2020-12400",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12400"
},
{
"name": "CVE-2020-12401",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12401"
},
{
"name": "CVE-2020-6829",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-6829"
},
{
"name": "CVE-2020-14314",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14314"
},
{
"name": "CVE-2020-24394",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24394"
},
{
"name": "CVE-2020-25212",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25212"
},
{
"name": "CVE-2020-14305",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14305"
},
{
"name": "CVE-2020-10742",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10742"
},
{
"name": "CVE-2020-14385",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14385"
},
{
"name": "CVE-2020-25643",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25643"
},
{
"name": "CVE-2020-15999",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15999"
},
{
"name": "CVE-2018-20843",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20843"
},
{
"name": "CVE-2018-5729",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5729"
},
{
"name": "CVE-2018-5730",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5730"
},
{
"name": "CVE-2020-13817",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-13817"
},
{
"name": "CVE-2020-11868",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11868"
},
{
"name": "CVE-2021-3156",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3156"
},
{
"name": "CVE-2019-17006",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17006"
},
{
"name": "CVE-2019-13232",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13232"
},
{
"name": "CVE-2020-10531",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10531"
},
{
"name": "CVE-2019-8696",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-8696"
},
{
"name": "CVE-2019-20907",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20907"
},
{
"name": "CVE-2019-8675",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-8675"
},
{
"name": "CVE-2017-12652",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12652"
},
{
"name": "CVE-2019-12450",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12450"
},
{
"name": "CVE-2020-12825",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12825"
},
{
"name": "CVE-2020-12243",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12243"
},
{
"name": "CVE-2019-14866",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14866"
},
{
"name": "CVE-2020-1983",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1983"
},
{
"name": "CVE-2019-5188",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5188"
},
{
"name": "CVE-2019-5094",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5094"
},
{
"name": "CVE-2020-10754",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10754"
},
{
"name": "CVE-2020-12049",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12049"
},
{
"name": "CVE-2019-14822",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14822"
},
{
"name": "CVE-2020-14363",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14363"
},
{
"name": "CVE-2019-9924",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9924"
},
{
"name": "CVE-2018-18751",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-18751"
},
{
"name": "CVE-2019-9948",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9948"
},
{
"name": "CVE-2019-20386",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20386"
},
{
"name": "CVE-2017-13722",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13722"
},
{
"name": "CVE-2014-0210",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0210"
},
{
"name": "CVE-2018-16403",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-16403"
},
{
"name": "CVE-2018-15746",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15746"
},
{
"name": "CVE-2014-6272",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-6272"
},
{
"name": "CVE-2019-7638",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7638"
},
{
"name": "CVE-2015-8241",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8241"
},
{
"name": "CVE-2019-10155",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10155"
},
{
"name": "CVE-2018-11813",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-11813"
},
{
"name": "CVE-2018-18310",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-18310"
},
{
"name": "CVE-2018-1084",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1084"
},
{
"name": "CVE-2020-12662",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12662"
},
{
"name": "CVE-2012-4423",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-4423"
},
{
"name": "CVE-2017-0902",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-0902"
},
{
"name": "CVE-2018-8945",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-8945"
},
{
"name": "CVE-2017-0899",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-0899"
},
{
"name": "CVE-2010-2239",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-2239"
},
{
"name": "CVE-2010-2242",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-2242"
},
{
"name": "CVE-2017-14167",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14167"
},
{
"name": "CVE-2015-0225",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0225"
},
{
"name": "CVE-2019-11324",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11324"
},
{
"name": "CVE-2013-6458",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6458"
},
{
"name": "CVE-2018-1000075",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000075"
},
{
"name": "CVE-2018-15857",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15857"
},
{
"name": "CVE-2018-16062",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-16062"
},
{
"name": "CVE-2018-10534",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10534"
},
{
"name": "CVE-2014-0179",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0179"
},
{
"name": "CVE-2018-18384",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-18384"
},
{
"name": "CVE-2013-1766",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1766"
},
{
"name": "CVE-2016-6580",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6580"
},
{
"name": "CVE-2018-12697",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-12697"
},
{
"name": "CVE-2018-1000301",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000301"
},
{
"name": "CVE-2019-11236",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11236"
},
{
"name": "CVE-2019-12155",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12155"
},
{
"name": "CVE-2017-0900",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-0900"
},
{
"name": "CVE-2014-3598",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3598"
},
{
"name": "CVE-2017-1000050",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-1000050"
},
{
"name": "CVE-2018-10535",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10535"
},
{
"name": "CVE-2019-3820",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-3820"
},
{
"name": "CVE-2018-16402",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-16402"
},
{
"name": "CVE-2018-1116",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1116"
},
{
"name": "CVE-2018-15853",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15853"
},
{
"name": "CVE-2019-14378",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14378"
},
{
"name": "CVE-2016-1494",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1494"
},
{
"name": "CVE-2019-12312",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12312"
},
{
"name": "CVE-2013-0339",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0339"
},
{
"name": "CVE-2019-16935",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16935"
},
{
"name": "CVE-2015-6525",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-6525"
},
{
"name": "CVE-2016-6581",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6581"
},
{
"name": "CVE-2013-4520",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4520"
},
{
"name": "CVE-2014-3633",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3633"
},
{
"name": "CVE-2014-3004",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3004"
},
{
"name": "CVE-2015-9381",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-9381"
},
{
"name": "CVE-2016-5361",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-5361"
},
{
"name": "CVE-2018-14598",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14598"
},
{
"name": "CVE-2014-1447",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1447"
},
{
"name": "CVE-2018-20852",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20852"
},
{
"name": "CVE-2012-2693",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2693"
},
{
"name": "CVE-2018-7208",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7208"
},
{
"name": "CVE-2018-12910",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-12910"
},
{
"name": "CVE-2019-8325",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-8325"
},
{
"name": "CVE-2015-7497",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7497"
},
{
"name": "CVE-2019-7665",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7665"
},
{
"name": "CVE-2018-15854",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15854"
},
{
"name": "CVE-2019-13404",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-13404"
},
{
"name": "CVE-2015-5160",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5160"
},
{
"name": "CVE-2018-10767",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10767"
},
{
"name": "CVE-2018-7550",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7550"
},
{
"name": "CVE-2016-3076",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3076"
},
{
"name": "CVE-2018-14404",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14404"
},
{
"name": "CVE-2018-18521",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-18521"
},
{
"name": "CVE-2018-19788",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-19788"
},
{
"name": "CVE-2019-8322",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-8322"
},
{
"name": "CVE-2019-3840",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-3840"
},
{
"name": "CVE-2016-9189",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9189"
},
{
"name": "CVE-2015-9262",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-9262"
},
{
"name": "CVE-2018-14647",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14647"
},
{
"name": "CVE-2019-17041",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17041"
},
{
"name": "CVE-2019-14906",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14906"
},
{
"name": "CVE-2018-1000073",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000073"
},
{
"name": "CVE-2019-9947",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9947"
},
{
"name": "CVE-2017-1000158",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-1000158"
},
{
"name": "CVE-2019-7635",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7635"
},
{
"name": "CVE-2019-7576",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7576"
},
{
"name": "CVE-2019-14834",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14834"
},
{
"name": "CVE-2018-15855",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15855"
},
{
"name": "CVE-2019-7149",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7149"
},
{
"name": "CVE-2018-7642",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7642"
},
{
"name": "CVE-2019-5010",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5010"
},
{
"name": "CVE-2018-12641",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-12641"
},
{
"name": "CVE-2021-3396",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3396"
},
{
"name": "CVE-2020-12403",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12403"
},
{
"name": "CVE-2017-15268",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-15268"
},
{
"name": "CVE-2018-15587",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15587"
},
{
"name": "CVE-2016-10746",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10746"
},
{
"name": "CVE-2017-13711",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13711"
},
{
"name": "CVE-2014-8131",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-8131"
},
{
"name": "CVE-2014-9601",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-9601"
},
{
"name": "CVE-2014-3657",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3657"
},
{
"name": "CVE-2018-10373",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10373"
},
{
"name": "CVE-2017-17790",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-17790"
},
{
"name": "CVE-2011-2511",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-2511"
},
{
"name": "CVE-2018-1000802",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000802"
},
{
"name": "CVE-2017-7555",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7555"
},
{
"name": "CVE-2016-9015",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9015"
},
{
"name": "CVE-2017-13720",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13720"
},
{
"name": "CVE-2018-11782",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-11782"
},
{
"name": "CVE-2017-11671",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-11671"
},
{
"name": "CVE-2017-10664",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-10664"
},
{
"name": "CVE-2018-11213",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-11213"
},
{
"name": "CVE-2013-6457",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6457"
},
{
"name": "CVE-2019-10138",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10138"
},
{
"name": "CVE-2019-7578",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7578"
},
{
"name": "CVE-2020-7039",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-7039"
},
{
"name": "CVE-2017-11368",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-11368"
},
{
"name": "CVE-2018-0494",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0494"
},
{
"name": "CVE-2019-20485",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20485"
},
{
"name": "CVE-2003-1418",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-1418"
},
{
"name": "CVE-2017-15289",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-15289"
},
{
"name": "CVE-2016-5391",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-5391"
},
{
"name": "CVE-2017-2810",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-2810"
},
{
"name": "CVE-2018-15864",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15864"
},
{
"name": "CVE-2017-18207",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18207"
},
{
"name": "CVE-2019-12761",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12761"
},
{
"name": "CVE-2013-5651",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5651"
},
{
"name": "CVE-2017-17522",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-17522"
},
{
"name": "CVE-2019-20382",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20382"
},
{
"name": "CVE-2016-2533",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-2533"
},
{
"name": "CVE-2019-14287",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14287"
},
{
"name": "CVE-2018-18520",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-18520"
},
{
"name": "CVE-2019-9740",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9740"
},
{
"name": "CVE-2019-7575",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7575"
},
{
"name": "CVE-2015-5652",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5652"
},
{
"name": "CVE-2019-7572",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7572"
},
{
"name": "CVE-2017-6519",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6519"
},
{
"name": "CVE-2018-10906",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10906"
},
{
"name": "CVE-2018-15863",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15863"
},
{
"name": "CVE-2018-15862",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15862"
},
{
"name": "CVE-2018-1000079",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000079"
},
{
"name": "CVE-2019-7664",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7664"
},
{
"name": "CVE-2017-5992",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-5992"
},
{
"name": "CVE-2019-16865",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16865"
},
{
"name": "CVE-2019-8324",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-8324"
},
{
"name": "CVE-2018-1000076",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000076"
},
{
"name": "CVE-2018-1000030",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000030"
},
{
"name": "CVE-2018-1000074",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000074"
},
{
"name": "CVE-2017-0901",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-0901"
},
{
"name": "CVE-2018-7568",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7568"
},
{
"name": "CVE-2016-0775",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0775"
},
{
"name": "CVE-2018-15688",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15688"
},
{
"name": "CVE-2018-14599",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14599"
},
{
"name": "CVE-2018-10733",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10733"
},
{
"name": "CVE-2016-9396",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9396"
},
{
"name": "CVE-2019-10160",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10160"
},
{
"name": "CVE-2017-7562",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7562"
},
{
"name": "CVE-2016-1000032",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1000032"
},
{
"name": "CVE-2017-15124",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-15124"
},
{
"name": "CVE-2018-1113",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1113"
},
{
"name": "CVE-2013-4399",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4399"
},
{
"name": "CVE-2019-7636",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7636"
},
{
"name": "CVE-2014-3672",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3672"
},
{
"name": "CVE-2018-4700",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-4700"
},
{
"name": "CVE-2017-0903",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-0903"
},
{
"name": "CVE-2018-15856",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15856"
},
{
"name": "CVE-2018-1000078",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000078"
},
{
"name": "CVE-2019-7573",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7573"
},
{
"name": "CVE-2018-1000077",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000077"
},
{
"name": "CVE-2010-2237",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-2237"
},
{
"name": "CVE-2018-1000876",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000876"
},
{
"name": "CVE-2018-14348",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14348"
},
{
"name": "CVE-2019-3890",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-3890"
},
{
"name": "CVE-2015-7498",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7498"
},
{
"name": "CVE-2019-7577",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7577"
},
{
"name": "CVE-2016-0740",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0740"
},
{
"name": "CVE-2018-4180",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-4180"
},
{
"name": "CVE-2013-4297",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4297"
},
{
"name": "CVE-2010-2238",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-2238"
},
{
"name": "CVE-2018-14600",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14600"
},
{
"name": "CVE-2017-13090",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13090"
},
{
"name": "CVE-2013-7336",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-7336"
},
{
"name": "CVE-2018-10372",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10372"
},
{
"name": "CVE-2019-7637",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7637"
},
{
"name": "CVE-2018-11806",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-11806"
},
{
"name": "CVE-2018-7643",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7643"
},
{
"name": "CVE-2015-0236",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0236"
},
{
"name": "CVE-2018-1000117",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000117"
},
{
"name": "CVE-2014-0209",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0209"
},
{
"name": "CVE-2013-2230",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2230"
},
{
"name": "CVE-2018-1122",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1122"
},
{
"name": "CVE-2014-3960",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3960"
},
{
"name": "CVE-2019-16056",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16056"
},
{
"name": "CVE-2020-12663",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-12663"
},
{
"name": "CVE-2018-10768",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10768"
},
{
"name": "CVE-2017-16611",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-16611"
},
{
"name": "CVE-2014-7823",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-7823"
},
{
"name": "CVE-2020-10703",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10703"
},
{
"name": "CVE-2018-7569",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7569"
},
{
"name": "CVE-2013-4154",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-4154"
},
{
"name": "CVE-2018-20060",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20060"
},
{
"name": "CVE-2015-9382",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-9382"
},
{
"name": "CVE-2017-18190",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18190"
},
{
"name": "CVE-2016-4009",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-4009"
},
{
"name": "CVE-2018-13033",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-13033"
},
{
"name": "CVE-2016-9190",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9190"
},
{
"name": "CVE-2019-7574",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7574"
},
{
"name": "CVE-2016-0772",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0772"
},
{
"name": "CVE-2016-5699",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-5699"
},
{
"name": "CVE-2011-1486",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-1486"
},
{
"name": "CVE-2020-5208",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-5208"
},
{
"name": "CVE-2019-6778",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6778"
},
{
"name": "CVE-2020-10772",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10772"
},
{
"name": "CVE-2020-25637",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25637"
},
{
"name": "CVE-2018-10360",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10360"
},
{
"name": "CVE-2018-15859",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15859"
},
{
"name": "CVE-2017-13089",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-13089"
},
{
"name": "CVE-2019-12779",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12779"
},
{
"name": "CVE-2019-1010238",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1010238"
},
{
"name": "CVE-2019-6690",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6690"
},
{
"name": "CVE-2015-8317",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8317"
},
{
"name": "CVE-2018-4181",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-4181"
},
{
"name": "CVE-2019-8323",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-8323"
},
{
"name": "CVE-2016-3616",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3616"
},
{
"name": "CVE-2018-14498",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14498"
},
{
"name": "CVE-2018-15861",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15861"
},
{
"name": "CVE-2019-7150",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-7150"
},
{
"name": "CVE-2019-17042",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17042"
},
{
"name": "CVE-2016-5008",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-5008"
},
{
"name": "CVE-2014-4616",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4616"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-267",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-03-23T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Juniper Networks\nJunos Space. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de\ns\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Juniper Networks Junos Space",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Juniper JSA11176 du 22 mars 2022",
"url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11176\u0026cat=SIRT_1\u0026actp=LIST"
}
]
}
CERTFR-2024-AVI-0203
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | Cerberus PRO EN Engineering Tool versions antérieures à IP8 | ||
| Siemens | N/A | SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0 | ||
| Siemens | N/A | SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0 | ||
| Siemens | N/A | Sinteso FS20 EN Fire Panel FC20 versions antérieures à MP8 | ||
| Siemens | N/A | RUGGEDCOM APE1808 avec Fortinet NGFW versions antérieures à V7.4.1 | ||
| Siemens | N/A | Sinteso FS20 EN X200 Cloud Distribution versions V4.0.x antérieures à V4.0.5016 | ||
| Siemens | N/A | Cerberus PRO EN X200 Cloud Distribution versions V4.0.x antérieures à V4.0.5016 | ||
| Siemens | N/A | SENTRON 3KC ATC6 Expansion Module Ethernet toutes versions | ||
| Siemens | N/A | Sinteso FS20 EN Engineering Tool versions antérieures à MP8 | ||
| Siemens | N/A | SIMATIC RF160B (6GT2003-0FA00) versions antérieures à V2.2 | ||
| Siemens | N/A | SINEMA Remote Connect Server versions antérieures à V3.2 | ||
| Siemens | N/A | Solid Edge versions antérieures à V223.0.11 | ||
| Siemens | N/A | Siveillance Control versions supérieures ou égales à V2.8 versions antérieures à V3.1.1 | ||
| Siemens | N/A | Cerberus PRO EN X300 Cloud Distribution versions V4.3.x antérieures à V4.3.5617 | ||
| Siemens | N/A | Cerberus PRO EN Fire Panel FC72x versions antérieures à IP8 | ||
| Siemens | N/A | SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0 | ||
| Siemens | N/A | Sinteso FS20 EN X300 Cloud Distribution versions V4.2.x antérieures à V4.2.5015 | ||
| Siemens | N/A | SINEMA Remote Connect Client versions antérieures à V3.1 SP1 | ||
| Siemens | N/A | SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0 | ||
| Siemens | N/A | Cerberus PRO EN X300 Cloud Distribution versions V4.2.x antérieures à V4.2.5015 | ||
| Siemens | N/A | Sinteso FS20 EN X200 Cloud Distribution versions V4.3.x antérieures à V4.3.5618 | ||
| Siemens | N/A | Cerberus PRO EN X200 Cloud Distribution versions V4.3.x antérieures à V4.3.5618 | ||
| Siemens | N/A | Sinteso FS20 EN X300 Cloud Distribution versions V4.3.x antérieures à V4.3.5617 | ||
| Siemens | N/A | Sinteso Mobile versions antérieures à V3.0.0 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cerberus PRO EN Engineering Tool versions ant\u00e9rieures \u00e0 IP8",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Sinteso FS20 EN Fire Panel FC20 versions ant\u00e9rieures \u00e0 MP8",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RUGGEDCOM APE1808 avec Fortinet NGFW versions ant\u00e9rieures \u00e0 V7.4.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Sinteso FS20 EN X200 Cloud Distribution versions V4.0.x ant\u00e9rieures \u00e0 V4.0.5016",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Cerberus PRO EN X200 Cloud Distribution versions V4.0.x ant\u00e9rieures \u00e0 V4.0.5016",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SENTRON 3KC ATC6 Expansion Module Ethernet toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Sinteso FS20 EN Engineering Tool versions ant\u00e9rieures \u00e0 MP8",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMATIC RF160B (6GT2003-0FA00) versions ant\u00e9rieures \u00e0 V2.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Remote Connect Server versions ant\u00e9rieures \u00e0 V3.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Solid Edge versions ant\u00e9rieures \u00e0 V223.0.11",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Siveillance Control versions sup\u00e9rieures ou \u00e9gales \u00e0 V2.8 versions ant\u00e9rieures \u00e0 V3.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Cerberus PRO EN X300 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5617",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Cerberus PRO EN Fire Panel FC72x versions ant\u00e9rieures \u00e0 IP8",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Sinteso FS20 EN X300 Cloud Distribution versions V4.2.x ant\u00e9rieures \u00e0 V4.2.5015",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Remote Connect Client versions ant\u00e9rieures \u00e0 V3.1 SP1",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Cerberus PRO EN X300 Cloud Distribution versions V4.2.x ant\u00e9rieures \u00e0 V4.2.5015",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Sinteso FS20 EN X200 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5618",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Cerberus PRO EN X200 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5618",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Sinteso FS20 EN X300 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5617",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Sinteso Mobile versions ant\u00e9rieures \u00e0 V3.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-0646",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0646"
},
{
"name": "CVE-2017-18509",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18509"
},
{
"name": "CVE-2021-0599",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0599"
},
{
"name": "CVE-2021-0443",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0443"
},
{
"name": "CVE-2022-20462",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20462"
},
{
"name": "CVE-2021-0598",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0598"
},
{
"name": "CVE-2021-0438",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0438"
},
{
"name": "CVE-2021-0651",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0651"
},
{
"name": "CVE-2021-0585",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0585"
},
{
"name": "CVE-2021-0331",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0331"
},
{
"name": "CVE-2021-0509",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0509"
},
{
"name": "CVE-2021-0601",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0601"
},
{
"name": "CVE-2021-0478",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0478"
},
{
"name": "CVE-2021-0397",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0397"
},
{
"name": "CVE-2021-0600",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0600"
},
{
"name": "CVE-2021-0928",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0928"
},
{
"name": "CVE-2021-0484",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0484"
},
{
"name": "CVE-2023-36641",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36641"
},
{
"name": "CVE-2021-0642",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0642"
},
{
"name": "CVE-2021-0341",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0341"
},
{
"name": "CVE-2023-38546",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38546"
},
{
"name": "CVE-2022-41329",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41329"
},
{
"name": "CVE-2021-0597",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0597"
},
{
"name": "CVE-2020-24587",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24587"
},
{
"name": "CVE-2017-14491",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14491"
},
{
"name": "CVE-2022-20421",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20421"
},
{
"name": "CVE-2021-0593",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0593"
},
{
"name": "CVE-2022-20498",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20498"
},
{
"name": "CVE-2021-0473",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0473"
},
{
"name": "CVE-2022-41328",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41328"
},
{
"name": "CVE-2022-42474",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42474"
},
{
"name": "CVE-2021-0870",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0870"
},
{
"name": "CVE-2020-0417",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-0417"
},
{
"name": "CVE-2020-29660",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-29660"
},
{
"name": "CVE-2021-0604",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0604"
},
{
"name": "CVE-2021-0522",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0522"
},
{
"name": "CVE-2021-39629",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39629"
},
{
"name": "CVE-2020-29661",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-29661"
},
{
"name": "CVE-2021-38204",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38204"
},
{
"name": "CVE-2022-20229",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20229"
},
{
"name": "CVE-2023-33306",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33306"
},
{
"name": "CVE-2022-39948",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39948"
},
{
"name": "CVE-2022-20423",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20423"
},
{
"name": "CVE-2021-0396",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0396"
},
{
"name": "CVE-2021-0650",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0650"
},
{
"name": "CVE-2021-0329",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0329"
},
{
"name": "CVE-2023-41675",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41675"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2023-27997",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27997"
},
{
"name": "CVE-2023-29183",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29183"
},
{
"name": "CVE-2021-0471",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0471"
},
{
"name": "CVE-2023-29181",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29181"
},
{
"name": "CVE-2021-0963",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0963"
},
{
"name": "CVE-2021-0327",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0327"
},
{
"name": "CVE-2021-0653",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0653"
},
{
"name": "CVE-2021-0690",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0690"
},
{
"name": "CVE-2021-39634",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39634"
},
{
"name": "CVE-2021-0596",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0596"
},
{
"name": "CVE-2023-47537",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-47537"
},
{
"name": "CVE-2023-28002",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28002"
},
{
"name": "CVE-2023-22641",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22641"
},
{
"name": "CVE-2021-0919",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0919"
},
{
"name": "CVE-2021-0968",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0968"
},
{
"name": "CVE-2022-20500",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20500"
},
{
"name": "CVE-2021-29647",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29647"
},
{
"name": "CVE-2021-0521",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0521"
},
{
"name": "CVE-2020-11301",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11301"
},
{
"name": "CVE-2021-0953",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0953"
},
{
"name": "CVE-2021-0926",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0926"
},
{
"name": "CVE-2021-0961",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0961"
},
{
"name": "CVE-2023-26207",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26207"
},
{
"name": "CVE-2020-23064",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-23064"
},
{
"name": "CVE-2021-0652",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0652"
},
{
"name": "CVE-2021-0339",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0339"
},
{
"name": "CVE-2021-39627",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39627"
},
{
"name": "CVE-2021-0437",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0437"
},
{
"name": "CVE-2023-29179",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29179"
},
{
"name": "CVE-2021-0433",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0433"
},
{
"name": "CVE-2024-22041",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22041"
},
{
"name": "CVE-2023-33305",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33305"
},
{
"name": "CVE-2022-20473",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20473"
},
{
"name": "CVE-2022-43947",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43947"
},
{
"name": "CVE-2023-41841",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41841"
},
{
"name": "CVE-2021-0333",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0333"
},
{
"name": "CVE-2022-20483",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20483"
},
{
"name": "CVE-2020-25705",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25705"
},
{
"name": "CVE-2024-22045",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22045"
},
{
"name": "CVE-2022-42476",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42476"
},
{
"name": "CVE-2023-49125",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-49125"
},
{
"name": "CVE-2021-0399",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0399"
},
{
"name": "CVE-2023-33301",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33301"
},
{
"name": "CVE-2021-0476",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0476"
},
{
"name": "CVE-2021-0507",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0507"
},
{
"name": "CVE-2021-0390",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0390"
},
{
"name": "CVE-2021-0444",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0444"
},
{
"name": "CVE-2021-0520",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0520"
},
{
"name": "CVE-2021-0586",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0586"
},
{
"name": "CVE-2021-39633",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39633"
},
{
"name": "CVE-2021-0587",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0587"
},
{
"name": "CVE-2021-0952",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0952"
},
{
"name": "CVE-2022-20476",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20476"
},
{
"name": "CVE-2020-10768",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10768"
},
{
"name": "CVE-2022-20472",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20472"
},
{
"name": "CVE-2021-0326",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0326"
},
{
"name": "CVE-2021-0929",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0929"
},
{
"name": "CVE-2022-20227",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20227"
},
{
"name": "CVE-2021-0336",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0336"
},
{
"name": "CVE-2023-44250",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44250"
},
{
"name": "CVE-2021-0506",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0506"
},
{
"name": "CVE-2021-0515",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0515"
},
{
"name": "CVE-2022-20355",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20355"
},
{
"name": "CVE-2021-0330",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0330"
},
{
"name": "CVE-2021-0688",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0688"
},
{
"name": "CVE-2021-0393",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0393"
},
{
"name": "CVE-2024-21762",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21762"
},
{
"name": "CVE-2021-0512",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0512"
},
{
"name": "CVE-2023-29178",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29178"
},
{
"name": "CVE-2022-20130",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20130"
},
{
"name": "CVE-2021-0519",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0519"
},
{
"name": "CVE-2021-0516",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0516"
},
{
"name": "CVE-2021-39621",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39621"
},
{
"name": "CVE-2021-33909",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33909"
},
{
"name": "CVE-2022-42469",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42469"
},
{
"name": "CVE-2021-1972",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1972"
},
{
"name": "CVE-2021-1976",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1976"
},
{
"name": "CVE-2022-41327",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41327"
},
{
"name": "CVE-2021-0640",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0640"
},
{
"name": "CVE-2020-14305",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14305"
},
{
"name": "CVE-2023-36555",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36555"
},
{
"name": "CVE-2022-20422",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20422"
},
{
"name": "CVE-2022-20468",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20468"
},
{
"name": "CVE-2023-22640",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22640"
},
{
"name": "CVE-2021-0400",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0400"
},
{
"name": "CVE-2022-20469",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20469"
},
{
"name": "CVE-2020-26558",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26558"
},
{
"name": "CVE-2021-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0706"
},
{
"name": "CVE-2021-0682",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0682"
},
{
"name": "CVE-2021-0480",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0480"
},
{
"name": "CVE-2021-0429",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0429"
},
{
"name": "CVE-2023-22639",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22639"
},
{
"name": "CVE-2021-0683",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0683"
},
{
"name": "CVE-2022-20411",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20411"
},
{
"name": "CVE-2022-43953",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-43953"
},
{
"name": "CVE-2023-33307",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33307"
},
{
"name": "CVE-2021-0328",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0328"
},
{
"name": "CVE-2021-0684",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0684"
},
{
"name": "CVE-2022-20466",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20466"
},
{
"name": "CVE-2023-40718",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40718"
},
{
"name": "CVE-2021-0920",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0920"
},
{
"name": "CVE-2021-0704",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0704"
},
{
"name": "CVE-2022-20127",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20127"
},
{
"name": "CVE-2021-0436",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0436"
},
{
"name": "CVE-2021-0584",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0584"
},
{
"name": "CVE-2022-45861",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45861"
},
{
"name": "CVE-2021-0594",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0594"
},
{
"name": "CVE-2021-0591",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0591"
},
{
"name": "CVE-2021-0514",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0514"
},
{
"name": "CVE-2021-0511",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0511"
},
{
"name": "CVE-2021-0931",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0931"
},
{
"name": "CVE-2024-21483",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21483"
},
{
"name": "CVE-2020-15436",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15436"
},
{
"name": "CVE-2023-45793",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45793"
},
{
"name": "CVE-2021-0689",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0689"
},
{
"name": "CVE-2023-28001",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28001"
},
{
"name": "CVE-2021-0970",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0970"
},
{
"name": "CVE-2021-0337",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0337"
},
{
"name": "CVE-2022-32257",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32257"
},
{
"name": "CVE-2023-36639",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36639"
},
{
"name": "CVE-2021-39623",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39623"
},
{
"name": "CVE-2022-41330",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41330"
},
{
"name": "CVE-2021-0508",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0508"
},
{
"name": "CVE-2021-0325",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0325"
},
{
"name": "CVE-2021-0708",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0708"
},
{
"name": "CVE-2022-41334",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41334"
},
{
"name": "CVE-2024-23113",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23113"
},
{
"name": "CVE-2020-0338",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-0338"
},
{
"name": "CVE-2020-26555",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26555"
},
{
"name": "CVE-2021-0302",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0302"
},
{
"name": "CVE-2021-0589",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0589"
},
{
"name": "CVE-2021-0305",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0305"
},
{
"name": "CVE-2023-33308",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33308"
},
{
"name": "CVE-2023-29175",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29175"
},
{
"name": "CVE-2021-0431",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0431"
},
{
"name": "CVE-2021-0392",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0392"
},
{
"name": "CVE-2021-0474",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0474"
},
{
"name": "CVE-2021-0930",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0930"
},
{
"name": "CVE-2021-39626",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39626"
},
{
"name": "CVE-2021-0967",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0967"
},
{
"name": "CVE-2023-25610",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25610"
},
{
"name": "CVE-2023-37935",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-37935"
},
{
"name": "CVE-2021-0695",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0695"
},
{
"name": "CVE-2024-22040",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22040"
},
{
"name": "CVE-2021-0965",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0965"
},
{
"name": "CVE-2021-0513",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0513"
},
{
"name": "CVE-2021-0434",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0434"
},
{
"name": "CVE-2021-0687",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0687"
},
{
"name": "CVE-2021-0481",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0481"
},
{
"name": "CVE-2021-0964",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0964"
},
{
"name": "CVE-2021-0641",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0641"
},
{
"name": "CVE-2021-0435",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0435"
},
{
"name": "CVE-2021-0334",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0334"
},
{
"name": "CVE-2021-0933",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0933"
},
{
"name": "CVE-2021-0394",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0394"
},
{
"name": "CVE-2023-29180",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29180"
},
{
"name": "CVE-2021-0588",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0588"
},
{
"name": "CVE-2023-38545",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38545"
},
{
"name": "CVE-2024-22039",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22039"
},
{
"name": "CVE-2021-0391",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0391"
},
{
"name": "CVE-2021-0510",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0510"
},
{
"name": "CVE-2021-0692",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0692"
},
{
"name": "CVE-2024-22044",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22044"
},
{
"name": "CVE-2020-14381",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14381"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0203",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-03-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Siemens\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0\ndistance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-792319 du 12 mars 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-792319.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-918992 du 12 mars 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-918992.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-353002 du 12 mars 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-353002.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-653855 du 12 mars 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-653855.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-225840 du 12 mars 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-225840.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-145196 du 12 mars 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-145196.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-382651 du 12 mars 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-382651.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-832273 du 12 mars 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-832273.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-366067 du 12 mars 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-366067.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-770721 du 12 mars 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-576771 du 12 mars 2024",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-576771.html"
}
]
}
CNVD-2017-29278
Vulnerability from cnvd - Published: 2017-10-09
VLAI
Title
DNSmasq任意代码执行漏洞
Description
DNSmasq是一个小巧且方便地用于配置DNS和DHCP的工具，适用于小型网络，它提供了DNS功能和可选择的DHCP功能。
DNSmasq 2.77及之前版本中存在任意代码执行漏洞，远程攻击者可以通过发送特制DNS数据包来触发堆溢出并在目标系统上执行任意代码。
Severity
高
Patch Name
DNSmasq任意代码执行漏洞的补丁
Patch Description
DNSmasq是一个小巧且方便地用于配置DNS和DHCP的工具，适用于小型网络，它提供了DNS功能和可选择的DHCP功能。
DNSmasq 2.77及之前版本中存在任意代码执行漏洞，远程攻击者可以通过发送特制DNS数据包来触发堆溢出并在目标系统上执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已发布漏洞修复程序，请及时关注更新： http://www.thekelleys.org.uk/dnsmasq/CHANGELOG
Reference
http://securitytracker.com/id/1039474
http://www.securityfocus.com/bid/101085
Impacted products
| Name | Dnsmasq Dnsmasq <=2.77 |
|---|
{
"bids": {
"bid": {
"bidNumber": "101085"
}
},
"cves": {
"cve": {
"cveNumber": "CVE-2017-14491"
}
},
"description": "DNSmasq\u662f\u4e00\u4e2a\u5c0f\u5de7\u4e14\u65b9\u4fbf\u5730\u7528\u4e8e\u914d\u7f6eDNS\u548cDHCP\u7684\u5de5\u5177\uff0c\u9002\u7528\u4e8e\u5c0f\u578b\u7f51\u7edc\uff0c\u5b83\u63d0\u4f9b\u4e86DNS\u529f\u80fd\u548c\u53ef\u9009\u62e9\u7684DHCP\u529f\u80fd\u3002\r\n\r\nDNSmasq 2.77\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u53d1\u9001\u7279\u5236DNS\u6570\u636e\u5305\u6765\u89e6\u53d1\u5806\u6ea2\u51fa\u5e76\u5728\u76ee\u6807\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
"discovererName": "Felix Wilhelm, Fermin J. Serna, Gabriel Campana, Kevin Hamacher and Ron Bowes of the Google Security Team",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttp://www.thekelleys.org.uk/dnsmasq/CHANGELOG",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2017-29278",
"openTime": "2017-10-09",
"patchDescription": "DNSmasq\u662f\u4e00\u4e2a\u5c0f\u5de7\u4e14\u65b9\u4fbf\u5730\u7528\u4e8e\u914d\u7f6eDNS\u548cDHCP\u7684\u5de5\u5177\uff0c\u9002\u7528\u4e8e\u5c0f\u578b\u7f51\u7edc\uff0c\u5b83\u63d0\u4f9b\u4e86DNS\u529f\u80fd\u548c\u53ef\u9009\u62e9\u7684DHCP\u529f\u80fd\u3002\r\n\r\nDNSmasq 2.77\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u53d1\u9001\u7279\u5236DNS\u6570\u636e\u5305\u6765\u89e6\u53d1\u5806\u6ea2\u51fa\u5e76\u5728\u76ee\u6807\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "DNSmasq\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "Dnsmasq Dnsmasq \u003c=2.77"
},
"referenceLink": "http://securitytracker.com/id/1039474\r\nhttp://www.securityfocus.com/bid/101085",
"serverity": "\u9ad8",
"submitTime": "2017-10-09",
"title": "DNSmasq\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}
FKIE_CVE-2017-14491
Vulnerability from fkie_nvd - Published: 2017-10-04 01:29 - Updated: 2026-05-13 00:24
Severity
Summary
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B85D7A28-8CBA-4D77-AD30-DB3CA49F2F98",
"versionEndIncluding": "2.77",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E5ED5807-55B7-47C5-97A6-03233F4FBC3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*",
"matchCriteriaId": "CB66DB75-2B16-4EBF-9B93-CE49D8086E41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*",
"matchCriteriaId": "588D4F37-0A56-47A4-B710-4D5F3D214FB9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7B21E9A8-CE63-42C2-A11A-94D977A96DF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1EA337A3-B9A3-4962-B8BD-8E0C7C5B28EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5F65DAB0-3DAD-49FF-BC73-3581CC3D5BF3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*",
"matchCriteriaId": "58D3B6FD-B474-4B09-B644-A8634A629280",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*",
"matchCriteriaId": "F892F1B0-514C-42F7-90AE-12ACDFDC1033",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:linux_enterprise_point_of_sale:11:sp3:*:*:*:*:*:*",
"matchCriteriaId": "0FC411C9-9A8A-49D0-B704-2207674778CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:ltss:*:*:*",
"matchCriteriaId": "B12243B2-D726-404C-ABFF-F1AB51BA1783",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*",
"matchCriteriaId": "55C5561F-BE86-4EEA-99D4-8697F8BD9DFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:*:*:*:ltss:*:*:*",
"matchCriteriaId": "B2F3699A-38E4-4E9D-9414-411F71D9E371",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nvidia:linux_for_tegra:*:*:*:*:*:*:*:*",
"matchCriteriaId": "54DF7A22-DF8B-4272-8EC6-48173E8860B8",
"versionEndExcluding": "r21.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nvidia:jetson_tk1:-:*:*:*:*:*:*:*",
"matchCriteriaId": "810B05A3-29CF-464F-9E63-8238AA0651AF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nvidia:linux_for_tegra:*:*:*:*:*:*:*:*",
"matchCriteriaId": "22159717-67FD-4A10-9F65-4434FEC1F922",
"versionEndExcluding": "r24.2.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nvidia:jetson_tx1:-:*:*:*:*:*:*:*",
"matchCriteriaId": "86D1FDAD-C594-43D9-9BF6-F7461177AB91",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nvidia:geforce_experience:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5454038C-F1F0-4061-8B5C-04A8CF1658C6",
"versionEndExcluding": "3.10.0.55",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:huawei:honor_v9_play_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CF744446-5C60-4C66-BE6B-DD108487B46C",
"versionEndExcluding": "jimmy-al00ac00b135",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:huawei:honor_v9_play:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B543AF24-5D59-4A46-AC76-0EFF314E3D1A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E861FF18-4E42-4092-81B6-0BB32679B2CF",
"versionEndIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E2DED50F-C1ED-43EB-9E63-B65F4F287F41",
"versionEndExcluding": "4.16.13m",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B5F144E5-EFB1-47E7-A2D2-28DEE6045CF6",
"versionEndExcluding": "4.17.8m",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8F1A3AF8-D105-4F13-8921-D94DCC7DE1AF",
"versionEndIncluding": "4.18.4.2f",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:ruggedcom_rm1224_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "63C108C5-0EF5-4C6D-8D83-ADB5EED24A6F",
"versionEndExcluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:ruggedcom_rm1224:-:*:*:*:*:*:*:*",
"matchCriteriaId": "284DF779-D900-48B4-A177-7281CD445AB5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:scalance_m-800_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E25B682B-83F5-4903-9138-16907DC7A859",
"versionEndExcluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:scalance_m-800:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB9921A-5204-40A3-88AB-B7755F5C6875",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:scalance_s615_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E8B2D681-1FBF-4013-B223-9878F4F1DB27",
"versionEndExcluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:scalance_s615:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E917CBBB-EF41-4113-B0CA-EB91889235E7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE55F796-FA73-4992-9826-57A00F77F6CA",
"versionEndExcluding": "6.5.1.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:siemens:scalance_w1750d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FBC30055-239F-4BB1-B2D1-E5E35F0D8911",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CFE6B116-71BB-49BF-A5EF-4460D9089511",
"versionEndExcluding": "6.3.1.25",
"versionStartIncluding": "6.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "193354A0-B108-4CA4-A1C3-F5F23147A295",
"versionEndExcluding": "6.4.4.16",
"versionStartIncluding": "6.4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "47D1AB4F-0922-49AF-9AE5-AEB4019E652C",
"versionEndExcluding": "6.5.1.9",
"versionStartIncluding": "6.5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8F5D03FA-CE4E-4888-88E2-384986A890BA",
"versionEndExcluding": "6.5.3.3",
"versionStartIncluding": "6.5.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E39B25F2-C65B-457F-A36E-14FC8285A004",
"versionEndExcluding": "6.5.4.2",
"versionStartIncluding": "6.5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "00E53FE9-EA96-456A-B522-FC81DD0CCE3E",
"versionEndExcluding": "8.1.0.4",
"versionStartIncluding": "8.1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:synology:router_manager:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "46261C28-E276-4639-BA3D-A735B02599F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:synology:diskstation_manager:5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01527614-8A68-48DC-B0A0-F4AA99489221",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:synology:diskstation_manager:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "65372FA7-B54B-4298-99BF-483E9FEBA253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:synology:diskstation_manager:6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3D04EA1A-F8E0-415B-8786-1C8C0F08E132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response."
},
{
"lang": "es",
"value": "Un desbordamiento de b\u00fafer basado en memoria din\u00e1mica (heap) en dnsmasq en versiones anteriores a la 2.78 permite a los atacantes provocar una denegaci\u00f3n de servicio (cierre inesperado) o ejecutar c\u00f3digo arbitrario utilizando una respuesta DNS manipulada."
}
],
"id": "CVE-2017-14491",
"lastModified": "2026-05-13T00:24:29.033",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-10-04T01:29:02.870",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4560"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4561"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "http://thekelleys.org.uk/dnsmasq/CHANGELOG"
},
{
"source": "cve@mitre.org",
"url": "http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=0549c73b7ea6b22a3c49beb4d432f185a81efcbc"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2017/dsa-3989"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://www.securityfocus.com/bid/101085"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://www.securityfocus.com/bid/101977"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://www.securitytracker.com/id/1039474"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-3430-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-3430-2"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-3430-3"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2837"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2838"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2839"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2840"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2841"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201710-27"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Third Party Advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2017/dsa-3989"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/42941/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.kb.cert.org/vuls/id/973527"
},
{
"source": "cve@mitre.org",
"url": "https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4560"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4561"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "http://thekelleys.org.uk/dnsmasq/CHANGELOG"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=0549c73b7ea6b22a3c49beb4d432f185a81efcbc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2017/dsa-3989"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.securityfocus.com/bid/101085"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.securityfocus.com/bid/101977"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.securitytracker.com/id/1039474"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-3430-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-3430-2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-3430-3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2837"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2838"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2839"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2840"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2841"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201710-27"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Third Party Advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2017/dsa-3989"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/42941/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.kb.cert.org/vuls/id/973527"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-M4PX-PH3F-7964
Vulnerability from github – Published: 2022-04-30 00:02 – Updated: 2025-01-14 21:31
VLAI
Details
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2017-14491"
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-04T01:29:00Z",
"severity": "CRITICAL"
},
"details": "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.",
"id": "GHSA-m4px-ph3f-7964",
"modified": "2025-01-14T21:31:36Z",
"published": "2022-04-30T00:02:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14491"
},
{
"type": "WEB",
"url": "https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq"
},
{
"type": "WEB",
"url": "https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg11665.html"
},
{
"type": "WEB",
"url": "https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg11664.html"
},
{
"type": "WEB",
"url": "https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11665.html"
},
{
"type": "WEB",
"url": "https://www.mail-archive.com/dnsmasq-discuss%40lists.thekelleys.org.uk/msg11664.html"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/973527"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/42941"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-3989"
},
{
"type": "WEB",
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449"
},
{
"type": "WEB",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30"
},
{
"type": "WEB",
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201710-27"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2841"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2840"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2839"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2838"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2837"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html"
},
{
"type": "WEB",
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4560"
},
{
"type": "WEB",
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4561"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html"
},
{
"type": "WEB",
"url": "http://thekelleys.org.uk/dnsmasq/CHANGELOG"
},
{
"type": "WEB",
"url": "http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=0549c73b7ea6b22a3c49beb4d432f185a81efcbc"
},
{
"type": "WEB",
"url": "http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=0549c73b7ea6b22a3c49beb4d432f185a81efcbc"
},
{
"type": "WEB",
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3989"
},
{
"type": "WEB",
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101085"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101977"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039474"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3430-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3430-2"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3430-3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GSD-2017-14491
Vulnerability from gsd - Updated: 2023-12-13 01:21Details
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2017-14491",
"description": "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.",
"id": "GSD-2017-14491",
"references": [
"https://www.suse.com/security/cve/CVE-2017-14491.html",
"https://www.debian.org/security/2017/dsa-3989",
"https://access.redhat.com/errata/RHSA-2017:2841",
"https://access.redhat.com/errata/RHSA-2017:2840",
"https://access.redhat.com/errata/RHSA-2017:2839",
"https://access.redhat.com/errata/RHSA-2017:2838",
"https://access.redhat.com/errata/RHSA-2017:2837",
"https://access.redhat.com/errata/RHSA-2017:2836",
"https://ubuntu.com/security/CVE-2017-14491",
"https://advisories.mageia.org/CVE-2017-14491.html",
"https://security.archlinux.org/CVE-2017-14491",
"https://alas.aws.amazon.com/cve/html/CVE-2017-14491.html",
"https://linux.oracle.com/cve/CVE-2017-14491.html",
"https://packetstormsecurity.com/files/cve/CVE-2017-14491"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2017-14491"
],
"details": "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.",
"id": "GSD-2017-14491",
"modified": "2023-12-13T01:21:12.964743Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-14491",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1039474",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1039474"
},
{
"name": "https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq",
"refsource": "CONFIRM",
"url": "https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq"
},
{
"name": "DSA-3989",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2017/dsa-3989"
},
{
"name": "https://access.redhat.com/security/vulnerabilities/3199382",
"refsource": "CONFIRM",
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"name": "101085",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101085"
},
{
"name": "USN-3430-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3430-1"
},
{
"name": "http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=0549c73b7ea6b22a3c49beb4d432f185a81efcbc",
"refsource": "CONFIRM",
"url": "http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=0549c73b7ea6b22a3c49beb4d432f185a81efcbc"
},
{
"name": "101977",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/101977"
},
{
"name": "RHSA-2017:2838",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:2838"
},
{
"name": "VU#973527",
"refsource": "CERT-VN",
"url": "https://www.kb.cert.org/vuls/id/973527"
},
{
"name": "GLSA-201710-27",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201710-27"
},
{
"name": "RHSA-2017:2840",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:2840"
},
{
"name": "USN-3430-2",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3430-2"
},
{
"name": "RHSA-2017:2839",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:2839"
},
{
"name": "[dnsmasq-discuss] 20171002 Announce: dnsmasq-2.78.",
"refsource": "MLIST",
"url": "https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg11665.html"
},
{
"name": "RHSA-2017:2836",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
},
{
"name": "http://nvidia.custhelp.com/app/answers/detail/a_id/4561",
"refsource": "CONFIRM",
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4561"
},
{
"name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt",
"refsource": "CONFIRM",
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt"
},
{
"name": "RHSA-2017:2837",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:2837"
},
{
"name": "42941",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/42941/"
},
{
"name": "http://thekelleys.org.uk/dnsmasq/CHANGELOG",
"refsource": "CONFIRM",
"url": "http://thekelleys.org.uk/dnsmasq/CHANGELOG"
},
{
"name": "RHSA-2017:2841",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2017:2841"
},
{
"name": "http://nvidia.custhelp.com/app/answers/detail/a_id/4560",
"refsource": "CONFIRM",
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4560"
},
{
"name": "openSUSE-SU-2017:2633",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html"
},
{
"name": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html",
"refsource": "MISC",
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
},
{
"name": "[dnsmasq-discuss] 20171002 IMPORTANT SECURITY INFORMATION.",
"refsource": "MLIST",
"url": "https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg11664.html"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf"
},
{
"name": "FEDORA-2017-515264ae24",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/"
},
{
"name": "FEDORA-2017-24f067299e",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/"
},
{
"name": "USN-3430-3",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3430-3"
},
{
"name": "http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html"
},
{
"name": "SUSE-SU-2017:2619",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html"
},
{
"name": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/",
"refsource": "CONFIRM",
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/"
},
{
"name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en",
"refsource": "CONFIRM",
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en"
},
{
"name": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449",
"refsource": "CONFIRM",
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449"
},
{
"name": "FEDORA-2017-7106a157f5",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/"
},
{
"name": "SUSE-SU-2017:2616",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html"
},
{
"name": "SUSE-SU-2017:2617",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html"
},
{
"name": "DSA-3989",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2017/dsa-3989"
},
{
"name": "https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30",
"refsource": "MISC",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:thekelleys:dnsmasq:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.77",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:suse:linux_enterprise_point_of_sale:11:sp3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:ltss:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:12:*:*:*:ltss:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nvidia:linux_for_tegra:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "r21.6",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nvidia:jetson_tk1:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nvidia:linux_for_tegra:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "r24.2.2",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nvidia:jetson_tx1:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:nvidia:geforce_experience:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.10.0.55",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:huawei:honor_v9_play_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "jimmy-al00ac00b135",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:huawei:honor_v9_play:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.15",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.16.13m",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.17.8m",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.18.4.2f",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:ruggedcom_rm1224_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:ruggedcom_rm1224:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:scalance_m-800_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:scalance_m-800:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:scalance_s615_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:scalance_s615:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.5.1.5",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:scalance_w1750d:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.3.1.25",
"versionStartIncluding": "6.3.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.4.4.16",
"versionStartIncluding": "6.4.4.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.5.1.9",
"versionStartIncluding": "6.5.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.5.3.3",
"versionStartIncluding": "6.5.3.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.5.4.2",
"versionStartIncluding": "6.5.4.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "8.1.0.4",
"versionStartIncluding": "8.1.0.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:synology:diskstation_manager:5.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:synology:diskstation_manager:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:synology:diskstation_manager:6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:synology:router_manager:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-14491"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[dnsmasq-discuss] 20171002 Announce: dnsmasq-2.78.",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg11665.html"
},
{
"name": "[dnsmasq-discuss] 20171002 IMPORTANT SECURITY INFORMATION.",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg11664.html"
},
{
"name": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
},
{
"name": "1039474",
"refsource": "SECTRACK",
"tags": [
"Broken Link"
],
"url": "http://www.securitytracker.com/id/1039474"
},
{
"name": "http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=0549c73b7ea6b22a3c49beb4d432f185a81efcbc",
"refsource": "CONFIRM",
"tags": [
"Mailing List",
"Patch",
"Vendor Advisory"
],
"url": "http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=0549c73b7ea6b22a3c49beb4d432f185a81efcbc"
},
{
"name": "http://thekelleys.org.uk/dnsmasq/CHANGELOG",
"refsource": "CONFIRM",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "http://thekelleys.org.uk/dnsmasq/CHANGELOG"
},
{
"name": "42941",
"refsource": "EXPLOIT-DB",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/42941/"
},
{
"name": "101085",
"refsource": "BID",
"tags": [
"Broken Link"
],
"url": "http://www.securityfocus.com/bid/101085"
},
{
"name": "VU#973527",
"refsource": "CERT-VN",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.kb.cert.org/vuls/id/973527"
},
{
"name": "https://access.redhat.com/security/vulnerabilities/3199382",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"name": "RHSA-2017:2841",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2841"
},
{
"name": "RHSA-2017:2840",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2840"
},
{
"name": "RHSA-2017:2839",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2839"
},
{
"name": "RHSA-2017:2838",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2838"
},
{
"name": "RHSA-2017:2837",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2837"
},
{
"name": "RHSA-2017:2836",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
},
{
"name": "USN-3430-2",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-3430-2"
},
{
"name": "USN-3430-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-3430-1"
},
{
"name": "DSA-3989",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2017/dsa-3989"
},
{
"name": "openSUSE-SU-2017:2633",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00006.html"
},
{
"name": "http://nvidia.custhelp.com/app/answers/detail/a_id/4561",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4561"
},
{
"name": "GLSA-201710-27",
"refsource": "GENTOO",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201710-27"
},
{
"name": "101977",
"refsource": "BID",
"tags": [
"Broken Link"
],
"url": "http://www.securityfocus.com/bid/101977"
},
{
"name": "https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/support/security/Synology_SA_17_59_Dnsmasq"
},
{
"name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-005.txt"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf",
"refsource": "CONFIRM",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-689071.pdf"
},
{
"name": "http://nvidia.custhelp.com/app/answers/detail/a_id/4560",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4560"
},
{
"name": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449/"
},
{
"name": "USN-3430-3",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-3430-3"
},
{
"name": "FEDORA-2017-24f067299e",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YXRZ2W6TV6NLUJC5NOFBSG6PZSMDTYPV/"
},
{
"name": "SUSE-SU-2017:2619",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00005.html"
},
{
"name": "DSA-3989",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2017/dsa-3989"
},
{
"name": "SUSE-SU-2017:2617",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00004.html"
},
{
"name": "FEDORA-2017-515264ae24",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5MMPCJOYPPL4B5RBY4U425PWG7EETDTD/"
},
{
"name": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-449"
},
{
"name": "http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html"
},
{
"name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171103-01-dnsmasq-en"
},
{
"name": "FEDORA-2017-7106a157f5",
"refsource": "FEDORA",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/527KNN34RN2SB6MBJG7CKSEBWYE3TJEB/"
},
{
"name": "https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30",
"refsource": "MISC",
"tags": [
"Mitigation",
"Third Party Advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/3577-security-advisory-30"
},
{
"name": "SUSE-SU-2017:2616",
"refsource": "SUSE",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00003.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
},
"lastModifiedDate": "2022-04-22T20:39Z",
"publishedDate": "2017-10-04T01:29Z"
}
}
}
ICSA-17-332-01
Vulnerability from csaf_cisa - Published: 2017-11-17 00:00 - Updated: 2018-05-09 00:00Summary
Siemens SCALANCE W1750D, M800, S615, and RUGGEDCOM RM1224 (Update C)
Notes
General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional Resources: Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Terms of Use: Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer: This CISA CSAF advisory was converted from a Siemens ProductCERT's advisory.
Critical infrastructure sectors: Multiple
Countries/areas deployed: Worldwide
Company headquarters location: Germany
Recommended Practices: CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices: Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices: Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices: When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices: CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices: CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices: Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CWE-20
- Improper Input Validation
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Siemens RUGGEDCOM RM1224: All versions < V5.0
Siemens / RUGGEDCOM RM1224
|
<V5.0 |
Mitigation
Vendor Fix
|
|
|
Siemens SCALANCE M-800 / S615: All versions < V5.0
Siemens / SCALANCE M-800 / S615
|
<V5.0 |
Mitigation
Vendor Fix
|
|
|
Siemens SCALANCE W1750D: All versions < V6.5.1.5
Siemens / SCALANCE W1750D
|
<V6.5.1.5 |
Mitigation
Vendor Fix
|
CWE-119
- Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Siemens RUGGEDCOM RM1224: All versions < V5.0
Siemens / RUGGEDCOM RM1224
|
<V5.0 |
Mitigation
Vendor Fix
|
|
|
Siemens SCALANCE M-800 / S615: All versions < V5.0
Siemens / SCALANCE M-800 / S615
|
<V5.0 |
Mitigation
Vendor Fix
|
|
|
Siemens SCALANCE W1750D: All versions < V6.5.1.5
Siemens / SCALANCE W1750D
|
<V6.5.1.5 |
Mitigation
Vendor Fix
|
CWE-772
- Missing Release of Resource after Effective Lifetime
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Siemens RUGGEDCOM RM1224: All versions < V5.0
Siemens / RUGGEDCOM RM1224
|
<V5.0 |
Mitigation
Vendor Fix
|
|
|
Siemens SCALANCE M-800 / S615: All versions < V5.0
Siemens / SCALANCE M-800 / S615
|
<V5.0 |
Mitigation
Vendor Fix
|
|
|
Siemens SCALANCE W1750D: All versions < V6.5.1.5
Siemens / SCALANCE W1750D
|
<V6.5.1.5 |
Mitigation
Vendor Fix
|
CWE-191
- Integer Underflow (Wrap or Wraparound)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Siemens RUGGEDCOM RM1224: All versions < V5.0
Siemens / RUGGEDCOM RM1224
|
<V5.0 |
Mitigation
Vendor Fix
|
|
|
Siemens SCALANCE M-800 / S615: All versions < V5.0
Siemens / SCALANCE M-800 / S615
|
<V5.0 |
Mitigation
Vendor Fix
|
|
|
Siemens SCALANCE W1750D: All versions < V6.5.1.5
Siemens / SCALANCE W1750D
|
<V6.5.1.5 |
Mitigation
Vendor Fix
|
References
9 references
Acknowledgments
Siemens ProductCERT
{
"document": {
"acknowledgments": [
{
"organization": "Siemens ProductCERT",
"summary": "reporting these vulnerabilities to CISA."
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.",
"title": "General Recommendations"
},
{
"category": "general",
"text": "Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "other",
"text": "This CISA CSAF advisory was converted from a Siemens ProductCERT\u0027s advisory.",
"title": "Advisory Conversion Disclaimer"
},
{
"category": "other",
"text": "Multiple",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "other",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "SSA-689071: DNSMasq Vulnerabilities in SCALANCE W1750D, SCALANCE M-800 / S615 and RUGGEDCOM RM1224 - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-689071.html"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-17-332-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2017/icsa-17-332-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-17-332-01 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-332-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Siemens SCALANCE W1750D, M800, S615, and RUGGEDCOM RM1224 (Update C)",
"tracking": {
"current_release_date": "2018-05-09T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-17-332-01",
"initial_release_date": "2017-11-17T00:00:00.000000Z",
"revision_history": [
{
"date": "2017-11-17T00:00:00.000000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2018-04-05T00:00:00.000000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Changed to the new format and added update information for SCALANCE W1750D"
},
{
"date": "2018-05-09T00:00:00.000000Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added update information for SCALANCE M-800 / S615"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV5.0",
"product": {
"name": "Siemens RUGGEDCOM RM1224: All versions \u003c V5.0",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM RM1224"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV5.0",
"product": {
"name": "Siemens SCALANCE M-800 / S615: All versions \u003c V5.0",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "SCALANCE M-800 / S615"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV6.5.1.5",
"product": {
"name": "Siemens SCALANCE W1750D: All versions \u003c V6.5.1.5",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "SCALANCE W1750D"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-13704",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "An attacker could cause a crash of the DNSmasq process by sending specially crafted request messages to the service on port 53/udp.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003"
]
},
"remediations": [
{
"category": "mitigation",
"details": "SCALANCE M-800 / S615 and RUGGEDCOM RM1224: Disable DNS proxy in the device configuration (System - DNS - DNS Proxy - Disable Checkbox \u0027Enable DNS Proxy\u0027), and configure the connected devices in the internal network to use a different DNS server",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "SCALANCE W1750D: If \u0027OpenDNS\u0027, \u0027Captive Portal\u0027 or \u0027URL redirection\u0027 functionality is not used, deploy firewall rules in the device configuration to block incoming access to port 53/UDP",
"product_ids": [
"CSAFPID-0003"
]
},
{
"category": "vendor_fix",
"details": "Update to V5.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109757544",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "vendor_fix",
"details": "Update to V6.5.1.5 or later version https://support.industry.siemens.com/cs/ww/en/view/109778052",
"product_ids": [
"CSAFPID-0003"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003"
]
}
],
"title": "CVE-2017-13704"
},
{
"cve": "CVE-2017-14491",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "An attacker could cause a crash of the DNSmasq process by sending specially crafted request messages to the service on port 53/udp.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003"
]
},
"remediations": [
{
"category": "mitigation",
"details": "SCALANCE M-800 / S615 and RUGGEDCOM RM1224: Disable DNS proxy in the device configuration (System - DNS - DNS Proxy - Disable Checkbox \u0027Enable DNS Proxy\u0027), and configure the connected devices in the internal network to use a different DNS server",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "SCALANCE W1750D: If \u0027OpenDNS\u0027, \u0027Captive Portal\u0027 or \u0027URL redirection\u0027 functionality is not used, deploy firewall rules in the device configuration to block incoming access to port 53/UDP",
"product_ids": [
"CSAFPID-0003"
]
},
{
"category": "vendor_fix",
"details": "Update to V5.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109757544",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "vendor_fix",
"details": "Update to V6.5.1.5 or later version https://support.industry.siemens.com/cs/ww/en/view/109778052",
"product_ids": [
"CSAFPID-0003"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003"
]
}
],
"title": "CVE-2017-14491"
},
{
"cve": "CVE-2017-14495",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"notes": [
{
"category": "summary",
"text": "An attacker could cause a crash of the DNSmasq process by sending specially crafted request messages to the service on port 53/udp.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003"
]
},
"remediations": [
{
"category": "mitigation",
"details": "SCALANCE M-800 / S615 and RUGGEDCOM RM1224: Disable DNS proxy in the device configuration (System - DNS - DNS Proxy - Disable Checkbox \u0027Enable DNS Proxy\u0027), and configure the connected devices in the internal network to use a different DNS server",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "SCALANCE W1750D: If \u0027OpenDNS\u0027, \u0027Captive Portal\u0027 or \u0027URL redirection\u0027 functionality is not used, deploy firewall rules in the device configuration to block incoming access to port 53/UDP",
"product_ids": [
"CSAFPID-0003"
]
},
{
"category": "vendor_fix",
"details": "Update to V5.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109757544",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "vendor_fix",
"details": "Update to V6.5.1.5 or later version https://support.industry.siemens.com/cs/ww/en/view/109778052",
"product_ids": [
"CSAFPID-0003"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003"
]
}
],
"title": "CVE-2017-14495"
},
{
"cve": "CVE-2017-14496",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"notes": [
{
"category": "summary",
"text": "An attacker could cause a crash of the DNSmasq process by sending specially crafted request messages to the service on port 53/udp.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003"
]
},
"remediations": [
{
"category": "mitigation",
"details": "SCALANCE M-800 / S615 and RUGGEDCOM RM1224: Disable DNS proxy in the device configuration (System - DNS - DNS Proxy - Disable Checkbox \u0027Enable DNS Proxy\u0027), and configure the connected devices in the internal network to use a different DNS server",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "mitigation",
"details": "SCALANCE W1750D: If \u0027OpenDNS\u0027, \u0027Captive Portal\u0027 or \u0027URL redirection\u0027 functionality is not used, deploy firewall rules in the device configuration to block incoming access to port 53/UDP",
"product_ids": [
"CSAFPID-0003"
]
},
{
"category": "vendor_fix",
"details": "Update to V5.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109757544",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
{
"category": "vendor_fix",
"details": "Update to V6.5.1.5 or later version https://support.industry.siemens.com/cs/ww/en/view/109778052",
"product_ids": [
"CSAFPID-0003"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003"
]
}
],
"title": "CVE-2017-14496"
}
]
}
ICSA-24-074-07
Vulnerability from csaf_cisa - Published: 2024-03-14 06:00 - Updated: 2024-03-14 06:00Summary
Siemens SIMATIC
Notes
Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation: Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code within the context of a privileged process.
Critical infrastructure sectors: Critical Manufacturing
Countries/areas deployed: Worldwide
Company headquarters location: Germany
Recommended Practices: CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices: CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Recommended Practices: Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices: Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
Recommended Practices: CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Recommended Practices: Do not click web links or open attachments in unsolicited email messages.
Recommended Practices: Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Recommended Practices: Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
Recommended Practices: No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
8.1 (High)
7.8 (High)
5.0 (Medium)
7.8 (High)
5.5 (Medium)
7.5 (High)
8.1 (High)
7.8 (High)
6.7 (Medium)
CWE-326
- Inadequate Encryption Strength
7.4 (High)
5.4 (Medium)
4.2 (Medium)
4.4 (Medium)
7.8 (High)
7.8 (High)
7.8 (High)
8.8 (High)
7.5 (High)
7.8 (High)
7.8 (High)
7.8 (High)
7.8 (High)
7.3 (High)
7.3 (High)
7.8 (High)
7.8 (High)
7.8 (High)
7.8 (High)
7.5 (High)
7.8 (High)
7.8 (High)
7.8 (High)
7.8 (High)
5.5 (Medium)
9.8 (Critical)
9.8 (Critical)
7.8 (High)
5.5 (Medium)
7.8 (High)
7.5 (High)
8.0 (High)
7.3 (High)
7.5 (High)
5.5 (Medium)
7.8 (High)
7.8 (High)
4.7 (Medium)
5.5 (Medium)
5.5 (Medium)
8.8 (High)
9.8 (Critical)
7.0 (High)
7.8 (High)
5.5 (Medium)
7.8 (High)
5.5 (Medium)
7.3 (High)
8.8 (High)
7.0 (High)
7.0 (High)
7.8 (High)
7.8 (High)
7.8 (High)
7.8 (High)
8.1 (High)
9.8 (Critical)
9.8 (Critical)
7.8 (High)
7.0 (High)
5.5 (Medium)
7.5 (High)
5.5 (Medium)
6.7 (Medium)
7.8 (High)
7.8 (High)
5.5 (Medium)
7.8 (High)
7.3 (High)
7.8 (High)
8.0 (High)
7.5 (High)
5.5 (Medium)
7.3 (High)
5.5 (Medium)
7.8 (High)
5.5 (Medium)
5.5 (Medium)
7.8 (High)
5.5 (Medium)
5.5 (Medium)
7.8 (High)
6.5 (Medium)
5.5 (Medium)
7.8 (High)
5.5 (Medium)
5.5 (Medium)
7.8 (High)
7.8 (High)
5.0 (Medium)
7.0 (High)
5.5 (Medium)
6.5 (Medium)
7.8 (High)
5.5 (Medium)
5.5 (Medium)
5.5 (Medium)
7.8 (High)
8.1 (High)
5.0 (Medium)
6.4 (Medium)
7.8 (High)
7.8 (High)
7.8 (High)
8.8 (High)
5.5 (Medium)
8.0 (High)
5.0 (Medium)
7.8 (High)
4.4 (Medium)
7.1 (High)
6.5 (Medium)
8.8 (High)
8.8 (High)
8.8 (High)
7.8 (High)
9.8 (Critical)
9.8 (Critical)
5.5 (Medium)
7.8 (High)
6.8 (Medium)
7.8 (High)
9.8 (Critical)
7.8 (High)
7.8 (High)
7.0 (High)
5.5 (Medium)
7.8 (High)
9.8 (Critical)
9.8 (Critical)
5.5 (Medium)
9.8 (Critical)
5.5 (Medium)
8.8 (High)
7.8 (High)
7.0 (High)
4.6 (Medium)
7.8 (High)
5.5 (Medium)
6.5 (Medium)
8.8 (High)
9.8 (Critical)
9.8 (Critical)
5.5 (Medium)
7.5 (High)
4.4 (Medium)
5.5 (Medium)
References
198 references
Acknowledgments
Siemens
{
"document": {
"acknowledgments": [
{
"organization": "Siemens",
"summary": "reporting these vulnerabilities to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code within the context of a privileged process.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Critical Manufacturing",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Do not click web links or open attachments in unsolicited email messages.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-24-074-07 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-074-07.json"
},
{
"category": "self",
"summary": "ICSA Advisory ICSA-24-074-07 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-07"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Siemens SIMATIC",
"tracking": {
"current_release_date": "2024-03-14T06:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-24-074-07",
"initial_release_date": "2024-03-14T06:00:00.000000Z",
"revision_history": [
{
"date": "2024-03-14T06:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "Initial Publication"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV2.2",
"product": {
"name": "Siemens SIMATIC RF160B (6GT2003-0FA00): \u003cV2.2",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "SIMATIC RF160B (6GT2003-0FA00)"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-14491",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "An attacker could cause a crash or potentially execute arbitrary code by sending specially crafted DNS responses to the DNSmasq process. In order to exploit this vulnerability, an attacker must be able to trigger DNS requests from the device, and must be in a privileged position to inject malicious DNS responses.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14491"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2017-18509",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18509"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-0338",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "In checkKeyIntent of AccountManagerService.java, there is a possible permission bypass. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-9 Android ID: A-123700107",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-0338"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-0417",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "summary",
"text": "In setNiNotification of GpsNetInitiatedHandler.java, there is a possible permissions bypass due to an empty mutable PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-8.1, Android-9 Android ID: A-154319182",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-0417"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-10768",
"cwe": {
"id": "CWE-440",
"name": "Expected Behavior Violation"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being \u0027force disabled\u0027 when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10768"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-11301",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "summary",
"text": "Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11301"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-14305",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds memory write flaw was found in how the Linux kernel\u0027s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14305"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-14381",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A flaw was found in the Linux kernel\u0027s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14381"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-15436",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging improper access to a certain error field.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15436"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-24587",
"cwe": {
"id": "CWE-326",
"name": "Inadequate Encryption Strength"
},
"notes": [
{
"category": "summary",
"text": "The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn\u0027t require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24587"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-25705",
"cwe": {
"id": "CWE-330",
"name": "Use of Insufficiently Random Values"
},
"notes": [
{
"category": "summary",
"text": "A flaw in ICMP packets in the Linux kernel was found to allow to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well. Kernel versions before 5.10 may be vulnerable to this issue.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25705"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-26555",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"notes": [
{
"category": "summary",
"text": "Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26555"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-26558",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "summary",
"text": "Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26558"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-29660",
"cwe": {
"id": "CWE-667",
"name": "Improper Locking"
},
"notes": [
{
"category": "summary",
"text": "A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-29660"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2020-29661",
"cwe": {
"id": "CWE-667",
"name": "Improper Locking"
},
"notes": [
{
"category": "summary",
"text": "A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-29661"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0302",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"notes": [
{
"category": "summary",
"text": "In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1 Android-9 Android-10Android ID: A-155287782",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0302"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0305",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"notes": [
{
"category": "summary",
"text": "In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10 Android ID: A-154015447",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0305"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0325",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In ih264d_parse_pslice of ih264d_parse_pslice.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-174238784",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0325"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0326",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In p2p_copy_client_info of p2p.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi direct search, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-172937525",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0326"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0327",
"cwe": {
"id": "CWE-269",
"name": "Improper Privilege Management"
},
"notes": [
{
"category": "summary",
"text": "In getContentProviderImpl of ActivityManagerService.java, there is a possible permission bypass due to non-restored binder identities. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-172935267",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0327"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0328",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "summary",
"text": "In onBatchScanReports and deliverBatchScan of GattService.java, there is a possible way to retrieve Bluetooth scan results without permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-172670415",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0328"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0329",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In several native functions called by AdvertiseManager.java, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege in the Bluetooth server with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-171400004",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0329"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0330",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In add_user_ce and remove_user_ce of storaged.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in storaged with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11 Android ID: A-170732441",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0330"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0331",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"notes": [
{
"category": "summary",
"text": "In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure default value. This could lead to local escalation of privilege and notification access with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-170731783",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0331"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0333",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"notes": [
{
"category": "summary",
"text": "In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay that obscures the phonebook permissions dialog when a Bluetooth device is connecting. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-168504491",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0333"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0334",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "summary",
"text": "In onTargetSelected of ResolverActivity.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary domains. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-163358811",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0334"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0336",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "summary",
"text": "In onReceive of BluetoothPermissionRequest.java, there is a possible permissions bypass due to a mutable PendingIntent. This could lead to local escalation of privilege that bypasses a permission check, with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-158219161",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0336"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0337",
"cwe": {
"id": "CWE-312",
"name": "Cleartext Storage of Sensitive Information"
},
"notes": [
{
"category": "summary",
"text": "In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-157474195",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0337"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0339",
"cwe": {
"id": "CWE-754",
"name": "Improper Check for Unusual or Exceptional Conditions"
},
"notes": [
{
"category": "summary",
"text": "In loadAnimation of WindowContainer.java, there is a possible way to keep displaying a malicious app while a target app is brought to the foreground. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-8.1, Android-9 Android ID: A-145728687",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0339"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0341",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "summary",
"text": "In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-171980069",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0341"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0390",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "summary",
"text": "In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to a missing permission check. This could lead to local escalation of privilege by a background user on the same device with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-174749461",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0390"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0391",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"notes": [
{
"category": "summary",
"text": "In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-172841550",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0391"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0392",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "In main of main.cpp, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-175124730",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0392"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0393",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution if an attacker can supply a malicious PAC file, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-168041375",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0393"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0394",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "In android_os_Parcel_readString8 of android_os_Parcel.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-172655291",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0394"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0396",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In Builtins::Generate_ArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-160610106",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0396"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0397",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-174052148",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0397"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0399",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-176919394References: Upstream kernel",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0399"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0400",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due to improper input validation. This could lead to incorrect reporting of location data to emergency services with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11 Android ID: A-177561690",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0400"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0429",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In pollOnce of ALooper.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-175074139",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0429"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0431",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "In avrc_msg_cback of avrc_api.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure to a paired device with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-174149901",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0431"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0433",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"notes": [
{
"category": "summary",
"text": "In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege and pairing malicious devices with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-171221090",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0433"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0434",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "In onReceive of BluetoothPermissionRequest.java, a phishing attack is possible allowing a malicious Bluetooth device to acquire permissions based on insufficient information presented to the user in the consent dialog. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-167403112",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0434"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0435",
"cwe": {
"id": "CWE-665",
"name": "Improper Initialization"
},
"notes": [
{
"category": "summary",
"text": "In avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-174150451",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0435"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0436",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out-of-bounds read due to integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-176496160",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0436"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0437",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "In setPlayPolicy of DrmPlugin.cpp, there is a possible double free. This could lead to local escalation of privilege in a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-176168330",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0437"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0438",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"notes": [
{
"category": "summary",
"text": "In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an incorrect FLAG_OBSCURED value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10 Android ID: A-152064592",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0438"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0443",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In several functions of ScreenshotHelper.java and related files, there is a possible incorrectly saved screenshot due to a race condition. This could lead to local information disclosure across user profiles with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-170474245",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0443"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0444",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "In onActivityResult of QuickContactActivity.java, there is an unnecessary return of an intent. This could lead to local information disclosure of contact data with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-178825358",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0444"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0471",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out-of-bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-176444786",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0471"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0473",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"notes": [
{
"category": "summary",
"text": "In rw_t3t_process_error of rw_t3t.cc, there is a possible double free due to uninitialized data. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-179687208",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0473"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0474",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In avrc_msg_cback of avrc_api.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-177611958",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0474"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0476",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In FindOrCreatePeer of btif_av.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-9, Android-10 Android ID: A-169252501",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0476"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0478",
"cwe": {
"id": "CWE-755",
"name": "Improper Handling of Exceptional Conditions"
},
"notes": [
{
"category": "summary",
"text": "In updateDrawable of StatusBarIconView.java, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege by running foreground services without notifying the user, with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-169255797",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0478"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0480",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "In createPendingIntent of SnoozeHelper.java, there is a possible broadcast intent containing a sensitive identifier. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-174493336",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0480"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0481",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In onActivityResult of EditUserPhotoController.java, there is a possible access of unauthorized files due to an unexpected URI handler. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-172939189",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0481"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0484",
"cwe": {
"id": "CWE-909",
"name": "Missing Initialization of Resource"
},
"notes": [
{
"category": "summary",
"text": "In readVector of IMediaPlayer.cpp, there is a possible read of uninitialized heap data due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-173720767",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0484"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0506",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"notes": [
{
"category": "summary",
"text": "In ActivityPicker.java, there is a possible bypass of user interaction in intent resolution due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-181962311",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0506"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0507",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In handle_rc_metamsg_cmd of btif_rc.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-181860042",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0507"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0508",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In various functions of DrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-176444154",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0508"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0509",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In various functions of CryptoPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-176444161",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0509"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0510",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-176444622",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0510"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0511",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In Dex2oat of dex2oat.cc, there is a possible way to inject bytecode into an app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11 Android ID: A-178055795",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0511"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0512",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-173843328References: Upstream kernel",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0512"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0513",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "summary",
"text": "In deleteNotificationChannel and related functions of NotificationManagerService.java, there is a possible permission bypass due to improper state validation. This could lead to local escalation of privilege via hidden services with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-156090809",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0513"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0514",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In several functions of the V8 library, there is a possible use after free due to a race condition. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-9, Android-11, Android-8.1 Android ID: A-162604069",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0514"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0515",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In Factory::CreateStrictFunctionMap of factory.cc, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-167389063",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0515"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0516",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In p2p_process_prov_disc_req of p2p_pd.c, there is a possible out-of-bounds read and write due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-181660448",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0516"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0519",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In BITSTREAM_FLUSH of ih264e_bitstream.h, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-176533109",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0519"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0520",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In several functions of MemoryFileSystem.cpp and related files, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-10 Android ID: A-176237595",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0520"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0521",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "summary",
"text": "In getAllPackages of PackageManagerService, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of cross-user permissions with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-174661955",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0521"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0522",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In ConnectionHandler::SdpCb of connection_handler.cc, there is a possible out-of-bounds read due to a use after free. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-9, Android-10 Android ID: A-174182139",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0522"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0584",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "In verifyBufferObject of Parcel.cpp, there is a possible out-of-bounds read due to an improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-179289794",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0584"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0585",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In beginWrite and beginRead of MessageQueueBase.h, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-184963385",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0585"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0586",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"notes": [
{
"category": "summary",
"text": "In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-182584940",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0586"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0587",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In StreamOut::prepareForWriting of StreamOut.cpp, there is a possible out-of-bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-185259758",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0587"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0588",
"cwe": {
"id": "CWE-668",
"name": "Exposure of Resource to Wrong Sphere"
},
"notes": [
{
"category": "summary",
"text": "In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9 Android ID: A-177238342",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0588"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0589",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In BTM_TryAllocateSCN of btm_scn.cc, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-180939982",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0589"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0591",
"cwe": {
"id": "CWE-610",
"name": "Externally Controlled Reference to a Resource in Another Sphere"
},
"notes": [
{
"category": "summary",
"text": "In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-179386960",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0591"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0593",
"cwe": {
"id": "CWE-610",
"name": "Externally Controlled Reference to a Resource in Another Sphere"
},
"notes": [
{
"category": "summary",
"text": "In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-179386068",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0593"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0594",
"cwe": {
"id": "CWE-74",
"name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. This could lead to remote (proximal, NFC) escalation of privilege allowing an attacker to deceive a user into allowing a Bluetooth connection with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-176445224",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0594"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0596",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-181346550",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0596"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0597",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "summary",
"text": "In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-176496502",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0597"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0598",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"notes": [
{
"category": "summary",
"text": "In onCreate of ConfirmConnectActivity.java, there is a possible pairing of untrusted Bluetooth devices due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-180422108",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0598"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0599",
"cwe": {
"id": "CWE-610",
"name": "Externally Controlled Reference to a Resource in Another Sphere"
},
"notes": [
{
"category": "summary",
"text": "In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-175614289",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0599"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0600",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In onCreate of DeviceAdminAdd.java, there is a possible way to mislead a user to activate a device admin app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-179042963",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0600"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0601",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "In encodeFrames of avc_enc_fuzzer.cpp, there is a possible out-of-bounds write due to a double free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-180643802",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0601"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0604",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible way to share private files over Bluetooth due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-179910660",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0604"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0640",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In noteAtomLogged of StatsdStats.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-187957589",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0640"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0641",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "summary",
"text": "In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifiers due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-185235454",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0641"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0642",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "summary",
"text": "In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permissions due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-185126149",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0642"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0646",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In sqlite3_str_vappendf of sqlite3.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege if the user can also inject a printf into a privileged process\u0027s SQL with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-153352319",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0646"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0650",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "In WT_InterpolateNoLoop of eas_wtengine.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-190286685",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0650"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0651",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In loadLabel of PackageItemInfo.java, there is a possible way to cause a denial of service in a device by having a long label in an app due to incorrect input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-11, Android-9, Android-10 Android ID: A-67013844",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0651"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0652",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In VectorDrawable::VectorDrawable of VectorDrawable.java, there is a possible way to introduce a memory corruption due to sharing objects that are not thread-safe. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1, Android-9, Android-10, Android-11 Android ID: A-185178568",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0652"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0653",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "summary",
"text": "In enqueueNotification of NetworkPolicyManagerService.java, there is a possible way to retrieve a trackable identifier due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-177931370",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0653"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0682",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "summary",
"text": "In sendAccessibilityEvent of NotificationManagerService.java, there is a possible disclosure of notification data due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-159624555",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0682"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0683",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "In runTraceIpcStop of ActivityManagerShellCommand.java, deletion of system files is possible due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-8.1, Android-9, Android-10 Android ID: A-185398942",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0683"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0684",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out-of-bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-179839665",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0684"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0687",
"cwe": {
"id": "CWE-834",
"name": "Excessive Iteration"
},
"notes": [
{
"category": "summary",
"text": "In ellipsize of Layout.java, there is a possible ANR due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-188913943",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0687"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0688",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-161149543",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0688"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0689",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "In RGB_to_BGR1_portable of SkSwizzler_opts.h, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-8.1, Android-9 Android ID: A-190188264",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0689"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0690",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In ih264d_mark_err_slice_skip of ih264d_parse_pslice.c, there is a possible out-of-bounds write due to heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-182152757",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0690"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0692",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "summary",
"text": "In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-11, Android-9, Android-10 Android ID: A-179289753",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0692"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0695",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In get_sock_stat of xt_qtaguid.c, there is a possible out-of-bounds read due to a use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-184018316References: Upstream kernel",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0695"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0704",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"notes": [
{
"category": "summary",
"text": "In createNoCredentialsPermissionNotification and related functions of AccountManagerService.java, there is a possible way to retrieve accounts from the device without permissions due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-179338675",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0704"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0706",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "summary",
"text": "In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: Android Versions: Android-10 Android-11Android ID: A-193444889",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0706"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0708",
"cwe": {
"id": "CWE-610",
"name": "Externally Controlled Reference to a Resource in Another Sphere"
},
"notes": [
{
"category": "summary",
"text": "In runDumpHeap of ActivityManagerShellCommand.java, deletion of system files is possible due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-183262161",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0708"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0870",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In RW_SetActivatedTagType of rw_main.cc, memory corruption is possible due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9, Android-10, Android-11, Android-8.1 Android ID: A-192472262",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0870"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0919",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "In getService of IServiceManager.cpp, there is a possible unhandled exception due to an integer overflow. This could lead to local denial of service making the lockscreen unusable with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-197336441",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0919"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0920",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-196926917References: Upstream kernel",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0920"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0926",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "summary",
"text": "In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user\u0027s consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-191053931",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0926"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0928",
"cwe": {
"id": "CWE-755",
"name": "Improper Handling of Exceptional Conditions"
},
"notes": [
{
"category": "summary",
"text": "In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-9 Android ID: A-188675581",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0928"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0929",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In ion_dma_buf_end_cpu_access and related functions of ion.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-187527909 References: Upstream kernel",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0929"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0930",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-181660091",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0930"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0931",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "In getAlias of BluetoothDevice.java, there is a possible way to create misleading permission dialogs due to missing data filtering. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-180747689",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0931"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0933",
"cwe": {
"id": "CWE-116",
"name": "Improper Encoding or Escaping of Output"
},
"notes": [
{
"category": "summary",
"text": "In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent dialog due to improper input validation. This could lead to remote escalation of privilege, confusing the user into accepting pairing of a malicious Bluetooth device, with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-172251622",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0933"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0952",
"cwe": {
"id": "CWE-311",
"name": "Missing Encryption of Sensitive Data"
},
"notes": [
{
"category": "summary",
"text": "In doCropPhoto of PhotoSelectionHandler.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure of user\u0027s contacts with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-195748381",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0952"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0953",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"notes": [
{
"category": "summary",
"text": "In setOnClickActivityIntent of SearchWidgetProvider.java, there is a possible way to access contacts and history bookmarks without permission due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-184046278",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0953"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0961",
"cwe": {
"id": "CWE-909",
"name": "Missing Initialization of Resource"
},
"notes": [
{
"category": "summary",
"text": "In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-196046570References: Upstream kernel",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0961"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0963",
"cwe": {
"id": "CWE-1021",
"name": "Improper Restriction of Rendered UI Layers or Frames"
},
"notes": [
{
"category": "summary",
"text": "In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-199754277",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0963"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0964",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"notes": [
{
"category": "summary",
"text": "In C2SoftMP3::process() of C2SoftMp3Dec.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-193363621",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0964"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0965",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "summary",
"text": "In AndroidManifest.xml of Settings, there is a possible pairing of a Bluetooth device without user\u0027s consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-194300867",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0965"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0967",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In vorbis_book_decodev_set of codebook.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-199065614",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0967"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0968",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "In osi_malloc and osi_calloc of allocator.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-197868577",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0968"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-0970",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "summary",
"text": "In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-196970023",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0970"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-1972",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "summary",
"text": "Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1972"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-1976",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice \u0026 Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1976"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-29647",
"cwe": {
"id": "CWE-909",
"name": "Missing Initialization of Resource"
},
"notes": [
{
"category": "summary",
"text": "An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure, aka CID-50535249f624.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29647"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-33909",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an out-of-bounds write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33909"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-38204",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38204"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-39621",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "summary",
"text": "In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-185126319",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39621"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-39623",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In doRead of SimpleDecodingSource.cpp, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-194105348",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39623"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-39626",
"cwe": {
"id": "CWE-610",
"name": "Externally Controlled Reference to a Resource in Another Sphere"
},
"notes": [
{
"category": "summary",
"text": "In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-194695497",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39626"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-39627",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "summary",
"text": "In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-185126549",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39627"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-39629",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In phTmlNfc_Init and phTmlNfc_CleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-9 Android ID: A-197353344",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39629"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-39633",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-150694665 References: Upstream kernel",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39633"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2021-39634",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In fs/eventpoll.c, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-204450605References: Upstream kernel",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39634"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20127",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "In ce_t4t_data_cback of ce_t4t.cc, there is a possible out-of-bounds write due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L Android ID: A-221862119",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20127"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20130",
"cwe": {
"id": "CWE-754",
"name": "Improper Check for Unusual or Exceptional Conditions"
},
"notes": [
{
"category": "summary",
"text": "In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L Android ID: A-224314979",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20130"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20227",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "In USB driver, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-216825460 References: Upstream kernel",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20227"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20229",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In bta_hf_client_handle_cind_list_item of bta_hf_client_at.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L Android ID: A-224536184",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20229"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20355",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "In get of PacProxyService.java, there is a possible system service crash due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L Android ID: A-219498290",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20355"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20411",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In avdt_msg_asmbl of avdt_msg.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-232023771",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20411"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20421",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-239630375 References: Upstream kernel",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20421"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20422",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-237540956 References: Upstream kernel",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20422"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20423",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "In rndis_set_response of rndis.c, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious USB device is attached with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-239842288 References: Upstream kernel",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20423"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20462",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In phNxpNciHal_write_unlocked of phNxpNciHal.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-230356196",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20462"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20466",
"cwe": {
"id": "CWE-1188",
"name": "Initialization of a Resource with an Insecure Default"
},
"notes": [
{
"category": "summary",
"text": "In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user\u0027s password on a secondary display due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-179725730",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20466"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20468",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "In BNEP_ConnectResp of bnep_api.cc, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-228450451",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20468"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20469",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "In avct_lcb_msg_asmbl of avct_lcb_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-230867224",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20469"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20472",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "In toLanguageTag of LocaleListCache.cpp, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-239210579",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20472"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20473",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "In toLanguageTag of LocaleListCache.cpp, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-239267173",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20473"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20476",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "summary",
"text": "In setEnabledSetting of PackageManager.java, there is a possible way to get the device into an infinite reboot loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L Android ID: A-240936919",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20476"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20483",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"notes": [
{
"category": "summary",
"text": "In several functions that parse avrc response in avrc_pars_ct.cc and related files, there are possible out-of-bounds reads due to integer overflows. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-242459126",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20483"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20498",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "In fdt_path_offset_namelen of fdt_ro.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-246465319",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20498"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
},
{
"cve": "CVE-2022-20500",
"cwe": {
"id": "CWE-755",
"name": "Improper Handling of Exceptional Conditions"
},
"notes": [
{
"category": "summary",
"text": "In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10, Android-11, Android-12, Android-12L, Android-13 Android ID: A-246540168",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20500"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens\u0027 operational guidelines for industrial security and following recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
},
{
"category": "mitigation",
"details": "Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://www.siemens.com/industrialsecurity"
},
{
"category": "mitigation",
"details": "For more information see the associated Siemens security advisory SSA-770721 in HTML and CSAF.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
]
}
]
}
OPENSUSE-SU-2024:10721-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
dnsmasq-2.86-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: dnsmasq-2.86-1.1 on GA media
Description of the patch: These are all security issues fixed in the dnsmasq-2.86-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2024-10721
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.4 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.4 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
4.3 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.4 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
4.3 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.4 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.4 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.4 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
4 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
low
References
68 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "dnsmasq-2.86-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the dnsmasq-2.86-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-10721",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10721-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-14491 page",
"url": "https://www.suse.com/security/cve/CVE-2017-14491/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-14492 page",
"url": "https://www.suse.com/security/cve/CVE-2017-14492/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-14493 page",
"url": "https://www.suse.com/security/cve/CVE-2017-14493/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-14494 page",
"url": "https://www.suse.com/security/cve/CVE-2017-14494/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-14495 page",
"url": "https://www.suse.com/security/cve/CVE-2017-14495/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-14496 page",
"url": "https://www.suse.com/security/cve/CVE-2017-14496/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15107 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15107/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-14834 page",
"url": "https://www.suse.com/security/cve/CVE-2019-14834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-25681 page",
"url": "https://www.suse.com/security/cve/CVE-2020-25681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-25683 page",
"url": "https://www.suse.com/security/cve/CVE-2020-25683/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-25684 page",
"url": "https://www.suse.com/security/cve/CVE-2020-25684/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-25685 page",
"url": "https://www.suse.com/security/cve/CVE-2020-25685/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-25686 page",
"url": "https://www.suse.com/security/cve/CVE-2020-25686/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-3448 page",
"url": "https://www.suse.com/security/cve/CVE-2021-3448/"
}
],
"title": "dnsmasq-2.86-1.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:10721-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "dnsmasq-2.86-1.1.aarch64",
"product": {
"name": "dnsmasq-2.86-1.1.aarch64",
"product_id": "dnsmasq-2.86-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "dnsmasq-utils-2.86-1.1.aarch64",
"product": {
"name": "dnsmasq-utils-2.86-1.1.aarch64",
"product_id": "dnsmasq-utils-2.86-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "dnsmasq-2.86-1.1.ppc64le",
"product": {
"name": "dnsmasq-2.86-1.1.ppc64le",
"product_id": "dnsmasq-2.86-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "dnsmasq-utils-2.86-1.1.ppc64le",
"product": {
"name": "dnsmasq-utils-2.86-1.1.ppc64le",
"product_id": "dnsmasq-utils-2.86-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "dnsmasq-2.86-1.1.s390x",
"product": {
"name": "dnsmasq-2.86-1.1.s390x",
"product_id": "dnsmasq-2.86-1.1.s390x"
}
},
{
"category": "product_version",
"name": "dnsmasq-utils-2.86-1.1.s390x",
"product": {
"name": "dnsmasq-utils-2.86-1.1.s390x",
"product_id": "dnsmasq-utils-2.86-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "dnsmasq-2.86-1.1.x86_64",
"product": {
"name": "dnsmasq-2.86-1.1.x86_64",
"product_id": "dnsmasq-2.86-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "dnsmasq-utils-2.86-1.1.x86_64",
"product": {
"name": "dnsmasq-utils-2.86-1.1.x86_64",
"product_id": "dnsmasq-utils-2.86-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-2.86-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64"
},
"product_reference": "dnsmasq-2.86-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-2.86-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le"
},
"product_reference": "dnsmasq-2.86-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-2.86-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x"
},
"product_reference": "dnsmasq-2.86-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-2.86-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64"
},
"product_reference": "dnsmasq-2.86-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-2.86-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64"
},
"product_reference": "dnsmasq-utils-2.86-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-2.86-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le"
},
"product_reference": "dnsmasq-utils-2.86-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-2.86-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x"
},
"product_reference": "dnsmasq-utils-2.86-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-2.86-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
},
"product_reference": "dnsmasq-utils-2.86-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-14491",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-14491"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-14491",
"url": "https://www.suse.com/security/cve/CVE-2017-14491"
},
{
"category": "external",
"summary": "SUSE Bug 1060354 for CVE-2017-14491",
"url": "https://bugzilla.suse.com/1060354"
},
{
"category": "external",
"summary": "SUSE Bug 1060360 for CVE-2017-14491",
"url": "https://bugzilla.suse.com/1060360"
},
{
"category": "external",
"summary": "SUSE Bug 1060361 for CVE-2017-14491",
"url": "https://bugzilla.suse.com/1060361"
},
{
"category": "external",
"summary": "SUSE Bug 1060362 for CVE-2017-14491",
"url": "https://bugzilla.suse.com/1060362"
},
{
"category": "external",
"summary": "SUSE Bug 1060364 for CVE-2017-14491",
"url": "https://bugzilla.suse.com/1060364"
},
{
"category": "external",
"summary": "SUSE Bug 1063832 for CVE-2017-14491",
"url": "https://bugzilla.suse.com/1063832"
},
{
"category": "external",
"summary": "SUSE Bug 1143944 for CVE-2017-14491",
"url": "https://bugzilla.suse.com/1143944"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-14491"
},
{
"cve": "CVE-2017-14492",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-14492"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-14492",
"url": "https://www.suse.com/security/cve/CVE-2017-14492"
},
{
"category": "external",
"summary": "SUSE Bug 1060355 for CVE-2017-14492",
"url": "https://bugzilla.suse.com/1060355"
},
{
"category": "external",
"summary": "SUSE Bug 1060360 for CVE-2017-14492",
"url": "https://bugzilla.suse.com/1060360"
},
{
"category": "external",
"summary": "SUSE Bug 1060361 for CVE-2017-14492",
"url": "https://bugzilla.suse.com/1060361"
},
{
"category": "external",
"summary": "SUSE Bug 1060362 for CVE-2017-14492",
"url": "https://bugzilla.suse.com/1060362"
},
{
"category": "external",
"summary": "SUSE Bug 1060364 for CVE-2017-14492",
"url": "https://bugzilla.suse.com/1060364"
},
{
"category": "external",
"summary": "SUSE Bug 1063832 for CVE-2017-14492",
"url": "https://bugzilla.suse.com/1063832"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-14492"
},
{
"cve": "CVE-2017-14493",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-14493"
}
],
"notes": [
{
"category": "general",
"text": "Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-14493",
"url": "https://www.suse.com/security/cve/CVE-2017-14493"
},
{
"category": "external",
"summary": "SUSE Bug 1060360 for CVE-2017-14493",
"url": "https://bugzilla.suse.com/1060360"
},
{
"category": "external",
"summary": "SUSE Bug 1060361 for CVE-2017-14493",
"url": "https://bugzilla.suse.com/1060361"
},
{
"category": "external",
"summary": "SUSE Bug 1060362 for CVE-2017-14493",
"url": "https://bugzilla.suse.com/1060362"
},
{
"category": "external",
"summary": "SUSE Bug 1060364 for CVE-2017-14493",
"url": "https://bugzilla.suse.com/1060364"
},
{
"category": "external",
"summary": "SUSE Bug 1063832 for CVE-2017-14493",
"url": "https://bugzilla.suse.com/1063832"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-14493"
},
{
"cve": "CVE-2017-14494",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-14494"
}
],
"notes": [
{
"category": "general",
"text": "dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-14494",
"url": "https://www.suse.com/security/cve/CVE-2017-14494"
},
{
"category": "external",
"summary": "SUSE Bug 1060360 for CVE-2017-14494",
"url": "https://bugzilla.suse.com/1060360"
},
{
"category": "external",
"summary": "SUSE Bug 1060361 for CVE-2017-14494",
"url": "https://bugzilla.suse.com/1060361"
},
{
"category": "external",
"summary": "SUSE Bug 1060362 for CVE-2017-14494",
"url": "https://bugzilla.suse.com/1060362"
},
{
"category": "external",
"summary": "SUSE Bug 1060364 for CVE-2017-14494",
"url": "https://bugzilla.suse.com/1060364"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-14494"
},
{
"cve": "CVE-2017-14495",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-14495"
}
],
"notes": [
{
"category": "general",
"text": "Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-14495",
"url": "https://www.suse.com/security/cve/CVE-2017-14495"
},
{
"category": "external",
"summary": "SUSE Bug 1060360 for CVE-2017-14495",
"url": "https://bugzilla.suse.com/1060360"
},
{
"category": "external",
"summary": "SUSE Bug 1060361 for CVE-2017-14495",
"url": "https://bugzilla.suse.com/1060361"
},
{
"category": "external",
"summary": "SUSE Bug 1060362 for CVE-2017-14495",
"url": "https://bugzilla.suse.com/1060362"
},
{
"category": "external",
"summary": "SUSE Bug 1060364 for CVE-2017-14495",
"url": "https://bugzilla.suse.com/1060364"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-14495"
},
{
"cve": "CVE-2017-14496",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-14496"
}
],
"notes": [
{
"category": "general",
"text": "Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service via a crafted DNS request.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-14496",
"url": "https://www.suse.com/security/cve/CVE-2017-14496"
},
{
"category": "external",
"summary": "SUSE Bug 1060360 for CVE-2017-14496",
"url": "https://bugzilla.suse.com/1060360"
},
{
"category": "external",
"summary": "SUSE Bug 1060361 for CVE-2017-14496",
"url": "https://bugzilla.suse.com/1060361"
},
{
"category": "external",
"summary": "SUSE Bug 1060362 for CVE-2017-14496",
"url": "https://bugzilla.suse.com/1060362"
},
{
"category": "external",
"summary": "SUSE Bug 1060364 for CVE-2017-14496",
"url": "https://bugzilla.suse.com/1060364"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-14496"
},
{
"cve": "CVE-2017-15107",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15107"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15107",
"url": "https://www.suse.com/security/cve/CVE-2017-15107"
},
{
"category": "external",
"summary": "SUSE Bug 1076958 for CVE-2017-15107",
"url": "https://bugzilla.suse.com/1076958"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-15107"
},
{
"cve": "CVE-2019-14834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-14834"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via vectors involving DHCP response creation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-14834",
"url": "https://www.suse.com/security/cve/CVE-2019-14834"
},
{
"category": "external",
"summary": "SUSE Bug 1154849 for CVE-2019-14834",
"url": "https://bugzilla.suse.com/1154849"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-14834"
},
{
"cve": "CVE-2020-25681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-25681"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-25681",
"url": "https://www.suse.com/security/cve/CVE-2020-25681"
},
{
"category": "external",
"summary": "SUSE Bug 1177077 for CVE-2020-25681",
"url": "https://bugzilla.suse.com/1177077"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-25681"
},
{
"cve": "CVE-2020-25683",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-25683"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-25683",
"url": "https://www.suse.com/security/cve/CVE-2020-25683"
},
{
"category": "external",
"summary": "SUSE Bug 1177077 for CVE-2020-25683",
"url": "https://bugzilla.suse.com/1177077"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-25683"
},
{
"cve": "CVE-2020-25684",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-25684"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query\u0027s attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-25684",
"url": "https://www.suse.com/security/cve/CVE-2020-25684"
},
{
"category": "external",
"summary": "SUSE Bug 1177077 for CVE-2020-25684",
"url": "https://bugzilla.suse.com/1177077"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-25684"
},
{
"cve": "CVE-2020-25685",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-25685"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-25685",
"url": "https://www.suse.com/security/cve/CVE-2020-25685"
},
{
"category": "external",
"summary": "SUSE Bug 1177077 for CVE-2020-25685",
"url": "https://bugzilla.suse.com/1177077"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-25685"
},
{
"cve": "CVE-2020-25686",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-25686"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the \"Birthday Attacks\" section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-25686",
"url": "https://www.suse.com/security/cve/CVE-2020-25686"
},
{
"category": "external",
"summary": "SUSE Bug 1177077 for CVE-2020-25686",
"url": "https://bugzilla.suse.com/1177077"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-25686"
},
{
"cve": "CVE-2021-3448",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-3448"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-3448",
"url": "https://www.suse.com/security/cve/CVE-2021-3448"
},
{
"category": "external",
"summary": "SUSE Bug 1183709 for CVE-2021-3448",
"url": "https://bugzilla.suse.com/1183709"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-2.86-1.1.x86_64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.aarch64",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.ppc64le",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.s390x",
"openSUSE Tumbleweed:dnsmasq-utils-2.86-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2021-3448"
}
]
}
RHSA-2017:2836
Vulnerability from csaf_redhat - Published: 2017-10-02 17:18 - Updated: 2026-05-13 01:20Summary
Red Hat Security Advisory: dnsmasq security update
Severity
Critical
Notes
Topic: An update for dnsmasq is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.
Security Fix(es):
* A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. (CVE-2017-14491)
* A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement (RA) handling code. An attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. This issue only affected configurations using one of these options: enable-ra, ra-only, slaac, ra-names, ra-advrouter, or ra-stateless. (CVE-2017-14492)
* A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute arbitrary code. (CVE-2017-14493)
* An information leak was found in dnsmasq in the DHCPv6 relay code. An attacker on the local network could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory, potentially leaking sensitive data. (CVE-2017-14494)
* A memory exhaustion flaw was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets which would trigger memory allocations which would never be freed, leading to unbounded memory consumption and eventually a crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet. (CVE-2017-14495)
* An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet. (CVE-2017-14496)
Red Hat would like to thank Felix Wilhelm (Google Security Team), Fermin J. Serna (Google Security Team), Gabriel Campana (Google Security Team), Kevin Hamacher (Google Security Team), and Ron Bowes (Google Security Team) for reporting these issues.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code.
9.8 (Critical)
Affected products
Fixed
120 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Critical
A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement (RA) handling code. An attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. This issue only affected configurations using one of these options: enable-ra, ra-only, slaac, ra-names, ra-advrouter, or ra-stateless.
8.8 (High)
Affected products
Fixed
120 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Critical
A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute arbitrary code.
8.8 (High)
Affected products
Fixed
120 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Critical
An information leak was found in dnsmasq in the DHCPv6 relay code. An attacker on the local network could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory, potentially leaking sensitive data.
6.5 (Medium)
Affected products
Fixed
120 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A memory exhaustion flaw was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets which would trigger memory allocations which would never be freed, leading to unbounded memory consumption and eventually a crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet.
7.5 (High)
Affected products
Fixed
120 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet.
7.5 (High)
Affected products
Fixed
120 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
36 references
Acknowledgments
Google Security Team
Felix Wilhelm
Fermin J. Serna
Gabriel Campana
Kevin Hamacher
Ron Bowes
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for dnsmasq is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.\n\nSecurity Fix(es):\n\n* A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. (CVE-2017-14491)\n\n* A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement (RA) handling code. An attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. This issue only affected configurations using one of these options: enable-ra, ra-only, slaac, ra-names, ra-advrouter, or ra-stateless. (CVE-2017-14492)\n\n* A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute arbitrary code. (CVE-2017-14493)\n\n* An information leak was found in dnsmasq in the DHCPv6 relay code. An attacker on the local network could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory, potentially leaking sensitive data. (CVE-2017-14494)\n\n* A memory exhaustion flaw was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets which would trigger memory allocations which would never be freed, leading to unbounded memory consumption and eventually a crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet. (CVE-2017-14495)\n\n* An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet. (CVE-2017-14496)\n\nRed Hat would like to thank Felix Wilhelm (Google Security Team), Fermin J. Serna (Google Security Team), Gabriel Campana (Google Security Team), Kevin Hamacher (Google Security Team), and Ron Bowes (Google Security Team) for reporting these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2017:2836",
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/vulnerabilities/3199382",
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"category": "external",
"summary": "1495409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1495409"
},
{
"category": "external",
"summary": "1495410",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1495410"
},
{
"category": "external",
"summary": "1495411",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1495411"
},
{
"category": "external",
"summary": "1495412",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1495412"
},
{
"category": "external",
"summary": "1495415",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1495415"
},
{
"category": "external",
"summary": "1495416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1495416"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2836.json"
}
],
"title": "Red Hat Security Advisory: dnsmasq security update",
"tracking": {
"current_release_date": "2026-05-13T01:20:21+00:00",
"generator": {
"date": "2026-05-13T01:20:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.9"
}
},
"id": "RHSA-2017:2836",
"initial_release_date": "2017-10-02T17:18:46+00:00",
"revision_history": [
{
"date": "2017-10-02T17:18:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2017-10-02T17:18:46+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-13T01:20:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "dnsmasq-0:2.76-2.el7_4.2.x86_64",
"product": {
"name": "dnsmasq-0:2.76-2.el7_4.2.x86_64",
"product_id": "dnsmasq-0:2.76-2.el7_4.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq@2.76-2.el7_4.2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"product": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"product_id": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq-debuginfo@2.76-2.el7_4.2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"product": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"product_id": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq-utils@2.76-2.el7_4.2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "dnsmasq-0:2.76-2.el7_4.2.src",
"product": {
"name": "dnsmasq-0:2.76-2.el7_4.2.src",
"product_id": "dnsmasq-0:2.76-2.el7_4.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq@2.76-2.el7_4.2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"product": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"product_id": "dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq@2.76-2.el7_4.2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"product": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"product_id": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq-debuginfo@2.76-2.el7_4.2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"product": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"product_id": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq-utils@2.76-2.el7_4.2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64",
"product": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64",
"product_id": "dnsmasq-0:2.76-2.el7_4.2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq@2.76-2.el7_4.2?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"product": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"product_id": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq-debuginfo@2.76-2.el7_4.2?arch=ppc64"
}
}
},
{
"category": "product_version",
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"product": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"product_id": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq-utils@2.76-2.el7_4.2?arch=ppc64"
}
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "dnsmasq-0:2.76-2.el7_4.2.s390x",
"product": {
"name": "dnsmasq-0:2.76-2.el7_4.2.s390x",
"product_id": "dnsmasq-0:2.76-2.el7_4.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq@2.76-2.el7_4.2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"product": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"product_id": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq-debuginfo@2.76-2.el7_4.2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"product": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"product_id": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq-utils@2.76-2.el7_4.2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"product": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"product_id": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq-utils@2.76-2.el7_4.2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"product": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"product_id": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/dnsmasq-debuginfo@2.76-2.el7_4.2?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.src as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.src",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Client-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.src",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Client-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.src",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7ComputeNode-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.src",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7ComputeNode-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.src",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.src",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Server-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.src",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Workstation-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.src",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
},
"product_reference": "dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"relates_to_product_reference": "7Workstation-optional-7.4.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Felix Wilhelm",
"Fermin J. Serna",
"Gabriel Campana",
"Kevin Hamacher",
"Ron Bowes"
],
"organization": "Google Security Team"
}
],
"cve": "CVE-2017-14491",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2017-09-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1495409"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dnsmasq: heap overflow in the code responsible for building DNS replies",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform includes the dnsmasq-utils RPM which does not contain this flaw\u0027s affected code-paths; Red Hat OpenStack Platform is therefore listed as not affected.\n\nHowever, because all versions of Red Hat OpenStack Platform are based on Red Hat Enterprise Linux, all Red Hat OpenStack Platform users should absolutely upgrade the dnsmasq RPM from Red Hat Enterprise Linux as a matter of urgency using standard update mechanisms (such as \u0027yum update\u0027 or \u0027openstack overcloud update\u0027).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-14491"
},
{
"category": "external",
"summary": "RHBZ#1495409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1495409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-14491",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14491"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-14491",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14491"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/vulnerabilities/3199382",
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"category": "external",
"summary": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html",
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
}
],
"release_date": "2017-10-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-10-02T17:18:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "dnsmasq: heap overflow in the code responsible for building DNS replies"
},
{
"acknowledgments": [
{
"names": [
"Felix Wilhelm",
"Fermin J. Serna",
"Gabriel Campana",
"Kevin Hamacher",
"Ron Bowes"
],
"organization": "Google Security Team"
}
],
"cve": "CVE-2017-14492",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2017-09-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1495410"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement (RA) handling code. An attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. This issue only affected configurations using one of these options: enable-ra, ra-only, slaac, ra-names, ra-advrouter, or ra-stateless.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dnsmasq: heap overflow in the IPv6 router advertisement code",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform includes the dnsmasq-utils RPM which does not contain this flaw\u0027s affected code-paths; Red Hat OpenStack Platform is therefore listed as not affected.\n\nHowever, because all versions of Red Hat OpenStack Platform are based on Red Hat Enterprise Linux, all Red Hat OpenStack Platform users should absolutely upgrade the dnsmasq RPM from Red Hat Enterprise Linux as a matter of urgency using standard update mechanisms (such as \u0027yum update\u0027 or \u0027openstack overcloud update\u0027).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-14492"
},
{
"category": "external",
"summary": "RHBZ#1495410",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1495410"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-14492",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-14492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14492"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/vulnerabilities/3199382",
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"category": "external",
"summary": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html",
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
}
],
"release_date": "2017-10-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-10-02T17:18:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "dnsmasq: heap overflow in the IPv6 router advertisement code"
},
{
"acknowledgments": [
{
"names": [
"Felix Wilhelm",
"Fermin J. Serna",
"Gabriel Campana",
"Kevin Hamacher",
"Ron Bowes"
],
"organization": "Google Security Team"
}
],
"cve": "CVE-2017-14493",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2017-09-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1495411"
}
],
"notes": [
{
"category": "description",
"text": "A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dnsmasq: stack buffer overflow in the DHCPv6 code",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform includes the dnsmasq-utils RPM which does not contain this flaw\u0027s affected code-paths; Red Hat OpenStack Platform is therefore listed as not affected.\n\nHowever, because all versions of Red Hat OpenStack Platform are based on Red Hat Enterprise Linux, all Red Hat OpenStack Platform users should absolutely upgrade the dnsmasq RPM from Red Hat Enterprise Linux as a matter of urgency using standard update mechanisms (such as \u0027yum update\u0027 or \u0027openstack overcloud update\u0027).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-14493"
},
{
"category": "external",
"summary": "RHBZ#1495411",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1495411"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-14493",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14493"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-14493",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14493"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/vulnerabilities/3199382",
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"category": "external",
"summary": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html",
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
}
],
"release_date": "2017-10-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-10-02T17:18:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "dnsmasq: stack buffer overflow in the DHCPv6 code"
},
{
"acknowledgments": [
{
"names": [
"Felix Wilhelm",
"Fermin J. Serna",
"Gabriel Campana",
"Kevin Hamacher",
"Ron Bowes"
],
"organization": "Google Security Team"
}
],
"cve": "CVE-2017-14494",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-09-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1495412"
}
],
"notes": [
{
"category": "description",
"text": "An information leak was found in dnsmasq in the DHCPv6 relay code. An attacker on the local network could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory, potentially leaking sensitive data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dnsmasq: information leak in the DHCPv6 relay code",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform includes the dnsmasq-utils RPM which does not contain this flaw\u0027s affected code-paths; Red Hat OpenStack Platform is therefore listed as not affected.\n\nHowever, because all versions of Red Hat OpenStack Platform are based on Red Hat Enterprise Linux, all Red Hat OpenStack Platform users should absolutely upgrade the dnsmasq RPM from Red Hat Enterprise Linux as a matter of urgency using standard update mechanisms (such as \u0027yum update\u0027 or \u0027openstack overcloud update\u0027).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-14494"
},
{
"category": "external",
"summary": "RHBZ#1495412",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1495412"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-14494",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-14494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/vulnerabilities/3199382",
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"category": "external",
"summary": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html",
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
}
],
"release_date": "2017-10-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-10-02T17:18:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dnsmasq: information leak in the DHCPv6 relay code"
},
{
"acknowledgments": [
{
"names": [
"Felix Wilhelm",
"Fermin J. Serna",
"Gabriel Campana",
"Kevin Hamacher",
"Ron Bowes"
],
"organization": "Google Security Team"
}
],
"cve": "CVE-2017-14495",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2017-09-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1495415"
}
],
"notes": [
{
"category": "description",
"text": "A memory exhaustion flaw was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets which would trigger memory allocations which would never be freed, leading to unbounded memory consumption and eventually a crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dnsmasq: memory exhaustion vulnerability in the EDNS0 code",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform includes the dnsmasq-utils RPM which does not contain this flaw\u0027s affected code-paths; Red Hat OpenStack Platform is therefore listed as not affected.\n\nHowever, because all versions of Red Hat OpenStack Platform are based on Red Hat Enterprise Linux, all Red Hat OpenStack Platform users should absolutely upgrade the dnsmasq RPM from Red Hat Enterprise Linux as a matter of urgency using standard update mechanisms (such as \u0027yum update\u0027 or \u0027openstack overcloud update\u0027).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-14495"
},
{
"category": "external",
"summary": "RHBZ#1495415",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1495415"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-14495",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14495"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-14495",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14495"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/vulnerabilities/3199382",
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"category": "external",
"summary": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html",
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
}
],
"release_date": "2017-10-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-10-02T17:18:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dnsmasq: memory exhaustion vulnerability in the EDNS0 code"
},
{
"acknowledgments": [
{
"names": [
"Felix Wilhelm",
"Fermin J. Serna",
"Gabriel Campana",
"Kevin Hamacher",
"Ron Bowes"
],
"organization": "Google Security Team"
}
],
"cve": "CVE-2017-14496",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2017-09-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1495416"
}
],
"notes": [
{
"category": "description",
"text": "An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dnsmasq: integer underflow leading to buffer over-read in the EDNS0 code",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat OpenStack Platform includes the dnsmasq-utils RPM which does not contain this flaw\u0027s affected code-paths; Red Hat OpenStack Platform is therefore listed as not affected.\n\nHowever, because all versions of Red Hat OpenStack Platform are based on Red Hat Enterprise Linux, all Red Hat OpenStack Platform users should absolutely upgrade the dnsmasq RPM from Red Hat Enterprise Linux as a matter of urgency using standard update mechanisms (such as \u0027yum update\u0027 or \u0027openstack overcloud update\u0027).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-14496"
},
{
"category": "external",
"summary": "RHBZ#1495416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1495416"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-14496",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-14496"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-14496",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14496"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/vulnerabilities/3199382",
"url": "https://access.redhat.com/security/vulnerabilities/3199382"
},
{
"category": "external",
"summary": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html",
"url": "https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html"
}
],
"release_date": "2017-10-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2017-10-02T17:18:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2017:2836"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Client-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Client-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7ComputeNode-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7ComputeNode-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Server-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Server-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.src",
"7Workstation-optional-7.4.Z:dnsmasq-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-debuginfo-0:2.76-2.el7_4.2.x86_64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.aarch64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.ppc64le",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.s390x",
"7Workstation-optional-7.4.Z:dnsmasq-utils-0:2.76-2.el7_4.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dnsmasq: integer underflow leading to buffer over-read in the EDNS0 code"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…