Ubuntu alert USN-7925-1 (c-ares)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7925-1] c-ares vulnerability
Date:
             
 
Thu, 11 Dec 2025 15:00:15 +0000
Message-ID:
             
 
<E1vTi9P-0008Ai-Vf@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7925-1
December 11, 2025

c-ares vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 25.04

Summary:

c-ares could be made to crash if it received specially crafted queries.

Software Description:
- c-ares: library for asynchronous name resolution

Details:

It was discovered that c-ares incorrectly handled terminating certain
queries after a maximum number of attempts. An attacker could possibly use
this issue to cause c-ares to crash, resulting in a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  libcares2                       1.34.5-1ubuntu0.1

Ubuntu 25.04
  libcares2                       1.34.4-2.1ubuntu0.2

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7925-1
  CVE-2025-62408

Package Information:
  https://launchpad.net/ubuntu/+source/c-ares/1.34.5-1ubunt...
  https://launchpad.net/ubuntu/+source/c-ares/1.34.4-2.1ubu...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmk62uwACgkQcpJm3tlz
hgE2lhAAoN53rVjbsQjsOG2n+7T6XJrPDMKkGZMLfhRcIPz0baVo6kFS1Qlh1D7v
IAEIh0MWzYEyJATBptjTEp5IB1yKUAlzdbK6AZyRguq4QG0bHqpoHEti0ol1SghQ
8NJnZtlr2cLc0mEriCrBinZxbsBOC9fZ7Vdj037IeMVDNpO4EQaZW6tjFuSm+AVy
TVFMP2vlnKWfGRA4HxAJVg2LoKXcmH3DssYd1zIwZ0sfAb5bqg8Sl9tL5Fifgv9R
wJN5g44Kz04QKA/l5riwebpE9T8MXRn02eZiXglsR33fpPffQdJDK46BG5RjRMy+
zuFN0ufE9Gzy8fXGBK8ncfQy0Ic8DTU9lzNTl13pMN1+QMriQ32g1VMx0ixRPcbS
qjTNr2UwfwVZJAYG8eAeQlAMHdi7oWjkbrr7v58Cb2RkmnnUthX3mBdicYfZ9h1A
nTRrTFpuIM2fUaJC+PLYLer9pL4dxT33SPf6T4AO2GJeMy28wGTiVY/1r4+oPPMM
FFeN8UehA4KZ9JO2sY6CFOYELQxIkJC6bSm3vuf4Z/15dvYuRwOY317dk/YX1qWy
hd73igadatoCVUxpocPhIj/WRjCrh6aseyU7J24NmPvmetb9hV+1gFw0VgfBJ5gc
B8INMDj+L6e8WYv7C8X2BL6SKYt4Dl3lejKTA5hbhbSVPPiGvHM=
=TwIR
-----END PGP SIGNATURE-----