lp://staging/ubuntu/precise-security/bind9

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

1 recipe using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

59. By Marc Deslauriers on 2015-09-01

* SECURITY UPDATE: denial of service in DNSSEC-signed record validation
  via malformed keys
  - fix validation inlib/dns/hmac_link.c, lib/dns/include/dst/dst.h,
    lib/dns/ncache.c, lib/dns/openssldh_link.c,
    lib/dns/openssldsa_link.c, lib/dns/opensslrsa_link.c,
    lib/dns/resolver.c.
  - CVE-2015-5722

58. By Marc Deslauriers on 2015-07-27

* SECURITY UPDATE: denial of service in TKEY record query handling
  - lib/dns/tkey.c: clear out name before trying the answer section.
  - CVE-2015-5477
* SECURITY UPDATE: denial of service via AAAA record query
  - bin/named/query.c: arrange for RPZ rewriting of any A records.
  - CVE-2012-5689

57. By Marc Deslauriers on 2015-06-29

* SECURITY UPDATE: resolver DoS via specially crafted zone data
  - lib/dns/validator.c: don't use uninitialized fixedname.
  - CVE-2015-4620

56. By Marc Deslauriers on 2015-02-18

* SECURITY UPDATE: denial of service via revoking a managed trust anchor
  and supplying an untrusted replacement
  - lib/dns/zone.c: avoid crash due to managed-key rollover
  - Based on patch supplied by Evan Hunt <email address hidden>
  - CVE-2015-1349

55. By Marc Deslauriers on 2014-12-09

* SECURITY UPDATE: denial of service via delegation handling defect
  - limit max recursion in bin/named/config.c, bin/named/query.c,
    bin/named/server.c, lib/dns/adb.c, lib/dns/include/dns/adb.h,
    lib/dns/include/dns/resolver.h, lib/dns/resolver.c,
    lib/export/isc/Makefile.in, lib/isc/Makefile.in, lib/isc/counter.c,
    lib/isc/include/isc/counter.h, lib/isc/include/isc/Makefile.in,
    lib/isc/include/isc/types.h, lib/isc/tests/counter_test.c,
    lib/isccfg/namedconf.c.
  - Patch provided by upstream.
  - CVE-2014-8500

54. By Marc Deslauriers on 2014-01-10

* SECURITY UPDATE: denial of service when processing NSEC3-signed zone
  queries
  - debian/patches/CVE-2014-0591.patch: don't call memcpy with
    overlapping ranges in bin/named/query.c.
  - patch backported from 9.8.6-P2.
  - CVE-2014-0591

53. By Marc Deslauriers on 2013-07-26

* SECURITY UPDATE: denial of service via incorrect bounds checking on
  private type 'keydata'
  - lib/dns/rdata/generic/keydata_65533.c: check for correct length.
  - Patch backported from 9.8.5-P2
  - CVE-2013-4854

52. By Marc Deslauriers on 2013-03-28

* SECURITY UPDATE: denial of service via regex syntax checking
  - configure,configure.in,config.h.in: remove check for regex.h to
    disable regex syntax checking.
  - CVE-2013-2266

51. By Marc Deslauriers on 2012-12-05

* SECURITY UPDATE: denial of service via DNS64 and crafted query
  - bin/named/query.c: init rdataset before cleanup.
  - Patch backported from 9.8.4-P1
  - CVE-2012-5688

50. By Marc Deslauriers on 2012-10-05

* SECURITY UPDATE: denial of service via specific combinations of RDATA
  - bin/named/query.c: fix logic
  - Patch backported from 9.8.3-P4
  - CVE-2012-5166