Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation.

A memory exhaustion flaw was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets which would trigger memory allocations which would never be freed, leading to unbounded memory consumption and eventually a crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet. (CVE-2017-14495)

An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet. (CVE-2017-14496)

A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute arbitrary code. (CVE-2017-14493)

An information leak was found in dnsmasq in the DHCPv6 relay code. An attacker on the local network could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory, potentially leaking sensitive data. (CVE-2017-14494)

A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement (RA) handling code. An attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. This issue only affected configurations using one of these options: enable-ra, ra-only, slaac, ra-names, ra-advrouter, or ra-stateless.
(CVE-2017-14492)

A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. (CVE-2017-14491)

According to the versions of the dnsmasq packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A heap buffer overflow was discovered in dnsmasq in the     IPv6 router advertisement (RA) handling code. An     attacker on the local network segment could send     crafted RAs to dnsmasq which would cause it to crash     or, potentially, execute arbitrary code. This issue     only affected configurations using one of these     options: enable-ra, ra-only, slaac, ra-names,     ra-advrouter, or ra-stateless.(CVE-2017-14492)

  - An information leak was found in dnsmasq in the DHCPv6     relay code. An attacker on the local network could send     crafted DHCPv6 packets to dnsmasq causing it to forward     the contents of process memory, potentially leaking     sensitive data.(CVE-2017-14494)

  - A heap buffer overflow was found in dnsmasq in the code     responsible for building DNS replies. An attacker could     send crafted DNS packets to dnsmasq which would cause     it to crash or, potentially, execute arbitrary     code.(CVE-2017-14491)

  - A memory exhaustion flaw was found in dnsmasq in the     EDNS0 code. An attacker could send crafted DNS packets     which would trigger memory allocations which would     never be freed, leading to unbounded memory consumption     and eventually a crash. This issue only affected     configurations using one of the options: add-mac,     add-cpe-id, or add-subnet.(CVE-2017-14495)

  - An integer underflow flaw leading to a buffer over-read     was found in dnsmasq in the EDNS0 code. An attacker     could send crafted DNS packets to dnsmasq which would     cause it to crash. This issue only affected     configurations using one of the options: add-mac,     add-cpe-id, or add-subnet.(CVE-2017-14496)

  - A stack buffer overflow was found in dnsmasq in the     DHCPv6 code. An attacker on the local network could     send a crafted DHCPv6 request to dnsmasq which would     cause it to a crash or, potentially, execute arbitrary     code.(CVE-2017-14493)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the dnsmasq packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An information leak was found in dnsmasq in the DHCPv6     relay code. An attacker on the local network could send     crafted DHCPv6 packets to dnsmasq causing it to forward     the contents of process memory, potentially leaking     sensitive data.(CVE-2017-14494)

  - A memory exhaustion flaw was found in dnsmasq in the     EDNS0 code. An attacker could send crafted DNS packets     which would trigger memory allocations which would     never be freed, leading to unbounded memory consumption     and eventually a crash. This issue only affected     configurations using one of the options: add-mac,     add-cpe-id, or add-subnet.(CVE-2017-14495)

  - An integer underflow flaw leading to a buffer over-read     was found in dnsmasq in the EDNS0 code. An attacker     could send crafted DNS packets to dnsmasq which would     cause it to crash. This issue only affected     configurations using one of the options: add-mac,     add-cpe-id, or add-subnet.(CVE-2017-14496)

  - A heap buffer overflow was found in dnsmasq in the code     responsible for building DNS replies. An attacker could     send crafted DNS packets to dnsmasq which would cause     it to crash or, potentially, execute arbitrary     code.(CVE-2017-14491)

  - A heap buffer overflow was discovered in dnsmasq in the     IPv6 router advertisement (RA) handling code. An     attacker on the local network segment could send     crafted RAs to dnsmasq which would cause it to crash     or, potentially, execute arbitrary code. This issue     only affected configurations using one of these     options: enable-ra, ra-only, slaac, ra-names,     ra-advrouter, or ra-stateless.(CVE-2017-14492)

  - A stack buffer overflow was found in dnsmasq in the     DHCPv6 code. An attacker on the local network could     send a crafted DHCPv6 request to dnsmasq which would     cause it to a crash or, potentially, execute arbitrary     code.(CVE-2017-14493)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the dnsmasq package has been released.

According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A memory exhaustion flaw was found in dnsmasq in the     EDNS0 code. An attacker could send crafted DNS packets     which would trigger memory allocations which would     never be freed, leading to unbounded memory consumption     and eventually a crash. This issue only affected     configurations using one of the options: add-mac,     add-cpe-id, or add-subnet. (CVE-2017-14495)

  - An integer underflow flaw leading to a buffer over-read     was found in dnsmasq in the EDNS0 code. An attacker     could send crafted DNS packets to dnsmasq which would     cause it to crash. This issue only affected     configurations using one of the options: add-mac,     add-cpe-id, or add-subnet. (CVE-2017-14496)

As this issue only affects configurations using the add-mac, add-cpe-id, or add-subnet options, and these are not enabled by default in dnsmasq on EulerOS, this vulnerability may not actively affect the system at this time, but has the potential to do so if the configuration changes. Updating the version of these packages is the safest course of action.

Note that Tenable Network Security has extracted most of the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories.

CVE-2017-14491 CVE-2017-14492 CVE-2017-14493 CVE-2017-14494 CVE-2017-14495 CVE-2017-14496

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201710-27 (Dnsmasq: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Dnsmasq. Please review       the references below for details.
  Impact :

    A remote attacker could execute arbitrary code or cause a Denial of       Service condition via crafted DNS, IPv6, or DHCPv6 packets.
  Workaround :

    There is no known workaround at this time.

The version of dnsmasq installed on the remote host is prior to 2.78, and thus, is affected by the following vulnerabilities :

  - Denial of service related to handling DNS queries     exceeding 512 bytes. (CVE-2017-13704)

  - Heap overflow related to handling DNS requests. (CVE-2017-14491)

  - Heap overflow related to IPv6 router advertisement handling.
    (CVE-2017-14492)

  - Stack overflow related to DHCPv6 request handling.
    (CVE-2017-14493)

  - Memory disclosure related to DHCPv6 packet handling.
    (CVE-2017-14494)

  - Denial of service related to handling DNS queries.
    (CVE-2017-14495)

  - Denial of service related to handling DNS queries.
    (CVE-2017-14496)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3430-1 advisory.

    Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly     handled DNS requests. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a     denial of service, or possibly execute arbitrary code. (CVE-2017-14491)

    Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly     handled IPv6 router advertisements. A remote attacker could use this issue to cause Dnsmasq to crash,     resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-14492)

    Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly     handled DHCPv6 requests. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a     denial of service, or possibly execute arbitrary code. (CVE-2017-14493)

    Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly     handled DHCPv6 packets. A remote attacker could use this issue to possibly obtain sensitive memory     contents. (CVE-2017-14494)

    Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly     handled DNS requests. A remote attacker could use this issue to cause Dnsmasq to consume memory, resulting     in a denial of service. (CVE-2017-14495)

    Felix Wilhelm, Fermin J. Serna, Gabriel Campana and Kevin Hamacher discovered that Dnsmasq incorrectly     handled DNS requests. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a     denial of service. (CVE-2017-14496)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for dnsmasq fixes the following security issues :

  - CVE-2017-14491: 2 byte heap based overflow.
    [bsc#1060354]

  - CVE-2017-14492: heap based overflow. [bsc#1060355]

  - CVE-2017-14493: stack based overflow. [bsc#1060360]

  - CVE-2017-14494: DHCP - info leak. [bsc#1060361]

  - CVE-2017-14495: DNS - OOM DoS. [bsc#1060362]

  - CVE-2017-14496: DNS - DoS Integer underflow.
    [bsc#1060364] This update brings a (small) potential     incompatibility in the handling of 'basename' in
    --pxe-service. Please read the CHANGELOG and the     documentation if you are using this option.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dnsmasq fixes the following security issues :

  - CVE-2017-14491: 2 byte heap based overflow.
    [bsc#1060354]

  - CVE-2017-14492: heap based overflow. [bsc#1060355]

  - CVE-2017-14493: stack based overflow. [bsc#1060360]

  - CVE-2017-14494: DHCP - info leak. [bsc#1060361]

  - CVE-2017-14495: DNS - OOM DoS. [bsc#1060362]

  - CVE-2017-14496: DNS - DoS Integer underflow.
    [bsc#1060364]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dnsmasq fixes the following issues. Remedy the following security issues :

  - CVE-2017-14491: 2 byte heap based overflow.
    [bsc#1060354]

  - CVE-2017-14492: heap based overflow. [bsc#1060355]

  - CVE-2017-14493: stack based overflow. [bsc#1060360]

  - CVE-2017-14494: DHCP - info leak. [bsc#1060361]

  - CVE-2017-14495: DNS - OOM DoS. [bsc#1060362]

  - CVE-2017-14496: DNS - DoS Integer underflow.
    [bsc#1060364]

  - Prevent a man-in-the-middle attack (bsc#972164,     fate#321175). Furthermore, the following issues have     been fixed :

  - Fix DHCP relaying, broken in 2.76 and 2.77.

  - Update to version 2.78 (fate#321175, fate#322030,     bsc#1035227).

  - Fix PXE booting for UEFI architectures (fate#322030).

  - Drop PrivateDevices=yes which breaks logging     (bsc#902511, bsc#904537)

  - Build with support for DNSSEC (fate#318323, bsc#908137).
    Please note that this update brings a (small) potential     incompatibility in the handling of 'basename' in
    --pxe-service. Please read the CHANGELOG and the     documentation if you are using this option.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A heap buffer overflow was found in dnsmasq in the code     responsible for building DNS replies. An attacker could     send crafted DNS packets to dnsmasq which would cause it     to crash or, potentially, execute arbitrary code.
    (CVE-2017-14491)

  - A heap buffer overflow was discovered in dnsmasq in the     IPv6 router advertisement (RA) handling code. An     attacker on the local network segment could send crafted     RAs to dnsmasq which would cause it to crash or,     potentially, execute arbitrary code. This issue only     affected configurations using one of these options:
    enable-ra, ra-only, slaac, ra- names, ra-advrouter, or     ra-stateless. (CVE-2017-14492)

  - A stack-based buffer overflow was found in dnsmasq in     the DHCPv6 code. An attacker on the local network could     send a crafted DHCPv6 request to dnsmasq which would     cause it to a crash or, potentially, execute arbitrary     code. (CVE-2017-14493)

  - An information leak was found in dnsmasq in the DHCPv6     relay code. An attacker on the local network could send     crafted DHCPv6 packets to dnsmasq causing it to forward     the contents of process memory, potentially leaking     sensitive data. (CVE-2017-14494)

  - A memory exhaustion flaw was found in dnsmasq in the     EDNS0 code. An attacker could send crafted DNS packets     which would trigger memory allocations which would never     be freed, leading to unbounded memory consumption and     eventually a crash. This issue only affected     configurations using one of the options: add-mac,     add-cpe-id, or add- subnet. (CVE-2017-14495)

  - An integer underflow flaw leading to a buffer over-read     was found in dnsmasq in the EDNS0 code. An attacker     could send crafted DNS packets to dnsmasq which would     cause it to crash. This issue only affected     configurations using one of the options: add-mac,     add-cpe-id, or add- subnet. (CVE-2017-14496)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2836 advisory.

    The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic     Host Configuration Protocol) server.

    Security Fix(es):

    * A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An     attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute     arbitrary code. (CVE-2017-14491)

    * A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement (RA) handling code. An     attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash or,     potentially, execute arbitrary code. This issue only affected configurations using one of these options:
    enable-ra, ra-only, slaac, ra-names, ra-advrouter, or ra-stateless. (CVE-2017-14492)

    * A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could     send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute     arbitrary code. (CVE-2017-14493)

    * An information leak was found in dnsmasq in the DHCPv6 relay code. An attacker on the local network     could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory,     potentially leaking sensitive data. (CVE-2017-14494)

    * A memory exhaustion flaw was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS     packets which would trigger memory allocations which would never be freed, leading to unbounded memory     consumption and eventually a crash. This issue only affected configurations using one of the options: add-     mac, add-cpe-id, or add-subnet. (CVE-2017-14495)

    * An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An     attacker could send crafted DNS packets to dnsmasq which would cause it to crash. This issue only affected     configurations using one of the options: add-mac, add-cpe-id, or add-subnet. (CVE-2017-14496)

    Red Hat would like to thank Felix Wilhelm (Google Security Team), Fermin J. Serna (Google Security Team),     Gabriel Campana (Google Security Team), Kevin Hamacher (Google Security Team), and Ron Bowes (Google     Security Team) for reporting these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2836 advisory.

    - Small correction of CVE-2017-14491
    - Fix CVE-2017-14491
    - Fix CVE-2017-14492
    - Fix CVE-2017-14493
    - Fix CVE-2017-14494
    - Fix CVE-2017-14496
    - Fix CVE-2017-14495

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for dnsmasq fixes the following security issues :

  - CVE-2017-14491: 2 byte heap based overflow.
    [bsc#1060354]

  - CVE-2017-14492: heap based overflow. [bsc#1060355]

  - CVE-2017-14493: stack based overflow. [bsc#1060360]

  - CVE-2017-14494: DHCP - info leak. [bsc#1060361]

  - CVE-2017-14495: DNS - OOM DoS. [bsc#1060362]

  - CVE-2017-14496: DNS - DoS Integer underflow.
    [bsc#1060364]

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Google Project Zero reports :

- CVE-2017-14491: Heap based overflow (2 bytes). Before 2.76 and this commit overflow was unrestricted.

- CVE-2017-14492: Heap based overflow.

- CVE-2017-14493: Stack Based overflow.

- CVE-2017-14494: Information Leak

- CVE-2017-14495: Lack of free()

- CVE-2017-14496: Invalid boundary checks. Integer underflow leading to a huge memcpy.

- CVE-2017-13704: Crash on large DNS query

Felix Wilhelm, Fermin J. Serna, Gabriel Campana, Kevin Hamacher, Ron Bowes and Gynvael Coldwind of the Google Security Team discovered several vulnerabilities in dnsmasq, a small caching DNS proxy and DHCP/TFTP server, which may result in denial of service, information leak or the execution of arbitrary code.

An update for dnsmasq is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.

Security Fix(es) :

* A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. (CVE-2017-14491)

* A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement (RA) handling code. An attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. This issue only affected configurations using one of these options: enable-ra, ra-only, slaac, ra-names, ra-advrouter, or ra-stateless.
(CVE-2017-14492)

* A stack-based buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute arbitrary code. (CVE-2017-14493)

* An information leak was found in dnsmasq in the DHCPv6 relay code.
An attacker on the local network could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory, potentially leaking sensitive data. (CVE-2017-14494)

* A memory exhaustion flaw was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets which would trigger memory allocations which would never be freed, leading to unbounded memory consumption and eventually a crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet. (CVE-2017-14495)

* An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet. (CVE-2017-14496)

Red Hat would like to thank Felix Wilhelm (Google Security Team), Fermin J. Serna (Google Security Team), Gabriel Campana (Google Security Team), Kevin Hamacher (Google Security Team), and Ron Bowes (Google Security Team) for reporting these issues.

Information leak in the DHCPv6 relay code

An information leak was found in dnsmasq in the DHCPv6 relay code. An attacker on the local network could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory, potentially leaking sensitive data. (CVE-2017-14494)

Memory exhaustion vulnerability in the EDNS0 code

A memory exhaustion flaw was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets which would trigger memory allocations which would never be freed, leading to unbounded memory consumption and eventually a crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet. (CVE-2017-14495)

Integer underflow leading to buffer over-read in the EDNS0 code

An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash. This issue only affected configurations using one of the options: add-mac, add-cpe-id, or add-subnet. (CVE-2017-14496)

Heap overflow in the code responsible for building DNS replies

A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. (CVE-2017-14491)

Heap overflow in the IPv6 router advertisement code

A heap buffer overflow was discovered in dnsmasq in the IPv6 router advertisement (RA) handling code. An attacker on the local network segment could send crafted RAs to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. This issue only affected configurations using one of these options: enable-ra, ra-only, slaac, ra-names, ra-advrouter, or ra-stateless.
(CVE-2017-14492)

Stack buffer overflow in the DHCPv6 code

A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute arbitrary code. (CVE-2017-14493)

New dnsmasq packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

ID	Name	Product	Family	Severity
126963	Amazon Linux 2 : dnsmasq (ALAS-2019-1251)	Nessus	Amazon Linux Local Security Checks	critical
124926	EulerOS Virtualization 3.0.1.0 : dnsmasq (EulerOS-SA-2019-1423)	Nessus	Huawei Local Security Checks	critical
124883	EulerOS Virtualization for ARM 64 3.0.1.0 : dnsmasq (EulerOS-SA-2019-1380)	Nessus	Huawei Local Security Checks	critical
121733	Photon OS 1.0: Dnsmasq PHSA-2017-0035	Nessus	PhotonOS Local Security Checks	critical
117729	EulerOS 2.0 SP2 : dnsmasq (EulerOS-SA-2018-1285)	Nessus	Huawei Local Security Checks	high
109037	pfSense < 2.3.5 Multiple Vulnerabilities (KRACK)	Nessus	Firewalls	critical
105901	Fedora 27 : dnsmasq (2017-7106a157f5)	Nessus	Fedora Local Security Checks	critical
104110	Fedora 25 : dnsmasq (2017-515264ae24)	Nessus	Fedora Local Security Checks	critical
104070	GLSA-201710-27 : Dnsmasq: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
103888	Fedora 26 : dnsmasq (2017-24f067299e)	Nessus	Fedora Local Security Checks	critical
103647	dnsmasq < 2.78 Multiple Remote Vulnerabilities	Nessus	DNS	critical
103641	Ubuntu 14.04 LTS / 16.04 LTS : Dnsmasq vulnerabilities (USN-3430-1)	Nessus	Ubuntu Local Security Checks	critical
103640	SUSE SLES11 Security Update : dnsmasq (SUSE-SU-2017:2619-1)	Nessus	SuSE Local Security Checks	critical
103639	SUSE SLED12 / SLES12 Security Update : dnsmasq (SUSE-SU-2017:2618-1)	Nessus	SuSE Local Security Checks	critical
103638	SUSE SLES11 Security Update : dnsmasq (SUSE-SU-2017:2617-1)	Nessus	SuSE Local Security Checks	critical
103637	SUSE SLES12 Security Update : dnsmasq (SUSE-SU-2017:2616-1)	Nessus	SuSE Local Security Checks	critical
103635	Scientific Linux Security Update : dnsmasq on SL7.x x86_64 (20171002)	Nessus	Scientific Linux Local Security Checks	critical
103628	RHEL 7 : dnsmasq (RHSA-2017:2836)	Nessus	Red Hat Local Security Checks	critical
103625	Oracle Linux 7 : dnsmasq (ELSA-2017-2836)	Nessus	Oracle Linux Local Security Checks	critical
103623	openSUSE Security Update : dnsmasq (openSUSE-2017-1116)	Nessus	SuSE Local Security Checks	critical
103620	FreeBSD : dnsmasq -- multiple vulnerabilities (b77b5646-a778-11e7-ac58-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical
103608	Debian DSA-3989-1 : dnsmasq - security update	Nessus	Debian Local Security Checks	critical
103605	CentOS 7 : dnsmasq (CESA-2017:2836)	Nessus	CentOS Local Security Checks	critical
103604	Amazon Linux AMI : dnsmasq (ALAS-2017-907)	Nessus	Amazon Linux Local Security Checks	critical
103599	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : dnsmasq (SSA:2017-275-01)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2017-14495

high

Tenable Plugins

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical