Description
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc
functions in the libresolv library in the GNU C Library (aka glibc or
libc6) before 2.23 allow remote attackers to cause a denial of service
(crash) or possibly execute arbitrary code via a crafted DNS response that
triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6
address family, related to performing "dual A/AAAA DNS queries" and the
libnss_dns.so.2 NSS module.
Notes
jdstrand | stable-phone-overlay will be updated in OTA 9.1
tyhicks alerted the Snappy team for an emergency update |
Package
Upstream: | needs-triage
|
Ubuntu 14.04 ESM (Trusty Tahr): | released
(2.19-0ubuntu6.7)
|
Ubuntu 16.04 LTS (Xenial Xerus): | DNE
|
Updated: 2019-12-05 18:42:56 UTC (commit dd38ff22974aae499eb50644b9d5a2817483cbdb)