Debian: CVE-2022-4904: c-ares -- security update

Debian: CVE-2022-4904: c-ares -- security update

Severity

9

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:C)

Published

02/21/2023

Created

02/22/2023

Added

02/21/2023

Modified

01/28/2025

Description

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

Solution(s)

• debian-upgrade-c-ares

References

• https://attackerkb.com/topics/cve-2022-4904
• CVE - 2022-4904
• DLA-3323-1