[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <2ccbcc13-fc25-484c-a34d-56f27ac87db7@oracle.com>
Date: Mon, 27 Oct 2025 09:34:03 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Questionable CVE's reported against dnsmasq
Among the new CVE's published this weekend were these from the VulDB CNA:
CVE-2025-12198
A vulnerability has been found in dnsmasq up to 2.73rc6. Affected is the
function parse_hex of the file src/util.c of the component Config File
Handler. The manipulation of the argument i leads to heap-based buffer
overflow. Local access is required to approach this attack. The exploit
has been disclosed to the public and may be used. The vendor was
contacted early about this disclosure but did not respond in any way.
https://shimo.im/docs/1d3aMVMmNmiLjg3g/read
CVE-2025-12199
A vulnerability was found in dnsmasq up to 2.73rc6. Affected by this
vulnerability is the function check_servers of the file src/network.c
of the component Config File Handler. The manipulation results in null
pointer dereference. The attack needs to be approached locally. The exploit
has been made public and could be used. The vendor was contacted early about
this disclosure but did not respond in any way.
https://shimo.im/docs/ZzkLMVMN7vIYJBAQ/read
CVE-2025-12200
A vulnerability was determined in dnsmasq up to 2.73rc6. Affected by this
issue is the function parse_dhcp_opt of the file src/option.c of the
component Config File Handler. This manipulation of the argument m causes
null pointer dereference. The attack can only be executed locally. The
exploit has been publicly disclosed and may be utilized. The vendor was
contacted early about this disclosure but did not respond in any way.
https://shimo.im/docs/5xkGoMo0WVfY4dkX/read
For all three bugs, the documented "exploit" requires "Replace the default
configuration file (/etc/dnsmasq.conf) with the provided malicious file."
and if you can replace the server's configuration file you don't need to
play games with putting invalid contents in to break the parser, but can
simply change the configuration directly.
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
