{"id":"CVE-2017-1000381","aliases":["ALPINE-CVE-2017-1000381","BELL-CVE-2017-1000381","DEBIAN-CVE-2017-1000381","DLA-998-1","EUVD-2017-1540","GHSA-vjr3-54h8-whpv","MGASA-2017-0215","MGASA-2019-0277","RHSA-2017:2908","SUSE-SU-2017:1792-1","SUSE-SU-2017:2168-1","SUSE-SU-2019:14246-1","UBUNTU-CVE-2017-1000381","USN-3395-1","USN-4796-1","openSUSE-SU-2024:10668-1"],"status":"published","title":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could...","description":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03337,"percentile":0.88727,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-06-22T00:00:00Z","modified":"2026-10-24T10:31:01Z","fixes":[{"ecosystem":"Alpine:v3.3","package":"c-ares","fixed_in":["1.12.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"c-ares","fixed_in":["1.12.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"c-ares","fixed_in":["1.12.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"c-ares","fixed_in":["1.12.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.10","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"nodejs","fixed_in":["6.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"nodejs","fixed_in":["6.9.5-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"nodejs","fixed_in":["6.10.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"nodejs","fixed_in":["6.11.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"c-ares","fixed_in":["1.12.0-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"c-ares","fixed_in":["1.12.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"c-ares","fixed_in":["1.12.0-4"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"c-ares","fixed_in":["1.9.1-3+deb7u2"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"c-ares","fixed_in":["1.10.0-5.2.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libcares2","fixed_in":["1.9.1-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libcares2","fixed_in":["1.9.1-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libcares2","fixed_in":["1.9.1-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libcares2","fixed_in":["1.9.1-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libcares2","fixed_in":["1.9.1-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"libcares2","fixed_in":["1.9.1-8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"c-ares","fixed_in":["1.10.0-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"c-ares","fixed_in":["1.10.0-3ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","fixed_in":["4.2.6~dfsg-1ubuntu4.2+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.3","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.5-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-4"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-3+deb7u2"}]}],"versions":["1.9.1-3","1.9.1-3+deb7u1"]},{"source":"osv","ecosystem":"Mageia:5","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-5.2.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-8.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:6","package":"http-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-1.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:6","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-1.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs6-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-2.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs6-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-2.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs6-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-2.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs6-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-2.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs6-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs6-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs6-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs6-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.11.3-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"libcares2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-11.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-15.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-11.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"nodejs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.4-15.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-11.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.2.0-78.51.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"MozillaFirefox-branding-SLED","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68-21.9.8"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-atk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-2.8.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-2.13.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.11-2.8.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-2.14.7"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.9-2.15.3"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-harfbuzz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-2.7.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1.git259-2.3.3"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-libffi-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-14.1"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-pango","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.14-2.7.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21-29.6.1"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45-38.9.3"}]}],"bundled":118},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-2ubuntu0.2"}]}],"versions":["1.10.0-2","1.10.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-3ubuntu0.2"}]}],"versions":["1.10.0-2","1.10.0-3","1.10.0-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6~dfsg-1ubuntu4.2+esm1"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-2ubuntu0.2"}]}],"versions":["1.10.0-2","1.10.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-3ubuntu0.2"}]}],"versions":["1.10.0-2","1.10.0-3","1.10.0-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.25~dfsg2-2ubuntu1.2+esm1"}]}],"versions":["0.10.15~dfsg1-4","0.10.21~dfsg1-1","0.10.22~dfsg1-2","0.10.23~dfsg1-1","0.10.23~dfsg1-2","0.10.23~dfsg1-3","0.10.24~dfsg1-1","0.10.25~dfsg2-2","0.10.25~dfsg2-2ubuntu1","0.10.25~dfsg2-2ubuntu1.2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6~dfsg-1ubuntu4.2+esm1"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0~dfsg-2ubuntu0.4+esm1"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"c-ares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.2-2.2"}]}],"bundled":3}],"products":[{"vendor":"c-ares","product":"c-ares"},{"vendor":"c-ares_project","product":"c-ares"},{"vendor":"nodejs","product":"node.js"}],"references":[{"url":"https://c-ares.haxx.se/0616.patch","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/99148","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://c-ares.haxx.se/adv_20170620.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000381","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vjr3-54h8-whpv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-1000381","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-1000381","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-1000381","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0215.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21115","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2019-0277.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21330","tags":["report"]},{"url":"https://nodejs.org/en/blog/release/v6.11.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.11.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.11.2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.11.3/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.11.4/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.12.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.12.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.12.2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.12.3/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.13.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.13.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.14.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.14.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.14.2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.14.3/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.15.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.15.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.16.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.17.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.17.1/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2908","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475327","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2908.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11499","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463132","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000381","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171792-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1044946","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000381","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172168-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1041282","tags":["report"]},{"url":"https://bugzilla.suse.com/1041283","tags":["report"]},{"url":"https://bugzilla.suse.com/1048299","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11499","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914246-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1000036","tags":["report"]},{"url":"https://bugzilla.suse.com/1001652","tags":["report"]},{"url":"https://bugzilla.suse.com/1025108","tags":["report"]},{"url":"https://bugzilla.suse.com/1029377","tags":["report"]},{"url":"https://bugzilla.suse.com/1029902","tags":["report"]},{"url":"https://bugzilla.suse.com/1040164","tags":["report"]},{"url":"https://bugzilla.suse.com/104105","tags":["report"]},{"url":"https://bugzilla.suse.com/1042670","tags":["report"]},{"url":"https://bugzilla.suse.com/1043008","tags":["report"]},{"url":"https://bugzilla.suse.com/1047925","tags":["report"]},{"url":"https://bugzilla.suse.com/1047936","tags":["report"]},{"url":"https://bugzilla.suse.com/1049186","tags":["report"]},{"url":"https://bugzilla.suse.com/1050653","tags":["report"]},{"url":"https://bugzilla.suse.com/1056058","tags":["report"]},{"url":"https://bugzilla.suse.com/1058013","tags":["report"]},{"url":"https://bugzilla.suse.com/1066242","tags":["report"]},{"url":"https://bugzilla.suse.com/1066953","tags":["report"]},{"url":"https://bugzilla.suse.com/1070738","tags":["report"]},{"url":"https://bugzilla.suse.com/1070853","tags":["report"]},{"url":"https://bugzilla.suse.com/1072320","tags":["report"]},{"url":"https://bugzilla.suse.com/1072322","tags":["report"]},{"url":"https://bugzilla.suse.com/1073796","tags":["report"]},{"url":"https://bugzilla.suse.com/1073798","tags":["report"]},{"url":"https://bugzilla.suse.com/1073799","tags":["report"]},{"url":"https://bugzilla.suse.com/1073803","tags":["report"]},{"url":"https://bugzilla.suse.com/1073808","tags":["report"]},{"url":"https://bugzilla.suse.com/1073818","tags":["report"]},{"url":"https://bugzilla.suse.com/1073823","tags":["report"]},{"url":"https://bugzilla.suse.com/1073829","tags":["report"]},{"url":"https://bugzilla.suse.com/1073830","tags":["report"]},{"url":"https://bugzilla.suse.com/1073832","tags":["report"]},{"url":"https://bugzilla.suse.com/1073846","tags":["report"]},{"url":"https://bugzilla.suse.com/1074235","tags":["report"]},{"url":"https://bugzilla.suse.com/1077230","tags":["report"]},{"url":"https://bugzilla.suse.com/1079761","tags":["report"]},{"url":"https://bugzilla.suse.com/1081750","tags":["report"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/1087453","tags":["report"]},{"url":"https://bugzilla.suse.com/1087459","tags":["report"]},{"url":"https://bugzilla.suse.com/1087463","tags":["report"]},{"url":"https://bugzilla.suse.com/1088573","tags":["report"]},{"url":"https://bugzilla.suse.com/1091764","tags":["report"]},{"url":"https://bugzilla.suse.com/1094814","tags":["report"]},{"url":"https://bugzilla.suse.com/1097158","tags":["report"]},{"url":"https://bugzilla.suse.com/1097375","tags":["report"]},{"url":"https://bugzilla.suse.com/1097401","tags":["report"]},{"url":"https://bugzilla.suse.com/1097404","tags":["report"]},{"url":"https://bugzilla.suse.com/1097748","tags":["report"]},{"url":"https://bugzilla.suse.com/1104841","tags":["report"]},{"url":"https://bugzilla.suse.com/1105019","tags":["report"]},{"url":"https://bugzilla.suse.com/1107030","tags":["report"]},{"url":"https://bugzilla.suse.com/1109465","tags":["report"]},{"url":"https://bugzilla.suse.com/1117473","tags":["report"]},{"url":"https://bugzilla.suse.com/1117626","tags":["report"]},{"url":"https://bugzilla.suse.com/1117627","tags":["report"]},{"url":"https://bugzilla.suse.com/1117629","tags":["report"]},{"url":"https://bugzilla.suse.com/1117630","tags":["report"]},{"url":"https://bugzilla.suse.com/1120644","tags":["report"]},{"url":"https://bugzilla.suse.com/1122191","tags":["report"]},{"url":"https://bugzilla.suse.com/1123482","tags":["report"]},{"url":"https://bugzilla.suse.com/1124525","tags":["report"]},{"url":"https://bugzilla.suse.com/1127532","tags":["report"]},{"url":"https://bugzilla.suse.com/1129346","tags":["report"]},{"url":"https://bugzilla.suse.com/1130694","tags":["report"]},{"url":"https://bugzilla.suse.com/1130840","tags":["report"]},{"url":"https://bugzilla.suse.com/1133452","tags":["report"]},{"url":"https://bugzilla.suse.com/1133810","tags":["report"]},{"url":"https://bugzilla.suse.com/1134209","tags":["report"]},{"url":"https://bugzilla.suse.com/1138459","tags":["report"]},{"url":"https://bugzilla.suse.com/1140290","tags":["report"]},{"url":"https://bugzilla.suse.com/1140868","tags":["report"]},{"url":"https://bugzilla.suse.com/1141853","tags":["report"]},{"url":"https://bugzilla.suse.com/1144919","tags":["report"]},{"url":"https://bugzilla.suse.com/1145665","tags":["report"]},{"url":"https://bugzilla.suse.com/1146090","tags":["report"]},{"url":"https://bugzilla.suse.com/1146091","tags":["report"]},{"url":"https://bugzilla.suse.com/1146093","tags":["report"]},{"url":"https://bugzilla.suse.com/1146094","tags":["report"]},{"url":"https://bugzilla.suse.com/1146095","tags":["report"]},{"url":"https://bugzilla.suse.com/1146097","tags":["report"]},{"url":"https://bugzilla.suse.com/1146099","tags":["report"]},{"url":"https://bugzilla.suse.com/1146100","tags":["report"]},{"url":"https://bugzilla.suse.com/1149323","tags":["report"]},{"url":"https://bugzilla.suse.com/1153423","tags":["report"]},{"url":"https://bugzilla.suse.com/1154738","tags":["report"]},{"url":"https://bugzilla.suse.com/1447070","tags":["report"]},{"url":"https://bugzilla.suse.com/1447409","tags":["report"]},{"url":"https://bugzilla.suse.com/744625","tags":["report"]},{"url":"https://bugzilla.suse.com/744629","tags":["report"]},{"url":"https://bugzilla.suse.com/845955","tags":["report"]},{"url":"https://bugzilla.suse.com/865853","tags":["report"]},{"url":"https://bugzilla.suse.com/905528","tags":["report"]},{"url":"https://bugzilla.suse.com/917607","tags":["report"]},{"url":"https://bugzilla.suse.com/935856","tags":["report"]},{"url":"https://bugzilla.suse.com/937414","tags":["report"]},{"url":"https://bugzilla.suse.com/947747","tags":["report"]},{"url":"https://bugzilla.suse.com/948045","tags":["report"]},{"url":"https://bugzilla.suse.com/948602","tags":["report"]},{"url":"https://bugzilla.suse.com/955142","tags":["report"]},{"url":"https://bugzilla.suse.com/957814","tags":["report"]},{"url":"https://bugzilla.suse.com/957815","tags":["report"]},{"url":"https://bugzilla.suse.com/961254","tags":["report"]},{"url":"https://bugzilla.suse.com/962297","tags":["report"]},{"url":"https://bugzilla.suse.com/966076","tags":["report"]},{"url":"https://bugzilla.suse.com/966077","tags":["report"]},{"url":"https://bugzilla.suse.com/985201","tags":["report"]},{"url":"https://bugzilla.suse.com/986541","tags":["report"]},{"url":"https://bugzilla.suse.com/991344","tags":["report"]},{"url":"https://bugzilla.suse.com/998743","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9947","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-1000381","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3395-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4796-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-5737","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3672","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-1000381","description":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.","status":"published","published":"2017-07-07T17:00:00Z","modified":"2024-08-05T22:00:40.967Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-1540","description":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.","status":"published","published":"2017-07-07T17:00:00Z","modified":"2024-08-05T22:00:40Z","updated_at":"2026-11-03T02:23:03.159581Z"}],"ghsa":[{"id":"GHSA-vjr3-54h8-whpv","title":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could...","description":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.","status":"published","published":"2022-05-17T02:28:33Z","modified":"2023-01-28T05:01:15Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:43:31.850485Z"}],"nvd":[{"id":"CVE-2017-1000381","description":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.","status":"published","published":"2017-07-07T17:29:00.307Z","modified":"2026-06-17T00:59:04.233Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"ALPINE-CVE-2017-1000381","description":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.","status":"published","published":"2017-07-07T17:29:00.307Z","modified":"2026-06-15T18:18:06.723469578Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2017-1000381","title":"CVE-2017-1000381 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:30.848759Z","modified":"2026-02-18T07:35:13.014144Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-1000381","description":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.","status":"published","published":"2017-07-07T17:29:00.307Z","modified":"2026-10-24T10:31:01.760053508Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-1000381","description":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.","status":"published","published":"2017-07-07T17:29:00.307Z","modified":"2026-09-01T20:03:40.936277491Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"RHSA-2017:2908","title":"Red Hat Security Advisory: rh-nodejs6-nodejs security update","status":"published","published":"2024-09-13T14:42:11Z","modified":"2026-06-29T10:17:59Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2017-1000381","description":"The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.","status":"published","published":"2017-07-07T00:00:00Z","modified":"2026-04-22T11:09:31.448548Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-998-1","title":"c-ares - security update","status":"published","published":"2017-06-22T00:00:00Z","modified":"2026-03-09T02:11:45.274995Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"MGASA-2017-0215","title":"Updated c-ares packages fix security vulnerability","description":"The c-ares function ares_parse_naptr_reply(), which is used for parsing\nNAPTR responses, could be triggered to read memory outside of the given\ninput buffer if the passed in DNS response packet was crafted in a\nparticular way (CVE-2017-1000381).\n","status":"published","published":"2017-07-23T19:58:56Z","modified":"2026-04-16T06:23:51.950585332Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2019-0277","title":"Updated nodejs packages fix security vulnerabilities","description":"This update provides nodejs v6.17.1 fixing at least the following security\nissues:\n\nThe c-ares function ares_parse_naptr_reply(), which is used for parsing\nNAPTR responses, could be triggered to read memory outside of the given\ninput buffer (CVE-2017-1000381) \n\nFix for 'path' module regular expression denial of service (CVE-2018-7158)\n\nReject spaces in HTTP Content-Length header values (CVE-2018-7159)\n\nFix for inspector DNS rebinding vulnerability (CVE-2018-7160)\n\nbuffer: Fixes Denial of Service vulnerability where calling Buffer.fill()\ncould hang (CVE-2018-7167)\n\nbuffer: Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding\n(CVE-2018-12115)\n\nNode.js: HTTP request splitting (CVE-2018-12116)\n\nNode.js: Debugger port 5858 listens on any interface by default\n(CVE-2018-12120)\n\nNode.js: Denial of Service with large HTTP headers (CVE-2018-12121)\n\nNode.js: Slowloris HTTP Denial of Service (CVE-2018-12122)\n\nNode.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)\n\nNode.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)\n\nNode.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)\n\nFor other fixes in this update, see the referenced release logs.\n","status":"published","published":"2019-09-15T13:24:16Z","modified":"2026-04-16T04:41:44.565194424Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:10668-1","title":"c-ares-devel-1.17.2-2.2 on GA media","description":"These are all security issues fixed in the c-ares-devel-1.17.2-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:32:04.599764Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2017:1792-1","title":"Security update for libcares2","description":"This update for libcares2 fixes the following issues:\n\n- CVE-2017-1000381: A NAPTR parser out of bounds access was fixed that could lead to crashes. (bsc#1044946)\n","status":"published","published":"2017-07-06T09:39:22Z","modified":"2026-02-04T04:05:57.393377Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2168-1","title":"Security update for nodejs4, nodejs6","description":"This update for nodejs4 and nodejs6 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-1000381: The c-ares function ares_parse_naptr_reply() could be triggered to read memory\n  outside of the given input buffer if the passed in DNS response packet was crafted in a\n  particular way. (bsc#1044946)\n- CVE-2017-11499: Disable V8 snapshots. The hashseed embedded in the snapshot is currently the same\n  for all runs of the binary. This opens node up to collision attacks which could result in a Denial\n  of Service. We have temporarily disabled snapshots until a more robust solution is found.\n  (bsc#1048299)\n\nNon-security fixes:\n\n- GCC 7 compilation fixes for v8 backported and add missing ICU59 headers (bsc#1041282)\n- New upstream LTS release 6.11.1\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.1\n- New upstream LTS release 6.11.0\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.0\n- New upstream LTS release 6.10.3\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.3\n- New upstream LTS release 6.10.2\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.2\n- New upstream LTS release 6.10.1\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.1\n- New upstream LTS release 6.10.0\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.0\n\n- New upstream LTS release 4.8.4\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.4\n- New upstream LTS release 4.8.3\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.3\n- New upstream LTS release 4.8.2\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.2\n- New upstream LTS release 4.8.1\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.1\n- New upstream LTS release 4.8.0\n  * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.0\n","status":"published","published":"2017-08-15T12:27:34Z","modified":"2026-02-04T03:04:02.76247Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2019:14246-1","title":"Security update for Mozilla Firefox","description":"\nThis update contains the Mozilla Firefox ESR 68.2 release.\n\nMozilla Firefox was updated to ESR 68.2 release:\n\n* Enterprise: New administrative policies were added. More\n  information and templates are available at the Policy\n  Templates page.\n\n* Various security fixes:\n  MFSA 2019-33 (bsc#1154738)\n  * CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber\n  * CVE-2019-11757: Use-after-free when creating index updates in IndexedDB\n  * CVE-2019-11758: Potentially exploitable crash due to 360 Total Security\n  * CVE-2019-11759: Stack buffer overflow in HKDF output\n  * CVE-2019-11760: Stack buffer overflow in WebRTC networking\n  * CVE-2019-11761: Unintended access to a privileged JSONView object\n  * CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation\n  * CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique\n  * CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2\n\nOther Issues resolved:\n\n* [bsc#1104841] Newer versions of firefox have a dependency on\n                GLIBCXX_3.4.20\n* [bsc#1074235] MozillaFirefox: background tab crash reports sent\n                inadvertently without user opt-in\n* [bsc#1043008] Firefox hangs randomly when browsing and\n                scrolling\n* [bsc#1025108] Firefox stops loading page until mouse is moved\n* [bsc#905528]  Firefox malfunctions due to broken omni.ja\n                archives\n\n","status":"published","published":"2020-01-17T17:07:38Z","modified":"2026-02-04T02:31:26.178072Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-3395-1","title":"c-ares vulnerability","description":"It was discovered that c-ares incorrectly handled certain NAPTR responses.\nA remote attacker could possibly use this issue to cause applications using\nc-ares to crash, resulting in a denial of service.\n","status":"published","published":"2017-08-17T17:09:39Z","modified":"2026-04-22T09:38:01.155977Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-4796-1","title":"nodejs vulnerabilities","description":"Alexander Minozhenko and James Bunton discovered that Node.js did not\nproperly handle wildcards in name fields of X.509 TLS certificates. An\nattacker could use this vulnerability to execute a machine-in-the-middle-\nattack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)\n\nIt was discovered that Node.js incorrectly handled certain NAPTR responses.\nA remote attacker could possibly use this issue to cause applications using\nNode.js to crash, resulting in a denial of service. This issue only affected\nUbuntu 16.04 ESM. (CVE-2017-1000381)\n\nNikita Skovoroda discovered that Node.js mishandled certain input, leading\nto an out of bounds write. An attacker could use this vulnerability to\ncause a denial of service (crash) or possibly execute arbitrary code. This\nissue only affected Ubuntu 18.04 ESM. (CVE-2018-12115)\n\nArkadiy Tetelman discovered that Node.js improperly handled certain\nmalformed HTTP requests. An attacker could use this vulnerability to inject\nunexpected HTTP requests. This issue only affected Ubuntu 18.04 ESM.\n(CVE-2018-12116)\n\nJan Maybach discovered that Node.js did not time out if incomplete\nHTTP/HTTPS headers were received. An attacker could use this vulnerability\nto cause a denial of service by keeping HTTP/HTTPS connections alive for a\nlong period of time. This issue only affected Ubuntu 18.04 ESM.\n(CVE-2018-12122)\n\nMartin Bajanik discovered that the url.parse() method would return\nincorrect results if it received specially crafted input. An attacker could\nuse this vulnerability to spoof the hostname and bypass hostname-specific\nsecurity controls. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12123)\n\nIt was discovered that Node.js is vulnerable to a DNS rebinding attack which\ncould be exploited to perform remote code execution. An attack is possible\nfrom malicious websites open in a web browser with network access to the system\nrunning the Node.js process. This issue only affected Ubuntu 18.04 ESM.\n(CVE-2018-7160)\n\nIt was discovered that the Buffer.fill() and Buffer.alloc() methods\nimproperly handled certain inputs. An attacker could use this vulnerability\nto cause a denial of service. This issue only affected Ubuntu 18.04 ESM.\n(CVE-2018-7167)\n\nMarco Pracucci discovered that Node.js mishandled HTTP and HTTPS\nconnections. An attacker could use this vulnerability to cause a denial of\nservice. This issue only affected Ubuntu 18.04 ESM. (CVE-2019-5737)\n","status":"published","published":"2021-03-15T21:18:37Z","modified":"2026-06-29T13:48:17.400849278Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}