opensuse/bind&distro=openSUSE Tumbleweed

Vulnerabilities (124)

• CVE-2020-8624MedAug 21, 2020
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the

• CVE-2020-8623HigAug 21, 2020
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must

• CVE-2020-8622MedAug 21, 2020
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated

• CVE-2020-8621HigAug 21, 2020
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affecte

• CVE-2020-8620HigAug 21, 2020
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit.

• CVE-2020-8619MedJun 17, 2020
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal

• CVE-2020-8618MedJun 17, 2020
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients.

• CVE-2020-8617HigMay 19, 2020
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whos

• CVE-2020-8616HigMay 19, 2020
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to proce

• CVE-2019-6477HigNov 26, 2019
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been pr

• CVE-2019-6476MedOct 17, 2019
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4.

• CVE-2019-6471MedOct 9, 2019
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch a

• CVE-2019-6465MedOct 9, 2019
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Ver

• CVE-2018-5745MedOct 9, 2019
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  "managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit d

• CVE-2018-5743HigOct 9, 2019
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit

• CVE-2018-5737MedJan 16, 2019
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative caching can in some

• CVE-2017-3145HigJan 16, 2019
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.

• CVE-2017-3142MedJan 16, 2019
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys f

• CVE-2017-3141HigJan 16, 2019
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.

• CVE-2017-3135HigJan 16, 2019
  affected < 9.16.20-1.4fixed 9.16.20-1.4

  Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.