TI-2016-06076 Aliases CVE-2016-7069 GHSA-v3pf-fvxp-8mjf

Improper input validation in Open-Xchange GmbH dnsdist

MEDIUM 40CWE-20Published 2018-09-11 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash.

Why it matters now

EPSS 0.0458 91st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Open-Xchange GmbH	dnsdist	1.2.0	—	No fix listed	CNA

dnsdist VendorOpen-Xchange GmbH Affected 1.2.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:powerdns:dnsdist:::x86:::::*	up to 1.2.0	Vulnerable	PowerDNS

cpe:2.3:a:powerdns:dnsdist:*:*:x86:*:*:*:*:* Versions up to 1.2.0 Vulnerable ·PowerDNS

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2016-7069
2026-10-03 Alias added: GHSA-v3pf-fvxp-8mjf

References

Patch 1

https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2017-01.html

Advisory 1

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7069

TI-2024-04069 Improper check for unusual conditions in Mozilla Firefox CVSS 3.1HIGH 8.8
TI-2022-17394 OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only… CVSS 3.1MEDIUM 5.3
TI-2022-17393 OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request… CVSS 3.1MEDIUM 5.3
TI-2022-17392 OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location… CVSS 3.1MEDIUM 5.3
TI-2022-17391 OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help… CVSS 3.1MEDIUM 6.1
TI-2022-17390 OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name. CVSS 3.1MEDIUM 6.1

See all 317 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences