[SECURITY] [DLA 3567-1] c-ares security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3567-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Anton Gladky
September 15, 2023 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : c-ares
Version : 1.14.0-1+deb10u4
CVE ID : CVE-2020-22217
A vulnerability has been identified in c-ares, an asynchronous name
resolver library:
CVE-2020-22217:
A buffer overflow vulnerability has been found in c-ares before
via the function ares_parse_soa_reply in ares_parse_soa_reply.c.
This vulnerability was discovered through fuzzing. Exploitation
of this vulnerability may allow an attacker to execute arbitrary
code or cause a denial of service condition.
For Debian 10 buster, this problem has been fixed in version
1.14.0-1+deb10u4.
We recommend that you upgrade your c-ares packages.
For the detailed security status of c-ares please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/c-ares
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEu71F6oGKuG/2fnKF0+Fzg8+n/wYFAmUD/DoACgkQ0+Fzg8+n
/wZ4lw/9FgVXE7CvEKIGfSFXX4D/ayOVUUJ21pha8cI78qWvO2Lfxhc1MBN94eMX
RLrt6KcLFfLkxSBq6KhHSOZ1ZuKZ56wN4OzsuvzClquTL1BZ63TfnDPCs1StkuTs
PCNvmDdObRMXAEOjzYBwC61Zr89kYnijubupdVeCIG7L2+lfbjlWcxeGEu05C/9i
HSD4WBo+RCtWhZd3LtDoHWn1kS6DhX+fHTrO22jE/+rL8i6Tc2foTcDzcAInLGG1
J5DqXfzLSQLk6pjH1eDGrrNN2ANL7HIY8UexUBKKJTAdSgcZ5qXLwhB1ymZRvw8R
tvbuk0g8B7lNCoSDIU4HSUiZBfm4Pi8i1GFMZSqPG8cqWqpSbPYO6ZfAVM8PWt1i
Xxf2tpiE8LmNf0KyI5epXSFugIeFtAkpQBiBc9OGRTH6CybUfpGf8e4rvdZzGPFR
yS9be+d5/SlG++Jq3JT/Iw56kSAicHJenZtlIND0LWJ9TBxhRD80fQ6JtwEn0C++
Ko848oTzGya61kKajAFqv4wUXu9pheO1ZWDUgmPTqniHHKo9EeK7rn2SYqRmZVEH
wbckwLC924JItis9YLuuNc+jE4VO1oDWbwMBGb2iChx4476YwQHkzYFvQdwCzmv3
JUR0zZSzh9/pqH92BttZx/+uWVMBc+ZIbvOKgTEPXxjaAx7ZuPo=
=V+cN
-----END PGP SIGNATURE-----
Reply to: