libcares2: c-ares is an asynchronous resolver library

c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4,there is a use-after-free in read_answers() when process_answer() mayre-enqueue a query either due to a DNS Cookie Failure or when the upstreamserver does not properly support EDNS, or possibly on TCP queries if theremote closed the connection immediately after a response. If there was anissue trying to put that new transaction on the wire, it would close theconnection handle, but read_answers() was still expecting the connectionhandle to be available to possibly dequeue other responses. In theory aremote attacker might be able to trigger this by flooding the target withICMP UNREACHABLE packets if they also control the upstream nameserver andcan return a result with one of those conditions, this has been untested.Otherwise only a local attacker might be able to change system behavior tomake send()/write() return a failure condition. This vulnerability is fixedin 1.34.5.

Where it's fixed