CVE-2017-15107

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-358

Affected software

Vendor	Product	Versions
Simon Kelley	dnsmasq	up to and including 2.78

References

http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00027.html
http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/011896.htmlVendor Advisory
http://www.securityfocus.com/bid/102812Third Party Advisory, VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00027.html
http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/011896.htmlVendor Advisory
http://www.securityfocus.com/bid/102812Third Party Advisory, VDB Entry

Timeline

Published: Jan 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-151087.8spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with acces CVE-2017-151104.3In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students c CVE-2017-151115.5keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via sy CVE-2017-151127.8keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command histo CVE-2017-151136.6ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can CVE-2017-151148.1When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority CVE-2017-151157.8The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a pee CVE-2017-151165.5The rngapi_reset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service (NULL pointer derefer CVE-2017-151189.8A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an expor CVE-2017-151198.6The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. It could occur if a c CVE-2017-151207.5An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference whe CVE-2017-151215.5A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that d