[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <87jyt8fca3.fsf@gentoo.org>
Date: Wed, 13 May 2026 00:17:40 +0100
From: Sam James <sam@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: dnsmasq vulnerabilities, including attacker DNS
redirect, privilege escalation, and heap manipulation
Alan Coopersmith <alan.coopersmith@...cle.com> writes:
> https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html
> announces:
>> Today, 11th May 2026 CERT is releasing a set of six CVEs for serious
>> security vulnerabilities in dnsmasq. These are all long-standing
>> bugs which apply to pretty much all non-ancient versions. The CVE
>> has been pre-disclosed to vendors, so hopefully they will be
>> releasing patched versions of their dnsmasq packages in a timely
>> manner.
>> Details and patches are available on the website at
>> https://thekelleys.org.uk/dnsmasq/CVE/
>> and I have made "2.92rel2" release of the current 2.92 dnsmasq
>> stable release which is downloadable from the usual place and has
>> had these patches applied.
>>
>> [...]
>>
>> Thank you to the reporters for discovering these vulnerabilities:
>> * Hugo Martinez (hugomray@...il.com) - CVE-2026-5172, CVE-2026-2291
>> * Andrew Fasano (NIST) - CVE-2026-2291
>> * Royce M (royce@...glabs.com) - CVE-2026-4893, CVE-2026-4892, CVE-2026-4891,
>> CVE-2026-4890, CVE-2026-2291
Writeup for these 5 is available at https://xchglabs.com/blog/dnsmasq-five-cves.html
>> * Asim Viladi Oglu Manizada - CVE-2026-4892
>> * Mattia Ricciardi (mindless) - CVE-2026-2291
Download attachment "signature.asc" of type "application/pgp-signature" (419 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
