{"id":"CVE-2018-1046","aliases":["DEBIAN-CVE-2018-1046","EUVD-2018-11702","GHSA-622f-mfw7-jxg6","MGASA-2018-0255","SUSE-SU-2018:1660-1","UBUNTU-CVE-2018-1046","USN-7203-1","openSUSE-SU-2018:1462-1","openSUSE-SU-2024:11156-1"],"status":"published","title":"pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool...","description":"pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.","severity":{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01411,"percentile":0.72861,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2018-05-24T16:30:31Z","modified":"2026-10-24T10:30:59Z","fixes":[{"ecosystem":"Debian:12","package":"pdns","fixed_in":["4.1.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pdns","fixed_in":["4.1.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pdns","fixed_in":["4.1.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"pdns","fixed_in":["4.1.2-1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"pdns","fixed_in":["4.1.2-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"pdns","fixed_in":["4.1.2-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pdns","fixed_in":["4.1.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 12 SP1","package":"pdns","fixed_in":["4.1.2-8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1ubuntu0.1~esm1"}]}],"versions":["4.0.4-2","4.0.4-2build1","4.0.5-1","4.1.0-1","4.1.0-2","4.1.0-2build1","4.1.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0~alpha2-3ubuntu0.1~esm1"}]}],"versions":["3.4.5-1build2","3.4.6-2","3.4.6-3","3.4.7-1","3.4.7-2","4.0.0~alpha1-1","4.0.0~alpha2-2","4.0.0~alpha2-3","4.0.0~alpha2-3build1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0~alpha2-2ubuntu0.1+esm1"}]}],"versions":["3.7.3-1","4.0.0~alpha1-1","4.0.0~alpha1-2","4.0.0~alpha2-2","4.0.0~alpha2-2ubuntu0.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1ubuntu0.1~esm1"}]}],"versions":["4.0.4-2","4.0.4-2build1","4.0.5-1","4.1.0-1","4.1.0-2","4.1.0-2build1","4.1.1-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-2ubuntu0.1~esm1"}]}],"versions":["4.0.6-1","4.0.6-1build1","4.0.7-1","4.1.1-1","4.1.1-1build1","4.1.1-2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1ubuntu0.1~esm1"}]}],"versions":["4.1.6-3build1","4.2.0-1","4.2.1-1","4.2.1-1build1","4.2.1-1build2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1ubuntu0.1~esm1"}]}],"versions":["4.2.0-6","4.2.1-1","4.2.1-1build1","4.2.1-1build2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-1ubuntu0.1~esm1"}]}],"versions":["4.4.1-1build1","4.4.1-3","4.4.1-4","4.5.2-1build1","4.5.3-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-1ubuntu1+esm1"}]}],"versions":["4.4.2-3","4.6.0-1ubuntu1"],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 12 SP1","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1.5"}]}],"bundled":16}],"products":[{"vendor":"[unknown]","product":"pdns"},{"vendor":"debian","product":"pdns"},{"vendor":"powerdns","product":"pdns"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1046","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1046"},{"url":"https://github.com/advisories/GHSA-622f-mfw7-jxg6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1046","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0255.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23009","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2018/05/09/2","tags":["web"]},{"url":"https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-02.html","tags":["advisory","report"]},{"url":"https://blog.powerdns.com/2018/05/08/authoritative-server-4-1-2-released/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181660-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092540","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1046","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-1046","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1046","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7203-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-10851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-17482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-27227","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HQSPXZY2QFCLZMVTDYNDOWYILQUQS6NR/#HQSPXZY2QFCLZMVTDYNDOWYILQUQS6NR","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36754","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1046","description":"pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.","status":"published","published":"2018-07-16T20:00:00Z","modified":"2024-08-05T03:44:11.842Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2018-11702","description":"pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.","status":"published","published":"2018-07-16T20:00:00Z","modified":"2024-08-05T03:44:11Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T02:40:17.442322Z"}],"ghsa":[{"id":"GHSA-622f-mfw7-jxg6","title":"pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool...","description":"pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.","status":"published","published":"2022-05-13T01:17:47Z","modified":"2023-02-01T05:05:26Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:14.84305Z"}],"nvd":[{"id":"CVE-2018-1046","description":"pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.","status":"published","published":"2018-07-16T20:29:00.317Z","modified":"2026-06-17T01:50:21.55Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:04:32.929986Z"}],"osv":[{"id":"CVE-2018-1046","description":"pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.","status":"published","published":"2018-07-16T20:29:00.317Z","modified":"2026-10-24T10:30:59.783524459Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-1046","description":"pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.","status":"published","published":"2018-07-16T20:29:00.317Z","modified":"2026-10-23T18:02:56.32772769Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-1046","description":"pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, replaying a specially crafted PCAP file can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the -ecs-stamp option of dnsreplay is used.","status":"published","published":"2018-07-16T20:29:00Z","modified":"2026-02-04T03:53:22.092181Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"MGASA-2018-0255","title":"Updated pdns packages fix security vulnerability","description":"A stack-based buffer overflow in the dnsreplay tool occurring when\nreplaying a specially crafted PCAP file with the `--ecs-stamp` option\nenabled, leading to a denial of service or potentially arbitrary code\nexecution (CVE-2018-1046).\n","status":"published","published":"2018-05-24T16:30:31Z","modified":"2026-04-16T06:25:37.748461341Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2018:1462-1","title":"Security update for pdns","description":"\npdns was updated to 4.1.2.\n\nSecurity fixes:\n\n* Dnsreplay: bail out on a too small outgoing buffer (CVE-2018-1046 bsc#1092540)\n\nImprovements:\n\n* API: increase serial after dnssec related updates\n* Auth: lower ‘packet too short’ loglevel\n* Make check-zone error on rows that have content but shouldn’t\n* Auth: avoid an isane amount of new backend connections during an axfr\n* Report unparseable data in stoul invalid_argument exception\n* Backport: recheck serial when axfr is done\n* Backport: add tcp support for alias\n\nBug Fixes:\n\n* Auth: allocate new statements after reconnecting to postgresql\n* Auth-bindbackend: only compare ips in ismaster() (Kees Monshouwer)\n* Rather than crash, sheepishly report no file/linenum\n* Document undocumented config vars\n* Backport #6276 (auth 4.1.x): prevent cname + other data with dnsupdate\n\nMisc fixes:\n\n* Move includes around to avoid boost L conflict\n* Backport: update edns option code list\n* Auth: link dnspcap2protobuf against librt when needed\n* Fix a warning on botan \u0026gt;= 2.5.0\n* Auth 4.1.x: unbreak build\n\n","status":"published","published":"2018-05-29T10:59:00Z","modified":"2026-02-04T02:24:49.338244Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:11156-1","title":"pdns-4.5.1-1.5 on GA media","description":"These are all security issues fixed in the pdns-4.5.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:39:47.285231Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:1660-1","title":"Security update for pdns","description":"This update for pdns fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1046: Fix an issue with replaying a specially crafted PCAP file that can trigger a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution (bsc#1092540).\n  ","status":"published","published":"2018-06-12T13:46:17Z","modified":"2026-02-04T03:08:09.493326Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-7203-1","title":"pdns, pdns-recursor vulnerabilities","description":"Wei Hao discovered that PowerDNS Authoritative Server incorrectly handled\nmemory when accessing certain files. An attacker could possibly use this\nissue to achieve arbitrary code execution. (CVE-2018-1046)\n\nIt was discovered that PowerDNS Authoritative Server and PowerDNS Recursor\nincorrectly handled memory when receiving certain remote input. An attacker\ncould possibly use this issue to cause denial of service. (CVE-2018-10851)\n\nKees Monshouwer discovered that PowerDNS Authoritative Server and PowerDNS\nRecursor incorrectly handled request validation after having cached\nmalformed input. An attacker could possibly use this issue to cause denial\nof service. (CVE-2018-14626)\n\nToshifumi Sakaguchi discovered that PowerDNS Recursor incorrectly handled\nrequests after having cached malformed input. An attacker could possibly\nuse this issue to cause denial of service. (CVE-2018-14644)\n\nNathaniel Ferguson discovered that PowerDNS Authoritative Server\nincorrectly handled memory when receiving certain remote input. An attacker\ncould possibly use this issue to obtain sensitive information.\n(CVE-2020-17482)\n\nNicolas Dehaine and Dmitry Shabanov discovered that PowerDNS Authoritative\nServer and PowerDNS Recursor incorrectly handled IXFR requests in certain\ncircumstances. An attacker could possibly use this issue to cause denial of\nservice. (CVE-2022-27227)\n","status":"published","published":"2025-01-14T13:40:35Z","modified":"2026-06-25T13:32:30.073988287Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}