{"id":"CVE-2017-9109","aliases":["DEBIAN-CVE-2017-9109","EUVD-2017-18047","GHSA-4429-757q-f87q","SUSE-SU-2020:14399-1","SUSE-SU-2020:1612-1","UBUNTU-CVE-2017-9109","openSUSE-SU-2020:0827-1"],"status":"published","title":"An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the...","description":"An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02044,"percentile":0.8131,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2020-06-12T07:44:06Z","modified":"2026-09-01T20:03:05Z","fixes":[{"ecosystem":"Debian:12","package":"adns","fixed_in":["1.6.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"adns","fixed_in":["1.6.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"adns","fixed_in":["1.6.0-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-75.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-75.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-103.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.0~rc1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.0~rc1-1ubuntu1","1.5.0~rc1-1.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.1-0.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"adns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-lp151.3.3.1"}]}],"bundled":7}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnu","product":"adns"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00037.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9109"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/"},{"url":"http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git;a=blob;f=changelog"},{"url":"https://github.com/advisories/GHSA-4429-757q-f87q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9109","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014399-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172265","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9109","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201612-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-9109","tags":["report"]},{"url":"http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git;a=commit;h=fcf2b4e1faf22accb6184cca595aaee602839868","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9109","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YGJFYTAXD5VI2C7KYA7GUUEJEHU4KNK3/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-9109","description":"An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct.","status":"published","published":"2020-06-18T13:02:11Z","modified":"2024-08-05T16:55:22.271Z","updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-18047","description":"An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct.","status":"published","published":"2020-06-18T13:02:11Z","modified":"2024-08-05T16:55:22Z","updated_at":"2026-11-03T02:23:29.187521Z"}],"ghsa":[{"id":"GHSA-4429-757q-f87q","title":"An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the...","description":"An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct.","status":"published","published":"2022-05-24T17:20:50Z","modified":"2023-02-04T05:06:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:53:58.500745Z"}],"nvd":[{"id":"CVE-2017-9109","description":"An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct.","status":"published","published":"2020-06-18T14:15:10.64Z","modified":"2026-06-17T01:27:29.51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:21.160774Z"}],"osv":[{"id":"CVE-2017-9109","description":"An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct.","status":"published","published":"2020-06-18T14:15:10.64Z","modified":"2026-03-15T22:18:03.533665Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-9109","description":"An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct.","status":"published","published":"2020-06-18T14:15:10.64Z","modified":"2026-09-01T20:03:05.299732865Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-9109","description":"An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct.","status":"published","published":"2020-06-18T14:15:00Z","modified":"2026-04-22T11:34:54.226768Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"openSUSE-SU-2020:0827-1","title":"Security update for adns","description":"This update for adns fixes the following issues:\n\n- CVE-2017-9103,CVE-2017-9104,CVE-2017-9105,CVE-2017-9109: Fixed an issue in local recursive resolver\n  which could have led to remote code execution (bsc#1172265).\n- CVE-2017-9106: Fixed an issue with upstream DNS data sources which could have led to denial of \n  service (bsc#1172265).\n- CVE-2017-9107: Fixed an issue when quering domain names which could have led to denial of service (bsc#1172265).\n- CVE-2017-9108: Fixed an issue which could have led to denial of service (bsc#1172265).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-06-17T16:19:06Z","modified":"2026-02-04T02:58:49.356519Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2020:14399-1","title":"Security update for adns","description":"This update for adns fixes the following issues:\n\n- CVE-2017-9103,CVE-2017-9104,CVE-2017-9105,CVE-2017-9109: Fixed an issue in local recursive resolver\n  which could have led to remote code execution (bsc#1172265).\n- CVE-2017-9106: Fixed an issue with upstream DNS data sources which could have led to denial of \n  service (bsc#1172265).\n- CVE-2017-9107: Fixed an issue when quering domain names which could have led to denial of service (bsc#1172265).\n- CVE-2017-9108: Fixed an issue which could have led to denial of service (bsc#1172265).\t  \n","status":"published","published":"2020-06-18T11:43:19Z","modified":"2026-02-04T03:59:27.750619Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1612-1","title":"Security update for adns","description":"This update for adns fixes the following issues:\n\t  \n- CVE-2017-9103,CVE-2017-9104,CVE-2017-9105,CVE-2017-9109: Fixed an issue in local recursive resolver\n  which could have led to remote code execution (bsc#1172265).\n- CVE-2017-9106: Fixed an issue with upstream DNS data sources which could have led to denial of \n  service (bsc#1172265).\n- CVE-2017-9107: Fixed an issue when quering domain names which could have led to denial of service (bsc#1172265).\n- CVE-2017-9108: Fixed an issue which could have led to denial of service (bsc#1172265).\n","status":"published","published":"2020-06-12T07:44:06Z","modified":"2026-02-04T02:48:06.743519Z","updated_at":"2026-11-02T15:53:47.634847Z"}]}}