A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| C-ares | C-ares | 1.16.0 (including) | 1.16.0 (including) |
| C-ares | Ubuntu | trusty | * |
| C-ares | Ubuntu | upstream | * |