CVE-2020-6080

Name	CVE-2020-6080
Description	An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through the function rr_read_RR [5] reads the current resource record, except for the RDATA section. This is read by the loop at in rr_read. For each RR type, a different function is called. When the RR type is 0x10, the function rr_read_TXT is called at [6].
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-4671-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libmicrodns (PTS)	sid, trixie	0.2.0-1	fixed
vlc (PTS)	jessie, jessie (lts)	2.2.7-1~deb8u1	vulnerable
	stretch (security)	3.0.12-0+deb9u1	fixed
	stretch (lts), stretch	3.0.21-0+deb9u1	fixed
	buster, buster (lts)	3.0.21-0+deb10u1	fixed
	buster (security)	3.0.20-0+deb10u1	fixed
	bullseye (security), bullseye	3.0.21-0+deb11u1	fixed
	bookworm (security), bookworm	3.0.21-0+deb12u1	fixed
	sid, trixie	3.0.21-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
libmicrodns	source	(unstable)	0.2.0-1
vlc	source	jessie	(unfixed)	end-of-life
vlc	source	stretch	3.0.10-0+deb9u1		DSA-4671-1
vlc	source	buster	3.0.10-0+deb10u1		DSA-4671-1
vlc	source	(unstable)	3.0.8-4

Notes

[jessie] - vlc <end-of-life> (Not supported in jessie LTS)
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1002
These were addressed on the source level in 3.0.9, but 3.0.8-4 disables the plugin