[Git][security-tracker-team/security-tracker][master] new c-ares issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d9364930 by Moritz Muehlenhoff at 2026-10-28T19:01:53+01:00
new c-ares issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,55 @@
+CVE-2026-XXXX [Memory corruption when an application cancels its lookups after a connection failure]
+	- c-ares 1.34.9-1
+	NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-wpr3-8q3r-4q8c
+	NOTE: https://github.com/c-ares/c-ares/commit/7f408deb128fbdcce78122322734ffaa01cad9ae (v1.34.9)
+	NOTE: https://github.com/c-ares/c-ares/commit/f944c4718fd672c9c0befd65a340abb2ccfc1a31 (v1.34.9)
+CVE-2026-XXXX [A DNS reply that arrived from a different server than the one queried could be accepted]
+	- c-ares 1.34.9-1
+	NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-fqh5-3x7m-wp44
+	NOTE: https://github.com/c-ares/c-ares/commit/c8bd9ab53329f66ec0c395a11002a5696669b147 (v1.34.9)
+	NOTE: https://github.com/c-ares/c-ares/commit/c7fa9ebcb0c0086730c53bf03191c03f03706246 (v1.34.9)
+CVE-2026-XXXX [Use-after-free of a lookup after shutting down a failed connection]
+	- c-ares 1.34.9-1
+	NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-97vq-4mxv-7vhm
+	NOTE: https://github.com/c-ares/c-ares/commit/7f408deb128fbdcce78122322734ffaa01cad9ae (v1.34.9)
+	NOTE: https://github.com/c-ares/c-ares/commit/f944c4718fd672c9c0befd65a340abb2ccfc1a31 (v1.34.9)
+CVE-2026-XXXX [Use-after-free when an application cancels lookups from a callback, or shuts a channel down]
+	- c-ares 1.34.9-1
+	NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-rf6g-ww74-97qh
+	NOTE: https://github.com/c-ares/c-ares/commit/7f408deb128fbdcce78122322734ffaa01cad9ae (v1.34.9)
+	NOTE: https://github.com/c-ares/c-ares/commit/f944c4718fd672c9c0befd65a340abb2ccfc1a31 (v1.34.9)
+CVE-2026-XXXX [Use-after-free of a connection after the socket-state callback returns]
+	- c-ares 1.34.9-1
+	NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-mw23-pfg6-2x9r
+	NOTE: https://github.com/c-ares/c-ares/commit/7f408deb128fbdcce78122322734ffaa01cad9ae (v1.34.9)
+	NOTE: https://github.com/c-ares/c-ares/commit/f944c4718fd672c9c0befd65a340abb2ccfc1a31 (v1.34.9)
+CVE-2026-XXXX [Use-after-free when an application cancels lookups from a server-state callback]
+	- c-ares 1.34.9-1
+	NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-v33j-65h4-4ch8
+	NOTE: https://github.com/c-ares/c-ares/commit/7f408deb128fbdcce78122322734ffaa01cad9ae (v1.34.9)
+	NOTE: https://github.com/c-ares/c-ares/commit/f944c4718fd672c9c0befd65a340abb2ccfc1a31 (v1.34.9)
+CVE-2026-XXXX [Use-after-free of a server record when an application changes its DNS servers from a callback]
+	- c-ares 1.34.9-1
+	NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-pj7p-v3cw-hq66
+	NOTE: https://github.com/c-ares/c-ares/commit/7f408deb128fbdcce78122322734ffaa01cad9ae (v1.34.9)
+	NOTE: https://github.com/c-ares/c-ares/commit/f944c4718fd672c9c0befd65a340abb2ccfc1a31 (v1.34.9)
+	NOTE: https://github.com/c-ares/c-ares/commit/13a10dddbabc30b6fca8e23f9efff73fedba9401 (v1.34.9)
+CVE-2026-XXXX [Use-after-free of a cached DNS answer while the application is still reading it]
+	- c-ares 1.34.9-1
+	NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-grv7-fq5q-9vfc
+	NOTE: https://github.com/c-ares/c-ares/commit/a21160045f9d7039225fa285be7cb1b02173a3a5 (v1.34.9)
+CVE-2026-XXXX [Buffer overflow when ares_dup() or ares_save_options() runs while another thread changes the servers]
+	- c-ares 1.34.9-1
+	NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-ph6c-3cvx-mq6v
+	NOTE: https://github.com/c-ares/c-ares/commit/25a6911370878d4b617b44b142ea0e49d1ccede6 (v1.34.9)
+CVE-2026-XXXX [Uninitialized memory returned for a numeric IPv6 name with a prefix length]
+	- c-ares 1.34.9-1
+	NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-cfcv-8v2j-qj6r
+	NOTE: https://github.com/c-ares/c-ares/commit/7e65b381c0b915aa5671ddc713080c87e15fc42f (v1.34.9)
+CVE-2026-XXXX [The query cache could return an answer obtained using different EDNS options]
+	- c-ares 1.34.9-1
+	NOTE: https://github.com/c-ares/c-ares/security/advisories/GHSA-wrgc-prmw-27xh
+	NOTE: https://github.com/c-ares/c-ares/commit/a21160045f9d7039225fa285be7cb1b02173a3a5 (v1.34.9)
 CVE-2026-99210 [accel/rocket: clear rdev on device init failure]
 	- linux 7.2.13-1
 	[trixie] - linux <not-affected> (Vulnerable code not present)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d936493098694f7b8105b5fd79c33bcdc72db137

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d936493098694f7b8105b5fd79c33bcdc72db137
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/7bbc2576/attachment-0001.htm>