Skip to content
Commit 209f42fd authored by Peter Korsgaard's avatar Peter Korsgaard
Browse files

musl: add upstream security fix for CVE-2017-15650

>From the upstream announcement:
http://www.openwall.com/lists/oss-security/2017/10/19/5



Felix Wilhelm has discovered a flaw in the dns response parsing for
musl libc 1.1.16 that leads to overflow of a stack-based buffer.
Earlier versions are also affected.

When an application makes a request via getaddrinfo for both IPv4 and
IPv6 results (AF_UNSPEC), an attacker who controls or can spoof the
nameservers configured in resolv.conf can reply to both the A and AAAA
queries with A results. Since A records are smaller than AAAA records,
it's possible to fit more addresses than the precomputed bound, and a
buffer overflow occurs.

Signed-off-by: default avatarPeter Korsgaard <peter@korsgaard.com>
parent 5f50fb8d
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment