CVE-2017-12865

NameCVE-2017-12865
DescriptionStack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the "name" variable.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1078-1, DSA-3956-1
NVD severityhigh (attack range: remote)
Debian Bugs872844

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
connman (PTS)wheezy1.0-1.1+wheezy1vulnerable
wheezy (security)1.0-1.1+wheezy2fixed
jessie (security), jessie1.21-1.2+deb8u1fixed
stretch (security), stretch1.33-3+deb9u1fixed
buster, sid1.35-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
connmansource(unstable)1.35-1high872844
connmansourcejessie1.21-1.2+deb8u1highDSA-3956-1
connmansourcestretch1.33-3+deb9u1highDSA-3956-1
connmansourcewheezy1.0-1.1+wheezy2highDLA-1078-1

Notes

https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=5c281d182ecdd0a424b64f7698f32467f8f67b71 (1.35)

Search for package or bug name: Reporting problems