Vulnerability Database

309,103

Total vulnerabilities in the database

CVE-2016-5180

Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

  • Published: Oct 3, 2016
  • Updated: Nov 9, 2025
  • CVE: CVE-2016-5180
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9.8
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
c-ares_project / c-ares 1.11.0 1.11.0.x
debian / debian_linux 8.0 8.0.x
nodejs / node.js 4.0.0 4.6.1
nodejs / node.js 0.12.0 0.12.17
nodejs / node.js 0.10.0 0.10.48
canonical / ubuntu_linux 16.10 16.10.x
canonical / ubuntu_linux 14.04 14.04.x
canonical / ubuntu_linux 16.04 16.04.x
canonical / ubuntu_linux 12.04 12.04.x
c-ares / c-ares 1.4.0 1.4.0.x
c-ares / c-ares 1.5.0 1.5.0.x
c-ares / c-ares 1.0.0 1.0.0.x
c-ares / c-ares 1.9.1 1.9.1.x
c-ares / c-ares 1.8.0 1.8.0.x
c-ares / c-ares 1.6.0 1.6.0.x
c-ares / c-ares 1.5.2 1.5.2.x
c-ares / c-ares 1.10.0 1.10.0.x
c-ares / c-ares 1.7.1 1.7.1.x
c-ares / c-ares 1.3.2 1.3.2.x
c-ares / c-ares 1.5.3 1.5.3.x
c-ares / c-ares 1.9.0 1.9.0.x
c-ares / c-ares 1.3.0 1.3.0.x
c-ares / c-ares 1.7.3 1.7.3.x
c-ares / c-ares 1.7.5 1.7.5.x
c-ares / c-ares 1.2.0 1.2.0.x
c-ares / c-ares 1.1.0 1.1.0.x
c-ares / c-ares 1.7.2 1.7.2.x
c-ares / c-ares 1.7.0 1.7.0.x
c-ares / c-ares 1.7.4 1.7.4.x
c-ares / c-ares 1.3.1 1.3.1.x
c-ares / c-ares 1.5.1 1.5.1.x
c-ares / c-ares 1.2.1 1.2.1.x