GNU Adns vulnerabilities

8 CVEs affecting GNU Adns, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-9104, published 2020-06-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-9105, published 2020-06-18. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. An issue was discovered in adns before 1.5.2. It corrupts a pointer when a nameserver speaks first because of a wrong number of pointer dereferences. This bug may well be exploitable as a remote code…
CVE-2017-9104, published 2020-06-18. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered.
CVE-2017-9103, published 2020-06-18. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. An issue was discovered in adns before 1.5.2. pap_mailbox822 does not properly check st from adns__findlabel_next. Without this, an uninitialised stack value can be used as the first label length.…
CVE-2017-9108, published 2020-06-18. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to…
CVE-2017-9109, published 2020-06-18. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at…
CVE-2017-9107, published 2020-06-18. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. An issue was discovered in adns before 1.5.2. It overruns reading a buffer if a domain ends with backslash. If the query domain ended with \, and adns_qf_quoteok_query was specified, qdparselabel…
CVE-2017-9106, published 2020-06-18. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. An issue was discovered in adns before 1.5.2. adns_rr_info mishandles a bogus *datap. The general pattern for formatting integers is to sprintf into a fixed-size buffer. This is correct if the input…
CVE-2008-4100, published 2008-09-18. Medium severity, CVSS 6.4. EPSS: 1.5% chance of exploitation in the next 30 days. GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than…