{"id":"CVE-2017-1000231","aliases":["ALPINE-CVE-2017-1000231","AZL-10412","DEBIAN-CVE-2017-1000231","DLA-1182-1","DLA-2910-1","EUVD-2017-1499","GHSA-r9hw-j2qr-6m8c","MGASA-2018-0003","SUSE-SU-2020:0801-1","UBUNTU-CVE-2017-1000231","USN-3491-1","openSUSE-SU-2020:0438-1","openSUSE-SU-2024:10912-1"],"status":"published","title":"A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.","description":"A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02653,"percentile":0.85782,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2017-11-16T00:00:00Z","modified":"2026-10-24T10:30:23Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"ldns","fixed_in":["1.7.0-r1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"ldns","fixed_in":["1.7.0-32"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ldns","fixed_in":["1.7.0-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ldns","fixed_in":["1.7.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ldns","fixed_in":["1.7.0-4"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"ldns","fixed_in":["1.6.13-1+deb7u2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ldns","fixed_in":["1.6.17-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ldns","fixed_in":["1.6.17-8ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ldns","fixed_in":["1.7.1-1.11"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-r1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-32"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13-1+deb7u2"}]}],"versions":["1.6.13-1","1.6.13-1+deb7u1"]},{"source":"osv","ecosystem":"Debian:9","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1+deb9u1"}]}],"versions":["1.7.0-1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-5.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-8.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-1ubuntu0.1"}]}],"versions":["1.6.16-1","1.6.17-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-8ubuntu0.1"}]}],"versions":["1.6.17-5","1.6.17-7","1.6.17-8"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-1ubuntu0.1"}]}],"versions":["1.6.16-1","1.6.17-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-8ubuntu0.1"}]}],"versions":["1.6.17-5","1.6.17-7","1.6.17-8"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-lp151.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1.11"}]}]}],"products":[{"vendor":"nlnetlabs","product":"ldns"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00028.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=1256","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00000.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000231","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r9hw-j2qr-6m8c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-1000231","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-1000231","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0003.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22066","tags":["report"]},{"url":"https://usn.ubuntu.com/usn/usn-3491-1/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200801-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1068709","tags":["report"]},{"url":"https://bugzilla.suse.com/1068711","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000232","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-1000231","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3491-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000232","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NSOVU5C657DBRCRXSQK3GESYECWT5JWP/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-1000231","description":"A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.","status":"published","published":"2017-11-17T04:00:00Z","modified":"2024-08-05T21:53:07.304Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-1499","description":"A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.","status":"published","published":"2017-11-17T04:00:00Z","modified":"2024-08-05T21:53:07Z","updated_at":"2026-11-03T02:23:03.593375Z"}],"ghsa":[{"id":"GHSA-r9hw-j2qr-6m8c","title":"A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.","description":"A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.","status":"published","published":"2022-05-14T03:46:35Z","modified":"2023-02-03T05:00:34Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:52:49.021794Z"}],"nvd":[{"id":"CVE-2017-1000231","description":"A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.","status":"published","published":"2017-11-17T04:29:00.247Z","modified":"2026-06-17T00:58:56.96Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:04:08.635428Z"}],"osv":[{"id":"ALPINE-CVE-2017-1000231","description":"A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.","status":"published","published":"2017-11-17T04:29:00.247Z","modified":"2026-06-15T18:18:06.721663574Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"AZL-10412","title":"CVE-2017-1000231 affecting package ldns for versions less than 1.7.0-32","description":"A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.","status":"published","published":"2017-11-17T04:29:00Z","modified":"2026-04-21T04:20:32.917564Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"CVE-2017-1000231","description":"A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.","status":"published","published":"2017-11-17T04:29:00.247Z","modified":"2026-10-24T10:30:23.632607406Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-1000231","description":"A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.","status":"published","published":"2017-11-17T04:29:00.247Z","modified":"2026-09-01T20:03:40.314838377Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2017-1000231","description":"A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.","status":"published","published":"2017-11-16T00:00:00Z","modified":"2026-04-22T11:09:28.350435Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-1182-1","title":"ldns - security update","status":"published","published":"2017-11-20T00:00:00Z","modified":"2026-03-09T01:00:54.479384Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-2910-1","title":"ldns - security update","status":"published","published":"2022-02-03T00:00:00Z","modified":"2026-03-09T01:22:44.312766Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2018-0003","title":"Updated ldns packages fix security vulnerabilities","description":"Stephan Zeisberg discovered that ldns incorrectly handled memory when\nprocessing data. A remote attacker could use this issue to cause ldns to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode (CVE-2017-1000231, CVE-2017-1000232).\n","status":"published","published":"2018-01-01T01:17:34Z","modified":"2026-04-16T06:25:28.29170186Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2020:0438-1","title":"Security update for ldns","description":"This update for ldns fixes the following issues:\n\n- CVE-2017-1000231: Fixed a buffer overflow during token parsing (bsc#1068711).\n- CVE-2017-1000232: Fixed a double-free vulnerability in str2host.c (bsc#1068709).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-03-31T22:24:49Z","modified":"2026-02-04T03:22:04.337488Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10912-1","title":"ldns-1.7.1-1.11 on GA media","description":"These are all security issues fixed in the ldns-1.7.1-1.11 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:59:08.811356Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:0801-1","title":"Security update for ldns","description":"This update for ldns fixes the following issues:\n\n- CVE-2017-1000231: Fixed a buffer overflow during token parsing (bsc#1068711).\n- CVE-2017-1000232: Fixed a double-free vulnerability in str2host.c (bsc#1068709).\n","status":"published","published":"2020-03-26T16:29:25Z","modified":"2026-02-04T02:43:20.405648Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-3491-1","title":"ldns vulnerabilities","description":"Leon Weber discovered that the ldns-keygen tool incorrectly set permissions\non private keys. A local attacker could possibly use this issue to obtain\ngenerated private keys. This issue only applied to Ubuntu 14.04 LTS.\n(CVE-2014-3209)\n\nStephan Zeisberg discovered that ldns incorrectly handled memory when\nprocessing data. A remote attacker could use this issue to cause ldns to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2017-1000231, CVE-2017-1000232)\n","status":"published","published":"2017-11-22T18:15:23Z","modified":"2026-04-22T09:41:04.223077Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}