CVE-2017-12865

NameCVE-2017-12865
DescriptionStack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the "name" variable.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1078-1, DSA-3956-1
NVD severityhigh
Debian Bugs872844

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
connman (PTS)stretch1.33-3+deb9u1fixed
stretch (security)1.33-3+deb9u2fixed
buster1.36-2.1~deb10u2fixed
buster (security)1.36-2.1~deb10u1fixed
bookworm, sid, bullseye1.36-2.2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
connmansourcewheezy1.0-1.1+wheezy2DLA-1078-1
connmansourcejessie1.21-1.2+deb8u1DSA-3956-1
connmansourcestretch1.33-3+deb9u1DSA-3956-1
connmansource(unstable)1.35-1872844

Notes

https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=5c281d182ecdd0a424b64f7698f32467f8f67b71 (1.35)

Search for package or bug name: Reporting problems