Upstream has issued advisories today (January 19): https://kb.isc.org/article/AA-01335 https://kb.isc.org/article/AA-01336 These are remotely exploitable denial of service vulnerabilities. The first is high severity. Updated packages uploaded for Mageia 5 and Cauldron. Advisory: ======================== Updated bind packages fix security vulnerabilities: In ISC BIND before 9.10.3-P3, a buffer size check used to guard against overflow could cause named to exit with an INSIST failure In apl_42.c (CVE-2015-8704). In ISC BIND before 9.10.3-P3, errors can occur when OPT pseudo-RR data or ECS options are formatted to text. In 9.10.3 through 9.10.3-P2, the issue may result in a REQUIRE assertion failure in buffer.c, causing a crash. This can be avoided in named by disabling debug logging (CVE-2015-8705). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8704 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8705 https://kb.isc.org/article/AA-01335 https://kb.isc.org/article/AA-01336 https://kb.isc.org/article/AA-01346 ======================== Updated packages in core/updates_testing: ======================== bind-9.10.3.P3-1.mga5 bind-sdb-9.10.3.P3-1.mga5 bind-utils-9.10.3.P3-1.mga5 bind-devel-9.10.3.P3-1.mga5 bind-doc-9.10.3.P3-1.mga5 from bind-9.10.3.P3-1.mga5.src.rpm Reproducible: Steps to Reproduce:
Testing procedure: similar to https://bugs.mageia.org/show_bug.cgi?id=9163#c8
Whiteboard: (none) => has_procedure
CC: (none) => davidwhodginsWhiteboard: has_procedure => has_procedure advisory
Keywords: (none) => validated_updateWhiteboard: has_procedure advisory => has_procedure advisory MGA5-64-OKCC: (none) => sysadmin-bugs
Testing complete on x86_64. Advisory added to svn. Validating the update.
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0030.html
Status: NEW => RESOLVEDResolution: (none) => FIXED
URL: (none) => http://lwn.net/Vulnerabilities/672559/
LWN reference for CVE-2015-8705: http://lwn.net/Vulnerabilities/672817/