[USN-6164-1] c-ares vulnerabilities

Severity High

Affected Packages 8

CVEs 2

Several security issues were fixed in c-ares.

Hannes Moesl discovered that c-ares incorrectly handled certain ipv6
addresses. An attacker could use this issue to cause c-ares to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2023-31130)

Xiang Li discovered that c-ares incorrectly handled certain UDP packets. A
remote attacker could possibly use this issue to cause c-res to crash,
resulting in a denial of service. (CVE-2023-32067)

Package	Affected Version
pkg:deb/ubuntu/libc-ares2?distro=lunar	< 1.18.1-2ubuntu0.1
pkg:deb/ubuntu/libc-ares2?distro=kinetic	< 1.18.1-1ubuntu0.22.10.2
pkg:deb/ubuntu/libc-ares2?distro=jammy	< 1.18.1-1ubuntu0.22.04.2
pkg:deb/ubuntu/libc-ares2?distro=focal	< 1.15.0-1ubuntu0.3
pkg:deb/ubuntu/libc-ares-dev?distro=lunar	< 1.18.1-2ubuntu0.1
pkg:deb/ubuntu/libc-ares-dev?distro=kinetic	< 1.18.1-1ubuntu0.22.10.2
pkg:deb/ubuntu/libc-ares-dev?distro=jammy	< 1.18.1-1ubuntu0.22.04.2
pkg:deb/ubuntu/libc-ares-dev?distro=focal	< 1.15.0-1ubuntu0.3

ID

USN-6164-1

Severity

high

Severity from

CVE-2023-32067

URL

https://ubuntu.com/security/notices/USN-6164-1

Published

2023-06-14T13:17:40
(15 months ago)

Modified

2023-06-14T13:17:40
(15 months ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/libc-ares2?distro=lunar	ubuntu	libc-ares2	< 1.18.1-2ubuntu0.1	lunar
Affected	pkg:deb/ubuntu/libc-ares2?distro=kinetic	ubuntu	libc-ares2	< 1.18.1-1ubuntu0.22.10.2	kinetic
Affected	pkg:deb/ubuntu/libc-ares2?distro=jammy	ubuntu	libc-ares2	< 1.18.1-1ubuntu0.22.04.2	jammy
Affected	pkg:deb/ubuntu/libc-ares2?distro=focal	ubuntu	libc-ares2	< 1.15.0-1ubuntu0.3	focal
Affected	pkg:deb/ubuntu/libc-ares-dev?distro=lunar	ubuntu	libc-ares-dev	< 1.18.1-2ubuntu0.1	lunar
Affected	pkg:deb/ubuntu/libc-ares-dev?distro=kinetic	ubuntu	libc-ares-dev	< 1.18.1-1ubuntu0.22.10.2	kinetic
Affected	pkg:deb/ubuntu/libc-ares-dev?distro=jammy	ubuntu	libc-ares-dev	< 1.18.1-1ubuntu0.22.04.2	jammy
Affected	pkg:deb/ubuntu/libc-ares-dev?distro=focal	ubuntu	libc-ares-dev	< 1.15.0-1ubuntu0.3	focal

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date