Description
A security flaw has been discovered in pymumu SmartDNS up to 47.1. This vulnerability affects the function _dns_decode_rr_head/_dns_decode_SVCB_HTTPS of the file src/dns.c of the component SVBC Record Parser. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The patch is identified as 2d57c4b4e1add9b4537aeb403f794a084727e1c8. Applying a patch is advised to resolve this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pymumu | SmartDNS | 47.0, 47.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | smartdns | 46.1+dfsg-1.1 | — |
| Debian 13 | smartdns | 46.1+dfsg-1.1~deb13u1 | — |
| Debian 12 | smartdns | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | smartdns | No fix yet | — |
| Ubuntu 26.04 LTS | smartdns | No fix yet | — |
| Ubuntu 25.10 | smartdns | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | smartdns | No fix yet | — |
| Ubuntu Pro 22.04 LTS | smartdns | No fix yet | — |
References
- VDB-342841 | pymumu SmartDNS SVBC Record dns.c _dns_decode_SVCB_HTTPS stack-based overflow vdb-entry technical-description
- VDB-342841 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #736827 | pymumu smartdns 47.1 Stack-based Buffer Overflow third-party-advisory
- https://github.com/pymumu/smartdns/commit/2d57c4b4e1add9b4537aeb403f794a084727e1c8 patch
- https://github.com/pymumu/smartdns/ product