USN-8844-1: c-ares vulnerability
Ubuntu patched c-ares after a callback bug that can cause use-after-free, denial of service, or code execution.
Ubuntu Security Notice USN-8844-1 says c-ares incorrectly handled certain query completion callbacks. An attacker could trigger a use-after-free or double-free, causing denial of service or arbitrary code execution. The notice does not name a CVE or report active exploitation.
- c-ares mishandles certain query completion callbacks.
- The bug can cause a use-after-free or double-free.
- Impact is denial of service or possible code execution.
- USN-8844-1 names no CVE and reports no exploitation.
From the original article
It was discovered that c-ares incorrectly handled certain query completion callbacks. An attacker could possibly use this issue to trigger a use- after-free or double-free, resulting in a denial of service or arbitrary code execution.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.