Description
In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 when processing a DNSSL option, rtsold(8) decodes domain name labels per an encoding specified in RFC 1035 in which the first octet of each label contains the label's length. rtsold(8) did not validate label lengths correctly and could overflow the destination buffer.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:32.rtsold.asc
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210423-0004/
Scores
CVSS v3
9.8
EPSS
0.0048
EPSS Percentile
65.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-120
Status
published
Products (4)
freebsd/freebsd
11.3 (14 CPE variants)
freebsd/freebsd
11.4 (4 CPE variants)
freebsd/freebsd
12.1 (10 CPE variants)
freebsd/freebsd
12.2
Published
Mar 29, 2021
Tracked Since
Feb 18, 2026