Security Update for ldns
Summary
DLA-1182-1: ldns - security update. Affects ldns versions < 1.6.13-1+deb7u2. Fixed in 1.6.13-1+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ldns is a library and collection of utilities for DNS programming. It provides a set of functions for querying DNS servers, constructing DNS packets, and parsing DNS data. The ldns library is widely used in various applications that require DNS functionality.
Vulnerability Detail
A double-free vulnerability (CVE-2017-1000231) has been discovered in the generic parser of ldns. This vulnerability could lead to an application crash and potentially have unspecified impacts and attack vectors. The double-free vulnerability occurs when a program tries to free the same memory location twice, which can result in memory corruption and unexpected behavior.
How To Fix
Minimum fixed version
1.6.13-1+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ldnsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to ensure the integrity and security of the ldns library.
Conclusion
In conclusion, ldns is affected by a double-free vulnerability that can lead to an application crash and potential security risks. It is crucial to upgrade the ldns package to version 1.6.13-1+deb7u2 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ldns →
FAQ
ldns is a library and collection of utilities for DNS programming. It provides functions for querying DNS servers, constructing DNS packets, and parsing DNS data.
A double-free vulnerability occurs when a program tries to free the same memory location twice. This can lead to memory corruption and unexpected behavior.
The impact of this vulnerability is unspecified, but it can result in an application crash and potentially have other attack vectors.
To fix this vulnerability, you need to upgrade the ldns package to version 1.6.13-1+deb7u2 or later.
No, there is no known workaround for this vulnerability. It is recommended to apply the security update.
Related vulnerabilities
Recent vulnerabilities recorded for ldns.
