CVE-2016-5180
Node.js 4: Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote…
CVE-2016-5180 is fixed in Node.js 4 on 1 platform by Node.js 4 4.6.1 (version 4.6.1), released October 18, 2016. It is not reported as exploited. Patch Radar priority: Urgent.
Urgent
CVSS
9.8
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0865
95th percentile
Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 4 | 4.6.1 | Node.js 4 4.6.1 | Oct 18, 2016 |