Vulnerability from csaf_suse
Published
2017-10-02 13:53
Modified
2017-10-02 13:53
Summary
Security update for dnsmasq

Notes

Title of the patch
Security update for dnsmasq
Description of the patch
This update for dnsmasq fixes the following issues. Remedy the following security issues: - CVE-2017-14491: 2 byte heap based overflow. [bsc#1060354] - CVE-2017-14492: heap based overflow. [bsc#1060355] - CVE-2017-14493: stack based overflow. [bsc#1060360] - CVE-2017-14494: DHCP - info leak. [bsc#1060361] - CVE-2017-14495: DNS - OOM DoS. [bsc#1060362] - CVE-2017-14496: DNS - DoS Integer underflow. [bsc#1060364] - Prevent a man-in-the-middle attack (bsc#972164, fate#321175). Furthermore, the following issues have been fixed: - Fix DHCP relaying, broken in 2.76 and 2.77. - Update to version 2.78 (fate#321175, fate#322030, bsc#1035227). - Fix PXE booting for UEFI architectures (fate#322030). - Drop PrivateDevices=yes which breaks logging (bsc#902511, bsc#904537) - Build with support for DNSSEC (fate#318323, bsc#908137). Please note that this update brings a (small) potential incompatibility in the handling of 'basename' in --pxe-service. Please read the CHANGELOG and the documentation if you are using this option.
Patchnames
SUSE-SLE-SERVER-12-2017-1616
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for dnsmasq",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for dnsmasq fixes the following issues.\n\nRemedy the following security issues:\n\n- CVE-2017-14491: 2 byte heap based overflow. [bsc#1060354]\n- CVE-2017-14492: heap based overflow. [bsc#1060355]\n- CVE-2017-14493: stack based overflow. [bsc#1060360]\n- CVE-2017-14494: DHCP - info leak. [bsc#1060361]\n- CVE-2017-14495: DNS - OOM DoS. [bsc#1060362]\n- CVE-2017-14496: DNS - DoS Integer underflow. [bsc#1060364]\n- Prevent a man-in-the-middle attack (bsc#972164, fate#321175).\n\nFurthermore, the following issues have been fixed:\n\n- Fix DHCP relaying, broken in 2.76 and 2.77.\n- Update to version 2.78 (fate#321175, fate#322030, bsc#1035227).\n- Fix PXE booting for UEFI architectures (fate#322030).\n- Drop PrivateDevices=yes which breaks logging (bsc#902511, bsc#904537)\n- Build with support for DNSSEC (fate#318323, bsc#908137).\n\nPlease note that this update brings a (small) potential incompatibility in the\nhandling of 'basename' in --pxe-service. Please read the CHANGELOG and the\ndocumentation if you are using this option.\n\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-SLE-SERVER-12-2017-1616",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_2616-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2017:2616-1",
            url: "https://www.suse.com/support/update/announcement/2017/suse-su-20172616-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2017:2616-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2017-October/003268.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1035227",
            url: "https://bugzilla.suse.com/1035227",
         },
         {
            category: "self",
            summary: "SUSE Bug 1060354",
            url: "https://bugzilla.suse.com/1060354",
         },
         {
            category: "self",
            summary: "SUSE Bug 1060355",
            url: "https://bugzilla.suse.com/1060355",
         },
         {
            category: "self",
            summary: "SUSE Bug 1060360",
            url: "https://bugzilla.suse.com/1060360",
         },
         {
            category: "self",
            summary: "SUSE Bug 1060361",
            url: "https://bugzilla.suse.com/1060361",
         },
         {
            category: "self",
            summary: "SUSE Bug 1060362",
            url: "https://bugzilla.suse.com/1060362",
         },
         {
            category: "self",
            summary: "SUSE Bug 1060364",
            url: "https://bugzilla.suse.com/1060364",
         },
         {
            category: "self",
            summary: "SUSE Bug 902511",
            url: "https://bugzilla.suse.com/902511",
         },
         {
            category: "self",
            summary: "SUSE Bug 904537",
            url: "https://bugzilla.suse.com/904537",
         },
         {
            category: "self",
            summary: "SUSE Bug 908137",
            url: "https://bugzilla.suse.com/908137",
         },
         {
            category: "self",
            summary: "SUSE Bug 972164",
            url: "https://bugzilla.suse.com/972164",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2015-3294 page",
            url: "https://www.suse.com/security/cve/CVE-2015-3294/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2015-8899 page",
            url: "https://www.suse.com/security/cve/CVE-2015-8899/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-14491 page",
            url: "https://www.suse.com/security/cve/CVE-2017-14491/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-14492 page",
            url: "https://www.suse.com/security/cve/CVE-2017-14492/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-14493 page",
            url: "https://www.suse.com/security/cve/CVE-2017-14493/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-14494 page",
            url: "https://www.suse.com/security/cve/CVE-2017-14494/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-14495 page",
            url: "https://www.suse.com/security/cve/CVE-2017-14495/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-14496 page",
            url: "https://www.suse.com/security/cve/CVE-2017-14496/",
         },
      ],
      title: "Security update for dnsmasq",
      tracking: {
         current_release_date: "2017-10-02T13:53:30Z",
         generator: {
            date: "2017-10-02T13:53:30Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2017:2616-1",
         initial_release_date: "2017-10-02T13:53:30Z",
         revision_history: [
            {
               date: "2017-10-02T13:53:30Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "dnsmasq-2.78-6.6.1.ppc64le",
                        product: {
                           name: "dnsmasq-2.78-6.6.1.ppc64le",
                           product_id: "dnsmasq-2.78-6.6.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "dnsmasq-2.78-6.6.1.s390x",
                        product: {
                           name: "dnsmasq-2.78-6.6.1.s390x",
                           product_id: "dnsmasq-2.78-6.6.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "dnsmasq-2.78-6.6.1.x86_64",
                        product: {
                           name: "dnsmasq-2.78-6.6.1.x86_64",
                           product_id: "dnsmasq-2.78-6.6.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 12-LTSS",
                        product: {
                           name: "SUSE Linux Enterprise Server 12-LTSS",
                           product_id: "SUSE Linux Enterprise Server 12-LTSS",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles-ltss:12",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "dnsmasq-2.78-6.6.1.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
            },
            product_reference: "dnsmasq-2.78-6.6.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "dnsmasq-2.78-6.6.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
            },
            product_reference: "dnsmasq-2.78-6.6.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "dnsmasq-2.78-6.6.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
               product_id: "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
            },
            product_reference: "dnsmasq-2.78-6.6.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12-LTSS",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2015-3294",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2015-3294",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2015-3294",
               url: "https://www.suse.com/security/cve/CVE-2015-3294",
            },
            {
               category: "external",
               summary: "SUSE Bug 923144 for CVE-2015-3294",
               url: "https://bugzilla.suse.com/923144",
            },
            {
               category: "external",
               summary: "SUSE Bug 928867 for CVE-2015-3294",
               url: "https://bugzilla.suse.com/928867",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-10-02T13:53:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2015-3294",
      },
      {
         cve: "CVE-2015-8899",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2015-8899",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2015-8899",
               url: "https://www.suse.com/security/cve/CVE-2015-8899",
            },
            {
               category: "external",
               summary: "SUSE Bug 983273 for CVE-2015-8899",
               url: "https://bugzilla.suse.com/983273",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-10-02T13:53:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2015-8899",
      },
      {
         cve: "CVE-2017-14491",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-14491",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-14491",
               url: "https://www.suse.com/security/cve/CVE-2017-14491",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060354 for CVE-2017-14491",
               url: "https://bugzilla.suse.com/1060354",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060360 for CVE-2017-14491",
               url: "https://bugzilla.suse.com/1060360",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060361 for CVE-2017-14491",
               url: "https://bugzilla.suse.com/1060361",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060362 for CVE-2017-14491",
               url: "https://bugzilla.suse.com/1060362",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060364 for CVE-2017-14491",
               url: "https://bugzilla.suse.com/1060364",
            },
            {
               category: "external",
               summary: "SUSE Bug 1063832 for CVE-2017-14491",
               url: "https://bugzilla.suse.com/1063832",
            },
            {
               category: "external",
               summary: "SUSE Bug 1143944 for CVE-2017-14491",
               url: "https://bugzilla.suse.com/1143944",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-10-02T13:53:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2017-14491",
      },
      {
         cve: "CVE-2017-14492",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-14492",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-14492",
               url: "https://www.suse.com/security/cve/CVE-2017-14492",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060355 for CVE-2017-14492",
               url: "https://bugzilla.suse.com/1060355",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060360 for CVE-2017-14492",
               url: "https://bugzilla.suse.com/1060360",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060361 for CVE-2017-14492",
               url: "https://bugzilla.suse.com/1060361",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060362 for CVE-2017-14492",
               url: "https://bugzilla.suse.com/1060362",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060364 for CVE-2017-14492",
               url: "https://bugzilla.suse.com/1060364",
            },
            {
               category: "external",
               summary: "SUSE Bug 1063832 for CVE-2017-14492",
               url: "https://bugzilla.suse.com/1063832",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-10-02T13:53:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2017-14492",
      },
      {
         cve: "CVE-2017-14493",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-14493",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-14493",
               url: "https://www.suse.com/security/cve/CVE-2017-14493",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060360 for CVE-2017-14493",
               url: "https://bugzilla.suse.com/1060360",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060361 for CVE-2017-14493",
               url: "https://bugzilla.suse.com/1060361",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060362 for CVE-2017-14493",
               url: "https://bugzilla.suse.com/1060362",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060364 for CVE-2017-14493",
               url: "https://bugzilla.suse.com/1060364",
            },
            {
               category: "external",
               summary: "SUSE Bug 1063832 for CVE-2017-14493",
               url: "https://bugzilla.suse.com/1063832",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-10-02T13:53:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2017-14493",
      },
      {
         cve: "CVE-2017-14494",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-14494",
            },
         ],
         notes: [
            {
               category: "general",
               text: "dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-14494",
               url: "https://www.suse.com/security/cve/CVE-2017-14494",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060360 for CVE-2017-14494",
               url: "https://bugzilla.suse.com/1060360",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060361 for CVE-2017-14494",
               url: "https://bugzilla.suse.com/1060361",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060362 for CVE-2017-14494",
               url: "https://bugzilla.suse.com/1060362",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060364 for CVE-2017-14494",
               url: "https://bugzilla.suse.com/1060364",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-10-02T13:53:30Z",
               details: "moderate",
            },
         ],
         title: "CVE-2017-14494",
      },
      {
         cve: "CVE-2017-14495",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-14495",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-14495",
               url: "https://www.suse.com/security/cve/CVE-2017-14495",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060360 for CVE-2017-14495",
               url: "https://bugzilla.suse.com/1060360",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060361 for CVE-2017-14495",
               url: "https://bugzilla.suse.com/1060361",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060362 for CVE-2017-14495",
               url: "https://bugzilla.suse.com/1060362",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060364 for CVE-2017-14495",
               url: "https://bugzilla.suse.com/1060364",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-10-02T13:53:30Z",
               details: "important",
            },
         ],
         title: "CVE-2017-14495",
      },
      {
         cve: "CVE-2017-14496",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-14496",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service via a crafted DNS request.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
               "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-14496",
               url: "https://www.suse.com/security/cve/CVE-2017-14496",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060360 for CVE-2017-14496",
               url: "https://bugzilla.suse.com/1060360",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060361 for CVE-2017-14496",
               url: "https://bugzilla.suse.com/1060361",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060362 for CVE-2017-14496",
               url: "https://bugzilla.suse.com/1060362",
            },
            {
               category: "external",
               summary: "SUSE Bug 1060364 for CVE-2017-14496",
               url: "https://bugzilla.suse.com/1060364",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.ppc64le",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.s390x",
                  "SUSE Linux Enterprise Server 12-LTSS:dnsmasq-2.78-6.6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-10-02T13:53:30Z",
               details: "important",
            },
         ],
         title: "CVE-2017-14496",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.