{"id":"CVE-2016-5180","aliases":["ALPINE-CVE-2016-5180","BELL-CVE-2016-5180","CLSA-2025-1757608893","DEBIAN-CVE-2016-5180","DLA-648-1","DSA-3682-1","EUVD-2016-6131","GHSA-29hr-5wcr-whpc","MGASA-2016-0351","RHSA-2017:0002","SUSE-SU-2016:2898-1","SUSE-SU-2016:3286-1","SUSE-SU-2016:3287-1","UBUNTU-CVE-2016-5180","USN-3143-1","openSUSE-SU-2024:10147-1","openSUSE-SU-2024:10247-1"],"status":"published","title":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows...","description":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08653,"percentile":0.95149,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-787"],"published":"2016-09-30T00:00:00Z","modified":"2026-10-24T10:30:30Z","exploits":[{"source":"pocgithub","id":"pouriam23/CVE-2016-5180","title":"pouriam23/CVE-2016-5180","date":"2025-05-23","url":"https://github.com/pouriam23/CVE-2016-5180"},{"source":"pocgithub","id":"pouriam23/CVE-2016-5180-docker-","title":"pouriam23/CVE-2016-5180-docker-","date":"2025-05-23","url":"https://github.com/pouriam23/CVE-2016-5180-docker-"},{"source":"pocgithub","id":"pouriam23/final-CVE-2016-5180","title":"pouriam23/final-CVE-2016-5180","date":"2025-05-24","url":"https://github.com/pouriam23/final-CVE-2016-5180"}],"fixes":[{"ecosystem":"Alpine:v3.2","package":"c-ares","fixed_in":["1.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"c-ares","fixed_in":["1.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"c-ares","fixed_in":["1.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"c-ares","fixed_in":["1.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"c-ares","fixed_in":["1.12.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"nodejs","fixed_in":["6.8.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"c-ares","fixed_in":["1.10.0-3.el7_9.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"c-ares-devel","fixed_in":["1.10.0-3.el7_9.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"c-ares","fixed_in":["1.12.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"c-ares","fixed_in":["1.12.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"c-ares","fixed_in":["1.12.0-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"c-ares","fixed_in":["1.9.1-3+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"c-ares","fixed_in":["1.10.0-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"c-ares","fixed_in":["1.10.0-5.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs4","fixed_in":["4.6.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libcares2","fixed_in":["1.9.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libcares2","fixed_in":["1.9.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libcares2","fixed_in":["1.9.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libcares2","fixed_in":["1.9.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libcares2","fixed_in":["1.9.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libcares2","fixed_in":["1.9.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libcares2","fixed_in":["1.9.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libcares2","fixed_in":["1.9.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libcares2","fixed_in":["1.9.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"libcares2","fixed_in":["1.9.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"libcares2","fixed_in":["1.9.1-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libcares2","fixed_in":["1.7.4-7.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libcares2","fixed_in":["1.7.4-7.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libcares2","fixed_in":["1.7.4-7.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"c-ares","fixed_in":["1.10.0-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"c-ares","fixed_in":["1.10.0-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"c-ares","fixed_in":["1.12.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-3.el7_9.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"c-ares-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-3.el7_9.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-3+deb7u1"}]}],"versions":["1.9.1-3"]},{"source":"osv","ecosystem":"Debian:8","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-2+deb8u1"}]}],"versions":["1.10.0-2"]},{"source":"osv","ecosystem":"Mageia:5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-5.1.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-http-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-2.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-http-parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-2.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-http-parser-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-2.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-http-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-http-parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-http-parser-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-7.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-7.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-7.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-2ubuntu0.1"}]}],"versions":["1.10.0-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-3ubuntu0.1"}]}],"versions":["1.10.0-2","1.10.0-3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-2ubuntu0.1"}]}],"versions":["1.10.0-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-3ubuntu0.1"}]}],"versions":["1.10.0-2","1.10.0-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-1.1"}]}]}],"products":[{"vendor":"c-ares","product":"c-ares"},{"vendor":"c-ares_project","product":"c-ares"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"nodejs","product":"node.js"}],"references":[{"url":"https://source.android.com/security/bulletin/2017-01-01.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/93243","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-3143-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201701-28","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3682","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://c-ares.haxx.se/adv_20160929.html","tags":["x_refsource_CONFIRM","x_transferred","web","article","report"]},{"url":"https://c-ares.haxx.se/CVE-2016-5180.patch","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0002.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5180","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-29hr-5wcr-whpc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-5180","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-5180","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2025-1757608893.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-5180","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0351.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19489","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0002","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1335449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1346910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1379921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1380463","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388097","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0002.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1669","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1669","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1669","tags":["advisory"]},{"url":"http://googlechromereleases.blogspot.com/2016/05/stable-channel-update.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5180","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5180","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5325","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7099","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162898-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1007728","tags":["report"]},{"url":"https://bugzilla.suse.com/1009011","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5180","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163286-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163287-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-5180","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3143-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7099","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-5180","description":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.","status":"published","published":"2016-10-03T15:00:00Z","modified":"2024-08-06T00:53:48.437Z","updated_at":"2026-11-02T14:33:30.767029Z"}],"euvd":[{"id":"EUVD-2016-6131","description":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.","status":"published","published":"2016-10-03T15:00:00Z","modified":"2024-08-06T00:53:48Z","updated_at":"2026-11-03T02:22:43.529102Z"}],"ghsa":[{"id":"GHSA-29hr-5wcr-whpc","title":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows...","description":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.","status":"published","published":"2022-05-14T03:56:52Z","modified":"2023-01-28T05:01:15Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:43:31.850485Z"}],"nvd":[{"id":"CVE-2016-5180","description":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.","status":"published","published":"2016-10-03T15:59:03.27Z","modified":"2026-06-17T00:48:55.07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:31.485755Z"}],"osv":[{"id":"ALPINE-CVE-2016-5180","description":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.","status":"published","published":"2016-10-03T15:59:03.27Z","modified":"2026-09-22T06:30:09.757219454Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"BELL-CVE-2016-5180","title":"CVE-2016-5180 does not affect BellSoft software","status":"withdrawn","published":"2016-10-03T15:59:00Z","modified":"2026-01-26T09:48:15.512383Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-5180","description":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.","status":"published","published":"2016-10-03T15:59:03.27Z","modified":"2026-10-24T10:30:30.712953911Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-5180","description":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.","status":"published","published":"2016-10-03T15:59:03.27Z","modified":"2026-09-22T07:02:08.875858458Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"RHSA-2017:0002","title":"Red Hat Security Advisory: rh-nodejs4-nodejs and rh-nodejs4-http-parser security update","status":"published","published":"2024-09-13T14:37:29Z","modified":"2026-06-29T10:14:45Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2016-5180","description":"Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.","status":"published","published":"2016-10-03T00:00:00Z","modified":"2026-04-22T10:49:08.407972Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"CLSA-2025-1757608893","title":"c-ares: Fix of CVE-2016-5180","description":"- CVE-2016-5180: fix heap-based buffer overflow in the ares_create_query\n  causing DoS","status":"published","published":"2025-09-11T16:41:36Z","modified":"2026-06-01T00:33:18.179579046Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"DLA-648-1","title":"c-ares - security update","status":"published","published":"2016-10-06T00:00:00Z","modified":"2026-03-09T02:09:42.588842Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3682-1","title":"c-ares - security update","status":"published","published":"2016-09-30T00:00:00Z","modified":"2026-03-09T01:20:17.30989Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2016-0351","title":"Updated c-ares packages fix security vulnerability","description":"In c-ares before 1.12.0, When a string is passed in to 'ares_create_query'\nor 'ares_mkquery' and uses an escaped trailing dot, like \"hello\\.\", c-ares\ncalculates the string length wrong and subsequently writes outside of the\nthe allocated buffer with one byte. The wrongly written byte is the least\nsignificant byte of the 'dnsclass' argument; most commonly 1\n(CVE-2016-5180).\n","status":"published","published":"2016-10-21T14:48:32Z","modified":"2026-04-16T06:25:01.707305229Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10147-1","title":"libcares-devel-1.12.0-1.1 on GA media","description":"These are all security issues fixed in the libcares-devel-1.12.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:12.621375Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10247-1","title":"nodejs4-4.7.0-1.1 on GA media","description":"These are all security issues fixed in the nodejs4-4.7.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:23:14.43884Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:2898-1","title":"Security update for nodejs4","description":"\nThis update for nodejs4 fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2016-5180: c-ares: Fix for single-byte buffer overwrite (bsc#1007728).\n\nBug fixes:\n- bsc#1009011: npm4 should provide versioned nodejs-npm and npm allowing nodejs-packaging to\n  continue to function properly in Leap 42.2\n","status":"published","published":"2016-11-24T13:31:38Z","modified":"2026-02-04T04:19:55.366481Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:3286-1","title":"Security update for libcares2","description":"\nThis update for libcares2 fixes the following issues:\n\n- Add patch to fix single byte out of buffer write\n  (CVE-2016-5180, bsc#1007728)\n\n","status":"published","published":"2016-12-29T08:43:12Z","modified":"2026-02-04T03:58:10.156537Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2016:3287-1","title":"Security update for libcares2","description":"\nThis update for libcares2 fixes the following issues:\n\n- Add patch to fix single byte out of buffer write\n  (CVE-2016-5180, bsc#1007728)\n","status":"published","published":"2016-12-29T08:14:27Z","modified":"2026-02-04T03:25:56.751765Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3143-1","title":"c-ares vulnerability","description":"Gzob Qq discovered that c-ares incorrectly handled certain hostnames. A\nremote attacker could use this issue to cause applications using c-ares to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","status":"published","published":"2016-11-30T18:22:12Z","modified":"2026-04-22T09:29:58.985351Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}