VDB

CVE-2017-13704

CVE-2017-13704 REJECTED CVSS 7.5 HIGH

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.

EPSS 65.41% · 99.2th percentile

Risk Scores

CVSS 3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
65.41%
99.2th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSdnsmasq2.66-4ubuntu1, 2.67-1, 2.68-1
Ubuntu:16.04:LTSdnsmasq2.75-1ubuntu0.16.04.1, 0, 2.75-1

Timeline

  • Aug 28, 2017 CVE Published
  • Oct 2, 2017 PoC Published
  • Oct 13, 2020 CVE Updated
  • Apr 14, 2021 EPSS Score
  • Aug 25, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Feb 4, 2022 EPSS Score
  • May 3, 2022 EPSS Score
  • Jul 5, 2022 EPSS Score
  • Nov 8, 2022 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Apr 4, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›