CVE - CVE-2015-3294

CVE-ID
CVE-2015-3294	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:74452 URL:http://www.securityfocus.com/bid/74452 BUGTRAQ:20150423 Dnsmasq 2.72 Unchecked returned value URL:http://www.securityfocus.com/archive/1/535354/100/1100/threaded CONFIRM:http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=ad4a8ff7d9097008d7623df8543df435bfddeac8 CONFIRM:http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html DEBIAN:DSA-3251 URL:http://www.debian.org/security/2015/dsa-3251 GENTOO:GLSA-201512-01 URL:https://security.gentoo.org/glsa/201512-01 MLIST:[Dnsmasq-discuss] 20150407 dnsmsaq potential vulnerability URL:http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html MLIST:[Dnsmasq-discuss] 20150407 dnsmsaq potential vulnerability URL:http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009387.html SECTRACK:1032195 URL:http://www.securitytracker.com/id/1032195 SUSE:openSUSE-SU-2015:0857 URL:http://lists.opensuse.org/opensuse-updates/2015-05/msg00013.html UBUNTU:USN-2593-1 URL:http://www.ubuntu.com/usn/USN-2593-1
Assigning CNA
MITRE Corporation
Date Record Created
20150410	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20150410)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)