{"id":"CVE-2017-12865","aliases":["DEBIAN-CVE-2017-12865","DLA-1078-1","DSA-3956-1","EUVD-2017-4397","GHSA-2f42-jv77-x675","MGASA-2018-0036","UBUNTU-CVE-2017-12865","openSUSE-SU-2024:10692-1"],"status":"published","title":"Stack-based buffer overflow in \"dnsproxy.c\" in connman 1.34 and earlier allows remote attackers...","description":"Stack-based buffer overflow in \"dnsproxy.c\" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the \"name\" variable.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05519,"percentile":0.92858,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119"],"published":"2017-08-27T00:00:00Z","modified":"2026-10-24T10:30:34Z","exploits":[{"source":"pocgithub","id":"ManaswiJaiswal/Reproducing-ConnMan-1.34","title":"ManaswiJaiswal/Reproducing-ConnMan-1.34","date":"2025-09-10","url":"https://github.com/ManaswiJaiswal/Reproducing-ConnMan-1.34"}],"fixes":[{"ecosystem":"Debian:12","package":"connman","fixed_in":["1.35-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"connman","fixed_in":["1.35-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"connman","fixed_in":["1.35-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"connman","fixed_in":["1.0-1.1+wheezy2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"connman","fixed_in":["1.21-1.2+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"connman","fixed_in":["1.33-3+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"connman","fixed_in":["1.24-4.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"connman","fixed_in":["1.33-6.1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"connman","fixed_in":["1.21-1.2+deb8u1build0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-1.1+wheezy2"}]}],"versions":["1.0-1.1+wheezy1"]},{"source":"osv","ecosystem":"Debian:8","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21-1.2+deb8u1"}]}],"versions":["1.21-1.2"]},{"source":"osv","ecosystem":"Debian:9","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33-3+deb9u1"}]}],"versions":["1.33-3"]},{"source":"osv","ecosystem":"Mageia:5","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-4.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33-6.1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21-1.2+deb8u1build0.16.04.1"}]}],"versions":["1.21-1.2","1.21-1.2build1","1.21-1.2build2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"connman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40-2.2"}]}],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"intel","product":"connman"}],"references":[{"url":"https://01.org/security/intel-oss-10001/intel-oss-10001","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1483720","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/201812-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.nri-secure.com/blog/new-iot-vulnerability-connmando","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/100498","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=5c281d182ecdd0a424b64f7698f32467f8f67b71","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"http://www.debian.org/security/2017/dsa-3956","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12865"},{"url":"https://github.com/advisories/GHSA-2f42-jv77-x675"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-12865","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0036.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21629","tags":["report"]},{"url":"https://www.debian.org/security/2017/dsa-3956","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-12865","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12865","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33833","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-12865","description":"Stack-based buffer overflow in \"dnsproxy.c\" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the \"name\" variable.","status":"published","published":"2017-08-29T16:00:00Z","modified":"2024-08-05T18:51:06.862Z","updated_at":"2026-11-02T14:33:17.264801Z"}],"euvd":[{"id":"EUVD-2017-4397","description":"Stack-based buffer overflow in \"dnsproxy.c\" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the \"name\" variable.","status":"published","published":"2017-08-29T16:00:00Z","modified":"2024-08-05T18:51:06Z","updated_at":"2026-11-03T02:23:20.155596Z"}],"ghsa":[{"id":"GHSA-2f42-jv77-x675","title":"Stack-based buffer overflow in \"dnsproxy.c\" in connman 1.34 and earlier allows remote attackers...","description":"Stack-based buffer overflow in \"dnsproxy.c\" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the \"name\" variable.","status":"published","published":"2022-05-13T01:27:59Z","modified":"2023-02-01T05:07:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:50:38.356016Z"}],"nvd":[{"id":"CVE-2017-12865","description":"Stack-based buffer overflow in \"dnsproxy.c\" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the \"name\" variable.","status":"published","published":"2017-08-29T16:29:00.217Z","modified":"2026-06-17T01:04:03.147Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:57.82609Z"}],"osv":[{"id":"CVE-2017-12865","description":"Stack-based buffer overflow in \"dnsproxy.c\" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the \"name\" variable.","status":"published","published":"2017-08-29T16:29:00.217Z","modified":"2026-10-24T10:30:34.025087199Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:04.159616Z"},{"id":"DEBIAN-CVE-2017-12865","description":"Stack-based buffer overflow in \"dnsproxy.c\" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the \"name\" variable.","status":"published","published":"2017-08-29T16:29:00.217Z","modified":"2026-09-01T20:03:42.415455897Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-12865","description":"Stack-based buffer overflow in \"dnsproxy.c\" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the \"name\" variable.","status":"published","published":"2017-08-29T16:29:00Z","modified":"2026-04-22T11:14:01.932451Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"DLA-1078-1","title":"connman - security update","status":"published","published":"2017-08-30T00:00:00Z","modified":"2026-03-09T01:01:58.937335Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-3956-1","title":"connman - security update","status":"published","published":"2017-08-27T00:00:00Z","modified":"2026-03-09T01:23:19.567344Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2018-0036","title":"Updated connman packages fix security vulnerability","description":"Security consultants in NRI Secure Technologies discovered a stack\noverflow vulnerability in ConnMan. An attacker with control of the DNS\nresponses to the DNS proxy in ConnMan might crash the service and, in same\ncases, remotely execute arbitrary commands in the host running the service\n(CVE-2017-12865)\n","status":"published","published":"2018-01-03T14:22:14Z","modified":"2026-04-16T06:24:50.523757533Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10692-1","title":"connman-1.40-2.2 on GA media","description":"These are all security issues fixed in the connman-1.40-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:09.262633Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}