Описание
Security update for dnsmasq
The DNS server dnsmasq was updated to fix one security issue and one non-security bug.
The following vulnerability was fixed:
- CVE-2015-3294: A remote unauthenticated attacker could have caused a denial of service (DoS) or read heap memory, potentially disclosing information such as performed DNS queries or encryption keys. (bsc#928867)
The following bug was fixed:
- bsc#923144: When answer to an upstream query is a CNAME pointing to an A/AAAA record which is present locally (/etc/hosts), allow caching when the upstream and local A/AAAA records have the same value.
Список пакетов
SUSE Cloud Compute Node for SUSE Linux Enterprise 12 5
dnsmasq-utils-2.71-4.1
Ссылки
- Link for SUSE-SU-2015:0979-2
- E-Mail link for SUSE-SU-2015:0979-2
- SUSE Security Ratings
- SUSE Bug 923144
- SUSE Bug 928867
- SUSE CVE CVE-2015-3294 page
Описание
The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request.
Затронутые продукты
SUSE Cloud Compute Node for SUSE Linux Enterprise 12 5:dnsmasq-utils-2.71-4.1
Ссылки
- CVE-2015-3294
- SUSE Bug 923144
- SUSE Bug 928867