CVE-2020-17467

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination. Therefore, the deduced length of the hostname doesn't reflect the correct length of the actual data. This may lead to Information Disclosure in _fnet_llmnr_poll in fnet_llmnr.c during a response to a malicious request of the DNS class IN.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://fnet.sourceforge.net/manual/fnet_history.htmlRelease Notes, Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource
http://fnet.sourceforge.net/manual/fnet_history.htmlRelease Notes, Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource

Timeline

Published: Dec 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-174687.5An issue was discovered in FNET through 4.6.4. The code for processing the hop-by-hop header (in the IPv6 extension headers) doesn't check f CVE-2020-174697.5An issue was discovered in FNET through 4.6.4. The code for IPv6 fragment reassembly tries to access a previous fragment starting from a net CVE-2020-17479.8A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it p CVE-2020-174705.3An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random CVE-2020-174735.9Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-las CVE-2020-174749.8A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to create arbitrary ne CVE-2020-174757.5Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending p CVE-2020-174766.1Mibew Messenger before 3.2.7 allows XSS via a crafted user name.CVE-2020-174776.5Incorrect LDAP ACLs in ucs-school-ldap-acls-master in UCS@school before 4.4v5-errata allow remote teachers, staff, and school administrators CVE-2020-174787.5ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplication algorithm.CVE-2020-174799.8jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.CVE-2020-17487.5A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were byp