CVE-2016-5180

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-5180
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2017-0002.html
http://www.debian.org/security/2016/dsa-3682
http://www.securityfocus.com/bid/93243
http://www.ubuntu.com/usn/USN-3143-1
https://c-ares.haxx.se/CVE-2016-5180.patch
https://c-ares.haxx.se/adv_20160929.html
https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html
https://security.gentoo.org/glsa/201701-28
https://source.android.com/security/bulletin/2017-01-01.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:c-ares:c-ares:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.2:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.3:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.4:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.5:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.9.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.11.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*
History

07 Nov 2023, 02:33

Type Values Removed Values Added
References (GENTOO) https://security.gentoo.org/glsa/201701-28 - Third Party Advisory () https://security.gentoo.org/glsa/201701-28 -
References (CONFIRM) https://c-ares.haxx.se/CVE-2016-5180.patch - Patch, Third Party Advisory () https://c-ares.haxx.se/CVE-2016-5180.patch -
References (BID) http://www.securityfocus.com/bid/93243 - Broken Link, Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/93243 -
References (CONFIRM) https://c-ares.haxx.se/adv_20160929.html - Vendor Advisory () https://c-ares.haxx.se/adv_20160929.html -
References (CONFIRM) https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html - Third Party Advisory () https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html -
References (DEBIAN) http://www.debian.org/security/2016/dsa-3682 - Third Party Advisory () http://www.debian.org/security/2016/dsa-3682 -
References (CONFIRM) https://source.android.com/security/bulletin/2017-01-01.html - Third Party Advisory () https://source.android.com/security/bulletin/2017-01-01.html -
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2017-0002.html - Third Party Advisory () http://rhn.redhat.com/errata/RHSA-2017-0002.html -
References (UBUNTU) http://www.ubuntu.com/usn/USN-3143-1 - Third Party Advisory () http://www.ubuntu.com/usn/USN-3143-1 -

15 Sep 2023, 11:42

Type Values Removed Values Added
First Time C-ares c-ares
C-ares
CPE cpe:2.3:a:c-ares_project:c-ares:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.7.4:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.7.5:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.9.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.7.2:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.7.3:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares_project:c-ares:1.7.1:*:*:*:*:*:*:*		 cpe:2.3:a:c-ares:c-ares:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.2:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.9.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.3:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.5:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.4:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:c-ares:c-ares:1.3.1:*:*:*:*:*:*:*

16 Aug 2022, 13:17

Type Values Removed Values Added
References (CONFIRM) https://c-ares.haxx.se/CVE-2016-5180.patch - Patch (CONFIRM) https://c-ares.haxx.se/CVE-2016-5180.patch - Patch, Third Party Advisory
References (BID) http://www.securityfocus.com/bid/93243 - Broken Link (BID) http://www.securityfocus.com/bid/93243 - Broken Link, Third Party Advisory, VDB Entry
References (CONFIRM) https://source.android.com/security/bulletin/2017-01-01.html - (CONFIRM) https://source.android.com/security/bulletin/2017-01-01.html - Third Party Advisory
References (UBUNTU) http://www.ubuntu.com/usn/USN-3143-1 - (UBUNTU) http://www.ubuntu.com/usn/USN-3143-1 - Third Party Advisory
References (GENTOO) https://security.gentoo.org/glsa/201701-28 - (GENTOO) https://security.gentoo.org/glsa/201701-28 - Third Party Advisory
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2017-0002.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2017-0002.html - Third Party Advisory
First Time Nodejs
Canonical
Nodejs node.js
Canonical ubuntu Linux
CPE cpe:2.3:o:canonical:ubuntu_linux:16.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Information

Published : 2016-10-03 15:59

Updated : 2023-12-10 11:46

NVD link : CVE-2016-5180

Mitre link : CVE-2016-5180

CVE.ORG link : CVE-2016-5180

JSON object : View

Products Affected

c-ares_project

  • c-ares

nodejs

  • node.js

c-ares

  • c-ares

debian

  • debian_linux

canonical

  • ubuntu_linux
CWE
CWE-787

Out-of-bounds Write