CVE-2020-14354CWE-120

A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing

published May 13, 2021

CVSS
—
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00529 · 43.9th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2021-05-13T13:38Z
EPSS history
Timeline
  • 13 MAY 13:38Z
    A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing
    cvelistv5