Vulnerability Report

CVE-2016-5180

Title: Nodejs Node.Js RCE

Memory Corruption

Proof Of Concept

PoC Available for CVE-2016-5180

CWE Category CWE-787
Published Date Oct 03, 2016
Modified Date May 06, 2026
Exploit Status Available
Score 9.8 CVSS v3.1
Exploit Probability (EPSS)
18.09%

Vulnerability Summary

CVE-2016-5180: Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

Impacted Vendors

D
daniel_stenberg 1
N
nodejs 1
J
joyent 1
C
c-ares_project 1
C
c-ares 1

Reference Links

http://rhn.redhat.com/errata/RHSA-2017-0002.html http://www.debian.org/security/2016/dsa-3682 http://www.securityfocus.com/bid/93243 http://www.ubuntu.com/usn/USN-3143-1 https://c-ares.haxx.se/CVE-2016-5180.patch https://c-ares.haxx.se/adv_20160929.html https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html https://security.gentoo.org/glsa/201701-28 https://source.android.com/security/bulletin/2017-01-01.html http://rhn.redhat.com/errata/RHSA-2017-0002.html http://www.debian.org/security/2016/dsa-3682 http://www.securityfocus.com/bid/93243 http://www.ubuntu.com/usn/USN-3143-1 https://c-ares.haxx.se/CVE-2016-5180.patch https://c-ares.haxx.se/adv_20160929.html https://googlechromereleases.blogspot.in/2016/09/stable-channel-updates-for-chrome-os.html https://security.gentoo.org/glsa/201701-28 https://source.android.com/security/bulletin/2017-01-01.html
CVSS v3.1
Source Entity [email protected]
Severity CRITICAL
9.8
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0
Source Entity [email protected]
Severity HIGH
7.5
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2016-5180 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/pouriam23/CVE-2016-5180
View Code
GitHub https://github.com/pouriam23/final-CVE-2016-5180
View Code
GitHub https://github.com/pouriam23/CVE-2016-5180-docker-
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.