svn commit: r539533 - head/security/vuxml
Philip Paeps
philip at FreeBSD.org
Thu Jun 18 08:06:00 UTC 2020
Author: philip
Date: Thu Jun 18 08:05:59 2020
New Revision: 539533
URL: https://svnweb.freebsd.org/changeset/ports/539533
Log:
security/vuxml: CVE-2020-8618 and CVE-2020-8619
ISC published CVE-2020-8618 affecting dns/bind916 and CVE-2020-8619
affecting dns/bind911 and dns/bind916. Both ports were updated.
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Thu Jun 18 07:31:17 2020 (r539532)
+++ head/security/vuxml/vuln.xml Thu Jun 18 08:05:59 2020 (r539533)
@@ -58,6 +58,73 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="f00d1873-b138-11ea-8659-901b0ef719ab">
+ <topic>BIND -- Remote Denial of Service vulnerability</topic>
+ <affects>
+ <package>
+ <name>bind911</name>
+ <range><ge>9.11.14</ge><lt>9.11.20</lt></range>
+ </package>
+ <package>
+ <name>bind916</name>
+ <range><ge>9.16.0</ge><lt>9.16.4</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>ISC reports:</p>
+ <blockquote cite="https://kb.isc.org/docs/cve-2020-8619">
+ <p>The asterisk character ("*") is allowed in DNS zone files, where
+ it is most commonly present as a wildcard at a terminal node of
+ the Domain Name System graph. However, the RFCs do not require
+ and BIND does not enforce that an asterisk character be present
+ only at a terminal node.</p>
+ <p>A problem can occur when an asterisk is present in an empty
+ non-terminal location within the DNS graph. If such a node exists,
+ after a series of queries, named can reach an inconsistent state
+ that results in the failure of an assertion check in rbtdb.c,
+ followed by the program exiting due to the assertion failure.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2020-8619</cvename>
+ <url>https://kb.isc.org/docs/cve-2020-8619</url>
+ </references>
+ <dates>
+ <discovery>2020-06-17</discovery>
+ <entry>2020-06-18</entry>
+ </dates>
+ </vuln>
+
+ <vuln vid="75d72e03-b137-11ea-8659-901b0ef719ab">
+ <topic>BIND -- Remote Denial of Service vulnerability</topic>
+ <affects>
+ <package>
+ <name>bind916</name>
+ <range><ge>9.16.0</ge><lt>9.16.4</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>ISC reports:</p>
+ <blockquote cite="https://kb.isc.org/docs/cve-2020-8618">
+ <p>An assertion check in BIND (that is meant to prevent going beyond
+ the end of a buffer when processing incoming data) can be
+ incorrectly triggered by a large response during zone transfer.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2020-8618</cvename>
+ <url>https://kb.isc.org/docs/cve-2020-8618</url>
+ </references>
+ <dates>
+ <discovery>2020-06-17</discovery>
+ <entry>2020-06-18</entry>
+ </dates>
+ </vuln>
+
<vuln vid="96fb446d-ac7b-11ea-8b5e-b42e99a1b9c3">
<topic>LibreOffice Security Advisory</topic>
<affects>
More information about the svn-ports-all
mailing list