rpm package
opensuse/libuv&distro=openSUSE Leap 15.1
pkg:rpm/opensuse/libuv&distro=openSUSE%20Leap%2015.1
Vulnerabilities (12)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-8624 | — | < 1.18.0-lp151.3.3.1 | 1.18.0-lp151.3.3.1 | Aug 21, 2020 | In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the | ||
| CVE-2020-8623 | — | < 1.18.0-lp151.3.3.1 | 1.18.0-lp151.3.3.1 | Aug 21, 2020 | In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must | ||
| CVE-2020-8622 | — | < 1.18.0-lp151.3.3.1 | 1.18.0-lp151.3.3.1 | Aug 21, 2020 | In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated | ||
| CVE-2020-8621 | — | < 1.18.0-lp151.3.3.1 | 1.18.0-lp151.3.3.1 | Aug 21, 2020 | In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affecte | ||
| CVE-2020-8620 | — | < 1.18.0-lp151.3.3.1 | 1.18.0-lp151.3.3.1 | Aug 21, 2020 | In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit. | ||
| CVE-2020-8619 | — | < 1.18.0-lp151.3.3.1 | 1.18.0-lp151.3.3.1 | Jun 17, 2020 | In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal | ||
| CVE-2020-8618 | — | < 1.18.0-lp151.3.3.1 | 1.18.0-lp151.3.3.1 | Jun 17, 2020 | An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients. | ||
| CVE-2020-8617 | — | < 1.18.0-lp151.3.3.1 | 1.18.0-lp151.3.3.1 | May 19, 2020 | Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whos | ||
| CVE-2020-8616 | — | < 1.18.0-lp151.3.3.1 | 1.18.0-lp151.3.3.1 | May 19, 2020 | A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to proce | ||
| CVE-2019-6477 | — | < 1.18.0-lp151.3.3.1 | 1.18.0-lp151.3.3.1 | Nov 26, 2019 | With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been pr | ||
| CVE-2018-5741 | — | < 1.18.0-lp151.3.3.1 | 1.18.0-lp151.3.3.1 | Jan 16, 2019 | To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when | ||
| CVE-2017-3136 | — | < 1.18.0-lp151.3.3.1 | 1.18.0-lp151.3.3.1 | Jan 16, 2019 | A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other p |
- CVE-2020-8624Aug 21, 2020affected < 1.18.0-lp151.3.3.1fixed 1.18.0-lp151.3.3.1
In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the
- CVE-2020-8623Aug 21, 2020affected < 1.18.0-lp151.3.3.1fixed 1.18.0-lp151.3.3.1
In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must
- CVE-2020-8622Aug 21, 2020affected < 1.18.0-lp151.3.3.1fixed 1.18.0-lp151.3.3.1
In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated
- CVE-2020-8621Aug 21, 2020affected < 1.18.0-lp151.3.3.1fixed 1.18.0-lp151.3.3.1
In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affecte
- CVE-2020-8620Aug 21, 2020affected < 1.18.0-lp151.3.3.1fixed 1.18.0-lp151.3.3.1
In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit.
- CVE-2020-8619Jun 17, 2020affected < 1.18.0-lp151.3.3.1fixed 1.18.0-lp151.3.3.1
In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal
- CVE-2020-8618Jun 17, 2020affected < 1.18.0-lp151.3.3.1fixed 1.18.0-lp151.3.3.1
An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients.
- CVE-2020-8617May 19, 2020affected < 1.18.0-lp151.3.3.1fixed 1.18.0-lp151.3.3.1
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whos
- CVE-2020-8616May 19, 2020affected < 1.18.0-lp151.3.3.1fixed 1.18.0-lp151.3.3.1
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to proce
- CVE-2019-6477Nov 26, 2019affected < 1.18.0-lp151.3.3.1fixed 1.18.0-lp151.3.3.1
With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been pr
- CVE-2018-5741Jan 16, 2019affected < 1.18.0-lp151.3.3.1fixed 1.18.0-lp151.3.3.1
To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when
- CVE-2017-3136Jan 16, 2019affected < 1.18.0-lp151.3.3.1fixed 1.18.0-lp151.3.3.1
A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other p