Read the docs
TI-2017-06865 Aliases CVE-2017-9454GHSA-hgqf-qr3f-rgx9

Buffer overflow in the ares_parse_a_reply function in the embedded ares library in…

Priority LOW 37CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Buffer overflow in the ares_parse_a_reply function in the embedded ares library in ReSIProcate before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted DNS response.

Why it matters now

EPSS 0.01992 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:resiprocate:resiprocate:*:*:*:*:*:*:*:*up to 1.10.2Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha1:*:*:*:*:*:*1.11.0 alpha1Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha10:*:*:*:*:*:*1.11.0 alpha10Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha11:*:*:*:*:*:*1.11.0 alpha11Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha2:*:*:*:*:*:*1.11.0 alpha2Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha3:*:*:*:*:*:*1.11.0 alpha3Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha4:*:*:*:*:*:*1.11.0 alpha4Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha5:*:*:*:*:*:*1.11.0 alpha5Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha6:*:*:*:*:*:*1.11.0 alpha6Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha7:*:*:*:*:*:*1.11.0 alpha7Vulnerableresiprocate
  • cpe:2.3:a:resiprocate:resiprocate:*:*:*:*:*:*:*:* Versions up to 1.10.2 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha1:*:*:*:*:*:* Versions 1.11.0 alpha1 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha10:*:*:*:*:*:* Versions 1.11.0 alpha10 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha11:*:*:*:*:*:* Versions 1.11.0 alpha11 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha2:*:*:*:*:*:* Versions 1.11.0 alpha2 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha3:*:*:*:*:*:* Versions 1.11.0 alpha3 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha4:*:*:*:*:*:* Versions 1.11.0 alpha4 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha5:*:*:*:*:*:* Versions 1.11.0 alpha5 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha6:*:*:*:*:*:* Versions 1.11.0 alpha6 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha7:*:*:*:*:*:* Versions 1.11.0 alpha7 Vulnerable ·resiprocate
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha8:*:*:*:*:*:*1.11.0 alpha8Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha9:*:*:*:*:*:*1.11.0 alpha9Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:beta1:*:*:*:*:*:*1.11.0 beta1Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:beta2:*:*:*:*:*:*1.11.0 beta2Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:beta3:*:*:*:*:*:*1.11.0 beta3Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:beta4:*:*:*:*:*:*1.11.0 beta4Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.11.0:beta5:*:*:*:*:*:*1.11.0 beta5Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.12.0:alpha1:*:*:*:*:*:*1.12.0 alpha1Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta1:*:*:*:*:*:*1.12.0 beta1Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta2:*:*:*:*:*:*1.12.0 beta2Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta3:*:*:*:*:*:*1.12.0 beta3Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta4:*:*:*:*:*:*1.12.0 beta4Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta5:*:*:*:*:*:*1.12.0 beta5Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta6:*:*:*:*:*:*1.12.0 beta6Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta7:*:*:*:*:*:*1.12.0 beta7Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta8:*:*:*:*:*:*1.12.0 beta8Vulnerableresiprocate
cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta9:*:*:*:*:*:*1.12.0 beta9Vulnerableresiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha8:*:*:*:*:*:* Versions 1.11.0 alpha8 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:alpha9:*:*:*:*:*:* Versions 1.11.0 alpha9 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:beta1:*:*:*:*:*:* Versions 1.11.0 beta1 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:beta2:*:*:*:*:*:* Versions 1.11.0 beta2 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:beta3:*:*:*:*:*:* Versions 1.11.0 beta3 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:beta4:*:*:*:*:*:* Versions 1.11.0 beta4 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.11.0:beta5:*:*:*:*:*:* Versions 1.11.0 beta5 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.12.0:alpha1:*:*:*:*:*:* Versions 1.12.0 alpha1 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta1:*:*:*:*:*:* Versions 1.12.0 beta1 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta2:*:*:*:*:*:* Versions 1.12.0 beta2 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta3:*:*:*:*:*:* Versions 1.12.0 beta3 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta4:*:*:*:*:*:* Versions 1.12.0 beta4 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta5:*:*:*:*:*:* Versions 1.12.0 beta5 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta6:*:*:*:*:*:* Versions 1.12.0 beta6 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta7:*:*:*:*:*:* Versions 1.12.0 beta7 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta8:*:*:*:*:*:* Versions 1.12.0 beta8 Vulnerable ·resiprocate
  • cpe:2.3:a:resiprocate:resiprocate:1.12.0:beta9:*:*:*:*:*:* Versions 1.12.0 beta9 Vulnerable ·resiprocate

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-9454
  2. 2026-10-03 Alias added: GHSA-hgqf-qr3f-rgx9

References

Patch 1

Advisory 1

  • TI-2018-09033 The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in… CVSS 3.1CRITICAL 9.8
  • TI-2017-08518 The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in… CVSS 3.1HIGH 7.5
  • TI-2008-03061 Multiple unspecified vulnerabilities in ReSIProcate before 1.3.4 allow remote attackers… CVSS 2.0HIGH 7.8
  • TI-2008-03072 rutil/dns/DnsStub.cxx in ReSIProcate 1.3.2, as used by repro, allows remote attackers to… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences