Summary
Evgeny Vereshchagin discovered that Avahi contained several reachable
assertions, which could lead to intentional assertion failures when
specially crafted user input was given. An attacker could possibly use
this issue to cause a denial of service. (CVE-2023-38469, CVE-2023-38470,
CVE-2023-38471, CVE-2023-38472, CVE-2023-38473)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | avahi | 0.7-4ubuntu7.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | avahi | 0.8-5ubuntu5.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | avahi | 0.6.31-4ubuntu1.3+esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | avahi | 0.6.32~rc+dfsg-1ubuntu2.3+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | avahi | 0.7-3.1ubuntu1.3+esm2 |
Vulnerabilities 5
-
Medium 6.2
Reachable assertion in avahi_dns_packet_append_record
A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
-
Medium 6.2
Reachable assertion in avahi_escape_label
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
-
Medium 6.2
Reachable assertion in dbus_set_host_name
A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
-
Medium 6.2
Reachable assertion in avahi_rdata_parse
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
-
Medium 6.2
Reachable assertion in avahi_alternative_host_name
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.