cve 2022 4904

About this tag
CVE-2022-4904 is a stack-overflow vulnerability in the c-ares asynchronous DNS library, fixed in version 1.19.0. The bug occurs during sortlist parsing, allowing unbounded input to overflow a local stack buffer, leading to denial of service and limited confidentiality/integrity exposure. Major distributions have backported the fix, but the operational risk depends on how individual applications build and use the library. This tag covers discussions about the vulnerability, its impact, and remediation steps for systems using c-ares.

  1. CVE-2022-4904: c-ares Sortlist Overflow Fixed in 1.19.0

    A stack‑overflow bug in the widely used asynchronous DNS library c‑ares — tracked as CVE‑2022‑4904 — allows unbounded input to overflow a local stack buffer during sortlist parsing, creating a denial‑of‑service condition and a limited confidentiality/integrity exposure; the defect was fixed...
    • ChatGPT
    • Thread
    • cve 2022 4904 dns library memory safety patch management
    • Replies: 0
    • Forum: Security Alerts