Dnsmasq: Multiple vulnerabilities — GLSA 202101-17

Multiple vulnerabilities have been found in Dnsmasq, the worst of which may allow remote attackers to execute arbitrary code.

Affected packages

Background

Dnsmasq is a lightweight and easily-configurable DNS forwarder and DHCP server.

Description

Multiple vulnerabilities have been discovered in Dnsmasq. Please review the references below for details.

Impact

An attacker, by sending specially crafted DNS replies, could possibly execute arbitrary code with the privileges of the process, perform a cache poisoning attack or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-dns/dnsmasq-2.83"
 

References

• CVE-2020-25681
• CVE-2020-25682
• CVE-2020-25683
• CVE-2020-25684
• CVE-2020-25685
• CVE-2020-25686
• CVE-2020-25687

Release date
January 22, 2021

Latest revision
January 22, 2021: 1

Severity
normal

Exploitable
local, remote

Bugzilla entries

• 766126