[SECURITY] [DLA 2910-1] ldns security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2910-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Chris Lamb
February 03, 2022 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : ldns
Version : 1.7.0-1+deb9u1
CVE IDs : CVE-2020-19860, CVE-2020-19861,
CVE-2017-1000231, CVE-2017-1000232
Debian Bugs : #882014, #882015
It was discovered that there were four issues in ldns, a library used
in Domain Name System (DNS) related programs:
* CVE-2020-19860: When ldns verified a zone file, the
ldns_rr_new_frm_str_internal function had a heap out of bounds
read vulnerability. An attacker could have potentially leaked
information on the heap by constructing a zone file payload.
* CVE-2020-19861: When a zone file in ldns was parsed, the function
ldns_nsec3_salt_data was too trusting of the length value
obtained from the zone file. This could have caused heap overflow
information leakage.
* CVE-2017-1000231: A double-free vulnerability in parse.c could
have resulted in an attack vector. (#882015)
* CVE-2017-1000232: A double-free vulnerability within str2host.c
could have resulted in an attack vector. (#882014)
For Debian 9 "Stretch", these problems have been fixed in version
1.7.0-1+deb9u1.
We recommend that you upgrade your ldns packages.
For the detailed security status of ldns please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ldns
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmH9awcACgkQHpU+J9Qx
Hli9jxAAisg2QkEMdz2D5nqm724lzIFnaSIkTTK8zOHdYuwIsF9BhYMFBrvrB97v
l/7Vq2PXI14cKOCVGy5s4qDZOu8CWx2xZjKP7M+akY2SY1A3Htk77w0RKn7dFoK9
raoZK1pfRTTkshEtYnqYWzguX3rWm3NvrkoRgP/VcZtCdmiZ+x2HKVGv4mMt4Hfe
GnLE74RqlCXTPxVn87vbzV+gZVFvlqqKrIoQ/KXgdeS4lgwHJHP0+ovVfzseSnqe
2efX1NH3A4CKzwajXbYEjNGKxTEitR8tids8LB2AU74SIZXvTs226K8wO6t3tqgl
3Tpfs0UZDGvGBaNcx6+WheBDq6pGAYHVbHUloubRqjI172z9keLaYOxe7b5iv1fj
i8lzrEB4dC1o55wRJ1Jw6PfJGMCOQZSbu4L8zX4KQMS0TNGdjGYBgh+RakARgPWQ
8xK5lRgmuTbW8Fb7cC/TVpCc2wsuGif3SQ7sABkDjEelSbMod1ejdSSfpy111tZl
NVfyOprDAaKrhXVrhyMkinrNT8Wz7THFTjDwG2WE8Xo4uhZXA4+BA3zjtJSAWrVv
0ZbvOoc96iEuo6aelJhjBC9Zyy1TwKG059lodX0rSJgcnbX+HBLsK0WILcTfDHzV
BZv+V3LZBG7rxHvypOT4eXxrQyMcZdAIcl+rqM46vWPTgmxAZEk=
=0Jcf
-----END PGP SIGNATURE-----
Reply to: