| Package | Affected versions | Patched versions |
|---|---|---|
| c-ares | = 1.10.0= 1.12.0= 1.8.0= 1.9.0= 1.9.1 | |
| c-ares | = 1.11.0 | |
| node.js | ≥ 4.0.0, ≤ 4.1.2≥ 4.2.0, < 4.8.4≥ 5.0.0, ≤ 5.12.0≥ 6.0.0, ≤ 6.8.1≥ 6.9.0, < 6.11.1≥ 7.0.0, < 7.10.1≥ 8.0.0, < 8.1.4 | 4.8.46.11.17.10.18.1.4 |
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free