CVE-2017-9103

An issue was discovered in adns before 1.5.2. pap_mailbox822 does not properly check st from adns__findlabel_next. Without this, an uninitialised stack value can be used as the first label length. Depending on the circumstances, an attacker might be able to trick adns into crashing the calling program, leaking aspects of the contents of some of its memory, causing it to allocate lots of memory, or perhaps overrunning a buffer. This is only possible with applications which make non-raw queries for SOA or RP records.

• CWE-119

• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00037.htmlMailing List, Third Party Advisory
• http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.gitThird Party Advisory
• http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/
• https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.htmlRelease Notes, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00037.htmlMailing List, Third Party Advisory
• http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.gitThird Party Advisory
• http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=adns.git%3Ba=blob%3Bf=changelog
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRVHN3GGVNQWAOL3PWC5FLAV7HUESLZR/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGFZ4SPV6KFQK6ZNUZFB5Y32OYFOM5YJ/
• https://www.chiark.greenend.org.uk/pipermail/adns-announce/2020/000004.htmlRelease Notes, Third Party Advisory

Published

Jun 18, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9095XXE in Diving Log 6.0 allows attackers to remotely view loca…5.5
• CVE-2017-9096The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 …
• CVE-2017-9097In Anti-Web through 3.8.7, as used on NetBiter FGW200 device…
• CVE-2017-9098ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 …7.5
• CVE-2017-9100login.cgi on D-Link DIR-600M devices with firmware 3.04 allo…8.8
• CVE-2017-9101import.php (aka the Phonebook import feature) in PlaySMS 1.4…
• CVE-2017-9104An issue was discovered in adns before 1.5.2. It hangs, eati…9.8
• CVE-2017-9105An issue was discovered in adns before 1.5.2. It corrupts a …8.8
• CVE-2017-9106An issue was discovered in adns before 1.5.2. adns_rr_info m…7.5
• CVE-2017-9107An issue was discovered in adns before 1.5.2. It overruns re…7.5
• CVE-2017-9108An issue was discovered in adns before 1.5.2. adnshost misha…7.5
• CVE-2017-9109An issue was discovered in adns before 1.5.2. It fails to ig…9.8