Most recent entries from all

ALSA-2022:6763 — Important: bind security update

Affected: AlmaLinux:9: bind, AlmaLinux:9: bind-chroot, AlmaLinux:9: bind-devel, AlmaLinux:9: bind-dnssec-doc, AlmaLinux:9: bind-dnssec-utils, AlmaLinux:9: bind-libs, AlmaLinux:9: bind-license, AlmaLinux:9: bind-utils, AlmaLinux:9: python3-bind

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind: BIND 9 resolvers configured to answer from cache with zero stale-answer-timeout may terminate unexpectedly (CVE-2022-3080) * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177) * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-06125

Withdrawn: BELL-CVE-2022-3080 — CVE-2022-3080 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2022-avi-848 — De multiples vulnérabilités ont été découvertes dans Bind. Elles permettent à un attaquant de provoquer un déni de serv…

certfr-2022-avi-848

EUVD-2026-180975

fkie_cve-2022-3080

By sending specific queries to the resolver, an attacker can cause named to crash.

GHSA-7mrh-jrcg-wc76

By sending specific queries to the resolver, an attacker can cause named to crash.

gsd-2022-3080

msrc_CVE-2022-3080 — BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly

msrc_CVE-2022-3080

OESA-2022-1983 — bind security update

Affected: openEuler:22.03-LTS: bind

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): By sending specific queries to the resolver, an attacker can cause named to crash.(CVE-2022-3080) By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.(CVE-2022-38177) By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.(CVE-2022-38178) By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.(CVE-2022-2795) The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.(CVE-2022-2881) An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would…

openSUSE-SU-2024:12356-1 — bind-9.18.7-1.1 on GA media

bind-9.18.7-1.1 on GA media

UBUNTU-CVE-2022-3080

Affected: Ubuntu:22.04:LTS: bind9

By sending specific queries to the resolver, an attacker can cause named to crash.

WID-SEC-W-2022-1492 — Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Internet Systems Consortium BIND ausnutzen, um einen Denial of Service Angriff durchzuführen.