Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
c-ares out of bounds read in ares__read_line()
Vulnerability Description
c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
缓冲区下溢读取
Vulnerability Title
c-ares 安全漏洞
Vulnerability Description
c-ares是c-ares个人开发者的一个用于异步 DNS 请求的 C 库。 c-ares存在安全漏洞，该漏洞源于如果配置文件中嵌入了“NULL”字符作为新行中的第一个字符，则可能会导致在给定缓冲区开始之前尝试读取内存，这可能会导致崩溃。
CVSS Information
N/A
Vulnerability Type
N/A