A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and
query logging are both enabled, logging of DS or DNSKEY replies containing
unsupported algorithm or digest types can cause dnsmasq to write past the end
of an internal logging buffer. A remote attacker able to supply such a DNS
response may crash the dnsmasq process, resulting in denial of service.
Mitigate this issue by updating to a version of dnsmasq that includes the
upstream fix (commit 36d081e37477027fd721fea498f3760f529034ad), or by
disabling query logging if DNSSEC validation must remain enabled. After
changing the configuration, restart the dnsmasq service for the changes to
take effect.