Most recent entries from all

ALSA-2022:2092 — Moderate: bind security, bug fix, and enhancement update

Affected: AlmaLinux:8: bind, AlmaLinux:8: bind-chroot, AlmaLinux:8: bind-devel, AlmaLinux:8: bind-export-devel, AlmaLinux:8: bind-export-libs, AlmaLinux:8: bind-libs, AlmaLinux:8: bind-libs-lite, AlmaLinux:8: bind-license, AlmaLinux:8: bind-lite-devel, AlmaLinux:8: bind-pkcs11 and 7 more

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

The following packages have been upgraded to a later upstream version: bind (9.11.36). (BZ#2013993)

Security Fix(es):

* bind: Lame cache can be abused to severely degrade resolver performance (CVE-2021-25219)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2022-00686

Withdrawn: BELL-CVE-2021-25219 — CVE-2021-25219 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2021-avi-828 — Une vulnérabilité a été découverte dans ISC BIND. Elle permet à un attaquant de provoquer un déni de service à distance.

certfr-2021-avi-828

EUVD-2026-166183

fkie_cve-2021-25219

In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

GHSA-x6vq-rxvf-3ggc

gsd-2021-25219

ICSA-22-069-09 — Siemens SINEC INS

SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c. Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact. SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements. pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled. flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results). SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling. zipfileUpdate in ext/misc/zipfile.c in SQLite…

msrc_CVE-2021-25219 — Lame cache can be abused to severely degrade resolver performance

msrc_CVE-2021-25219

OESA-2021-1459 — bind security update

Affected: openEuler:20.03-LTS-SP1: bind, openEuler:20.03-LTS-SP2: bind

Domain Name System (DNS) Server. Security Fix(es): In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.(CVE-2021-25219)

openSUSE-SU-2021:1502-1 — Security update for bind

Security update for bind

SUSE-SU-2021:3657-1 — Security update for bind

Security update for bind

UBUNTU-CVE-2021-25219

Affected: Ubuntu:Pro:14.04:LTS: bind9, Ubuntu:Pro:16.04:LTS: bind9, Ubuntu:18.04:LTS: bind9, Ubuntu:20.04:LTS: bind9, Ubuntu:22.04:LTS: bind9