CVE-2017-9108

HIGH

adns < 1.5.2 - Buffer Overflow via Missing Final Newline Handling

Title source: llm
STIX 2.1

Description

An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.

Scores

CVSS v3 7.5
EPSS 0.0056
EPSS Percentile 68.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-119
Status published
Products (4)
fedoraproject/fedora 31
fedoraproject/fedora 32
gnu/adns < 1.5.2
opensuse/leap 15.1
Published Jun 18, 2020
Tracked Since Feb 18, 2026