CVE-2016-5180

CRITICAL

9.8

CVSS Score

Published: October 3, 2016 at 03:00 PM UTC

Updated: June 17, 2026 at 12:48 AM UTC

5 products affected across 5 vendorsDebian LinuxUbuntu LinuxNode.js

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.8

Exploit prediction

EPSS 9%

Description

Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ares C Ares · C Ares

95%

1.0.0 1.1.0 1.10.0 1.2.0 1.2.1 1.3.0 1.3.1 1.3.2 1.4.0 1.5.0 1.5.1 1.5.2 1.5.3 1.6.0 1.7.0 1.7.1 1.7.2 1.7.3 1.7.4 1.7.5 1.8.0 1.9.0 1.9.1

C Ares · C Ares Project

95%

1.11.0

Ubuntu Linux · Canonicalrubygems

95%

12.04 14.04 16.04 16.10

Debian Linux · Debiandrupal

95%

8.0

Node.js · Node.js

95%

0.10.0 ≤ v < 0.10.480.12.0 ≤ v < 0.12.174.0.0 ≤ v < 4.6.1

Affected range stops below 0.10.48, so it looks safe — our inference, not a vendor statement

Affected range stops below 0.12.17, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.6.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (9)

Vendor Advisoryx_refsource_REDHAT

Source: [email protected]

http://rhn.redhat.com/errata/RHSA-2017-0002.html

Vendor Advisoryx_refsource_DEBIAN

Source: [email protected]

http://www.debian.org/security/2016/dsa-3682

VDB Entryx_refsource_BID

Source: [email protected]

http://www.securityfocus.com/bid/93243

Vendor Advisoryx_refsource_UBUNTU

Source: [email protected]

http://www.ubuntu.com/usn/USN-3143-1

x_refsource_CONFIRM

Source: [email protected]

https://c-ares.haxx.se/CVE-2016-5180.patch

x_refsource_CONFIRM

Source: [email protected]

https://c-ares.haxx.se/adv_20160929.html

x_refsource_CONFIRM

Source: [email protected]

https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html

Vendor Advisoryx_refsource_GENTOO

Source: [email protected]

https://security.gentoo.org/glsa/201701-28

CVSS

9.8CRITICAL[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-787

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card