{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2017-1000381","sourceIdentifier":"cve@mitre.org","published":"2017-07-07T17:29:00.307","lastModified":"2026-06-17T00:59:04.233","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way."},{"lang":"es","value":"La función \"ares_parse_naptr_reply()\" de c-ares, que es usada para analizar las respuestas NAPTR, podría ser activada para leer la memoria fuera del búfer de entrada dado si el pasado en el paquete de respuesta DNS fue creado de una manera particular."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:c-ares:c-ares:1.8.0:*:*:*:*:*:*:*","matchCriteriaId":"D7BDB0FC-AA36-4C41-B3DC-201F0DE0191A"},{"vulnerable":true,"criteria":"cpe:2.3:a:c-ares:c-ares:1.9.0:*:*:*:*:*:*:*","matchCriteriaId":"5B38F8E2-7710-4303-A80F-9009619BEC7B"},{"vulnerable":true,"criteria":"cpe:2.3:a:c-ares:c-ares:1.9.1:*:*:*:*:*:*:*","matchCriteriaId":"AA1637EF-3393-4770-91AE-89EA53D57830"},{"vulnerable":true,"criteria":"cpe:2.3:a:c-ares:c-ares:1.10.0:*:*:*:*:*:*:*","matchCriteriaId":"93FA2559-0DB1-49BE-A6E6-C73408F4AB57"},{"vulnerable":true,"criteria":"cpe:2.3:a:c-ares:c-ares:1.12.0:*:*:*:*:*:*:*","matchCriteriaId":"B92EADF5-3500-4F37-808E-41DC48DE8D68"},{"vulnerable":true,"criteria":"cpe:2.3:a:c-ares_project:c-ares:1.11.0:*:*:*:*:*:*:*","matchCriteriaId":"B8F4F4BD-4316-4CB2-8FCE-9EE5C59E64EA"},{"vulnerable":true,"criteria":"cpe:2.3:a:c-ares_project:c-ares:1.11.0:rc1:*:*:*:*:*:*","matchCriteriaId":"476034B6-69BF-4130-8139-D5DDC1EB0028"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"4.0.0","versionEndIncluding":"4.1.2","matchCriteriaId":"A47FC4F7-1F77-4314-B4B3-3C5D8E335379"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.8.4","matchCriteriaId":"AC1070A7-E3E0-423C-A73A-040FCED8AD96"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"5.0.0","versionEndIncluding":"5.12.0","matchCriteriaId":"121E5D5D-B4D9-43F3-B5C9-74590192FAF1"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"6.0.0","versionEndIncluding":"6.8.1","matchCriteriaId":"D107EC29-67E7-40C3-8E5A-324C9105C5E4"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*","versionStartIncluding":"6.9.0","versionEndExcluding":"6.11.1","matchCriteriaId":"6EA3B1B4-3576-4508-AC77-4AE3A5622E09"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.10.1","matchCriteriaId":"B9C02D94-B713-4BE4-8C26-F21C2ADC01B0"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.1.4","matchCriteriaId":"02C6E585-2704-4EC2-BED1-CF6D61BE9CC9"}]}]}],"references":[{"url":"http://www.securityfocus.com/bid/99148","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://c-ares.haxx.se/0616.patch","source":"cve@mitre.org","tags":["Mailing List","Vendor Advisory"]},{"url":"https://c-ares.haxx.se/adv_20170620.html","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/99148","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://c-ares.haxx.se/0616.patch","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"https://c-ares.haxx.se/adv_20170620.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}