Summary
It was discovered that c-ares incorrectly handled certain sortlist strings.
A remote attacker could use this issue to cause c-ares to crash, resulting
in a denial of service, or possibly execute arbitrary code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | c-ares | 1.14.0-1ubuntu0.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | c-ares | 1.15.0-1ubuntu0.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | c-ares | 1.18.1-1ubuntu0.22.04.1 |
Vulnerabilities 1
-
High 8.6
A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,…
References
-
report
https://ubuntu.com/security/CVE-2022-4904