<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Possible vulnerability were found in latest dnsmasq. It were
found with help of oss-fuzz Google project by me and short after
that independently also by <span class="quote">Richard Johnson of
Trellix </span><span class="quote">Threat Labs.</span></p>
<p><span class="quote">It is affected only by DHCPv6 requests, which
could be crafted to modify already freed memory. Red Hat
security assigned this vulnerability CVE-2022-0934. Affected are
also previous versions including 2.85, 2.79 and 2.76. Correction
is relative simple, I am attaching my proposal to fix this
issue. Simon will probably use his own commit in upcoming
version to fix this issue soon in git repository. We think it
might be triggered remotely, but we do not think it could be
used to execute remote code.<br>
</span></p>
<p><span class="quote">Best Regards,</span></p>
<p><span class="quote">Petr Menšík<br>
</span></p>
<pre class="moz-signature" cols="72">--
Petr Menšík
Software Engineer
Red Hat, <a class="moz-txt-link-freetext" href="http://www.redhat.com/">http://www.redhat.com/</a>
email: <a class="moz-txt-link-abbreviated" href="mailto:pemensik@redhat.com">pemensik@redhat.com</a>
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB</pre>
</body>
</html>