{"id":"CVE-2017-9108","aliases":["DEBIAN-CVE-2017-9108","EUVD-2017-18046","GHSA-33h2-rv7w-ppfj","SUSE-SU-2020:14399-1","SUSE-SU-2020:1612-1","UBUNTU-CVE-2017-9108","openSUSE-SU-2020:0827-1","openSUSE-SU-2024:10612-1"],"status":"published","title":"An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a...","description":"An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0218,"percentile":0.82478,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2020-06-12T07:44:06Z","modified":"2026-09-01T20:03:51Z","fixes":[{"ecosystem":"Debian:12","package":"adns","fixed_in":["1.6.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"adns","fixed_in":["1.6.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"adns","fixed_in":["1.6.0-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-75.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-75.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.0~rc1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.0~rc1-1ubuntu1","1.5.0~rc1-1.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.1-0.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-lp151.3.3.1"}]}],"bundled":7}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnu","product":"adns"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/"},{"url":"http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git;a=blob;f=changelog"},{"url":"https://github.com/advisories/GHSA-33h2-rv7w-ppfj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9108","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014399-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172265","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9109","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201612-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-9108","tags":["report"]},{"url":"http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git;a=commit;h=72c6bfd77dfdb34457a792874fd1c3030fca90ac","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9108","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YGJFYTAXD5VI2C7KYA7GUUEJEHU4KNK3/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1447","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-9108","description":"An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.","status":"published","published":"2020-06-18T13:05:46Z","modified":"2024-08-05T16:55:22.246Z","updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-18046","description":"An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.","status":"published","published":"2020-06-18T13:05:46Z","modified":"2024-08-05T16:55:22Z","updated_at":"2026-11-03T02:23:29.187521Z"}],"ghsa":[{"id":"GHSA-33h2-rv7w-ppfj","title":"An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a...","description":"An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.","status":"published","published":"2022-05-24T17:20:50Z","modified":"2023-01-27T21:31:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:43:22.817498Z"}],"nvd":[{"id":"CVE-2017-9108","description":"An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.","status":"published","published":"2020-06-18T14:15:10.593Z","modified":"2026-06-17T01:27:29.387Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:21.160774Z"}],"osv":[{"id":"CVE-2017-9108","description":"An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.","status":"published","published":"2020-06-18T14:15:10.593Z","modified":"2026-03-15T22:18:03.640792Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-9108","description":"An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.","status":"published","published":"2020-06-18T14:15:10.593Z","modified":"2026-09-01T20:03:51.388650365Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-9108","description":"An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte.","status":"published","published":"2020-06-18T14:15:00Z","modified":"2026-04-22T11:34:51.921413Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"openSUSE-SU-2020:0827-1","title":"Security update for adns","description":"This update for adns fixes the following issues:\n\n- CVE-2017-9103,CVE-2017-9104,CVE-2017-9105,CVE-2017-9109: Fixed an issue in local recursive resolver\n  which could have led to remote code execution (bsc#1172265).\n- CVE-2017-9106: Fixed an issue with upstream DNS data sources which could have led to denial of \n  service (bsc#1172265).\n- CVE-2017-9107: Fixed an issue when quering domain names which could have led to denial of service (bsc#1172265).\n- CVE-2017-9108: Fixed an issue which could have led to denial of service (bsc#1172265).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-06-17T16:19:06Z","modified":"2026-02-04T02:58:49.356519Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10612-1","title":"adns-1.6.0-1.8 on GA media","description":"These are all security issues fixed in the adns-1.6.0-1.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:24:29.174565Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:14399-1","title":"Security update for adns","description":"This update for adns fixes the following issues:\n\n- CVE-2017-9103,CVE-2017-9104,CVE-2017-9105,CVE-2017-9109: Fixed an issue in local recursive resolver\n  which could have led to remote code execution (bsc#1172265).\n- CVE-2017-9106: Fixed an issue with upstream DNS data sources which could have led to denial of \n  service (bsc#1172265).\n- CVE-2017-9107: Fixed an issue when quering domain names which could have led to denial of service (bsc#1172265).\n- CVE-2017-9108: Fixed an issue which could have led to denial of service (bsc#1172265).\t  \n","status":"published","published":"2020-06-18T11:43:19Z","modified":"2026-02-04T03:59:27.750619Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1612-1","title":"Security update for adns","description":"This update for adns fixes the following issues:\n\t  \n- CVE-2017-9103,CVE-2017-9104,CVE-2017-9105,CVE-2017-9109: Fixed an issue in local recursive resolver\n  which could have led to remote code execution (bsc#1172265).\n- CVE-2017-9106: Fixed an issue with upstream DNS data sources which could have led to denial of \n  service (bsc#1172265).\n- CVE-2017-9107: Fixed an issue when quering domain names which could have led to denial of service (bsc#1172265).\n- CVE-2017-9108: Fixed an issue which could have led to denial of service (bsc#1172265).\n","status":"published","published":"2020-06-12T07:44:06Z","modified":"2026-02-04T02:48:06.743519Z","updated_at":"2026-11-02T15:53:47.634847Z"}]}}