Royce M

A heap buffer overflow exists in the DNS cache when processing DNS responses. The `extract name()` function can be abused because the software expands certain characters into longer escape sequences without ensuring the cache buffer is sized to hold the expanded result. Specifically, an unsafe `strcpy()` in the `really insert()` function within `src/cache.c` copies attacker-controlled name strings without bounds validation, overflowing a 1,025-byte bigname cache buffer. An attacker can exploit this by using a malicious upstream DNS server and crafted CNAME chains to corrupt memory, potentially leading to remote code execution, DNS cache poisoning to redirect lookups to attacker-controlled IP addresses, or a denial of service (DoS).

A Denial of Service (DoS) issue in the DNSSEC validation of dnsmasq allows remote attackers to cause a service disruption by sending a crafted DNS packet.

A heap-based out-of-bounds read in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service by sending a crafted DNS packet. A heap-based out-of-bounds read occurs when a program reads data past the end of the allocated memory on the heap, which can lead to crashes or information disclosure.

A heap-based out-of-bounds write in the DHCPv6 implementation allows local attackers to execute arbitrary code with root privileges by sending a crafted DHCPv6 packet. A heap-based out-of-bounds write occurs when a program writes data past the end of a memory buffer allocated on the heap, which can lead to memory corruption.

An information disclosure issue allows remote attackers to bypass source checks by using a crafted DNS packet containing RFC 7871 client subnet information.