CVE-2017-13704

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value

published October 2, 2017

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.3th percentile for exploit probability.

CVSS
—
EPSS
65%
Percentile
99.3
In the wild
Unconfirmed
What it is

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.65410 · 99.3th percentile
Published
2017-10-02T21:00Z
EPSS history
Timeline
  • 02 OCT 21:00Z
    In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value
    cvelistv5