Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited

Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy.

Security update for unbound

unbound: integer overflow in the regional allocator via regional_alloc unbound: integer overflow in sldns_str2wire_dname_buf_origin can lead to an out-of-bounds write unbound: out-of-bounds write in sldns_bget_token_par unbound: assertion failure and denial of service in synth_cname unbound: assertion failure and denial of service in dname_pkt_copy via an invalid packet unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c unbound: integer overflow in a size calculation in respip/respip.c unbound: infinite loop via a compressed name in dname_pkt_copy unbound: assertion failure via a compressed name in dname_pkt_copy unbound: out-of-bounds write via a compressed name in rdata_copy unbound: symbolic link traversal when writing PID file

Security update for unbound

Affected: Ubuntu:18.04:LTS: unbound, Ubuntu:20.04:LTS: unbound

Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited