Hugo Martinez

**Name of the Vulnerable Software and Affected Versions** dnsmasq (affected versions not specified) **Description** A buffer overflow in the `extract addresses()` function allows an attacker to trigger a heap out-of-bounds read and cause a crash. This occurs when a malformed DNS response is processed, enabling the `extract name()` function to advance the pointer beyond the end of the record. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dnsmasq versions 2.73 through 2.92 **Description** A heap buffer overflow exists in the DNS cache when processing DNS responses. The `extract name()` function can be abused because the software expands certain characters into longer escape sequences without ensuring the cache buffer is sized to hold the expanded result. Specifically, an unsafe `strcpy()` in the `really insert()` function within `src/cache.c` copies attacker-controlled name strings without bounds validation, overflowing a 1,025-byte bigname cache buffer. An attacker can exploit this by using a malicious upstream DNS server and crafted CNAME chains to corrupt memory, potentially leading to remote code execution, DNS cache poisoning to redirect lookups to attacker-controlled IP addresses, or a denial of service (DoS). **Recommendations** Update dnsmasq to version 2.92rel2 or 2.93.