CVE-2015-3294: oracle solaris Data Processing Errors

Vulnerability summary

CVE-2015-3294 is a medium (CVSS 6.4) Data Processing Errors vulnerability in oracle solaris. EPSS estimates a 4.95% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 08-05-2015
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request.

• CWE-19Data Processing ErrorsWeaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.