musl libc vulnerabilities

Musl libc before 1.1.17 has a buffer overflow vulnerability that can be exploited via crafted DNS replies. The dns_parse_callback function in network/lookup_name.c does not restrict the number of addresses, allowing an attacker to send an unexpected number of A records in response to an AAAA query.

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

A stack-based buffer overflow in the inet_pton function in musl libc allows attackers to exploit unspecified impacts. This affects versions from 0.9.15 to 1.0.4 and from 1.1.0 to 1.1.7.

A security flaw has been discovered in musl libc up to 1.2.6. The iconv function in src/locale/iconv.c, within the GB18030 4-byte Decoder component, is affected. Manipulation results in inefficient algorithmic complexity, and the attack must be initiated from a local position.