Skip to content
OpenAdvisories
High ELSA-2025-21034 3 CVEs

Important: bind security update (Oracle Linux 10)

Published Dec 2, 2025 · Updated Dec 2, 2025

Ecosystem: Oracle Linux

Summary

[9.18.33-10.0.1]
- Fix warning when changing device file permissions [Orabug: 36518580]

[32:9.18.33-10.2]
- Fix upstream reported regression in recent CVE fix (CVE-2025-8677)

[32:9.18.33-10.1]
- Refuse malformed DNSKEY records (CVE-2025-8677)
- Address various spoofing attacks (CVE-2025-40778)
- Prevent cache poisoning due to weak PRNG (CVE-2025-40780)

[32:9.18.33-10]
- Fix failures in idna system test (RHEL-66172)

[32:9.18.33-9]
- Decode IDN names on input in all situations in utilities (RHEL-66172)

[32:9.18.33-8]
- logrotate: skip if empty and remove old variants (RHEL-113942)

[32:9.18.33-7]
- Add runtime tunable limit by environment NAMED_MAXADDITIONAL (RHEL-84006)

[32:9.18.33-6]
- Change additional NS to be served partially (RHEL-84006)

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 10 bind 32:9.18.33-10.0.1.el10_1.2
Oracle Linux · 10 bind-chroot 32:9.18.33-10.0.1.el10_1.2
Oracle Linux · 10 bind-devel 32:9.18.33-10.0.1.el10_1.2
Oracle Linux · 10 bind-dnssec-utils 32:9.18.33-10.0.1.el10_1.2
Oracle Linux · 10 bind-doc 32:9.18.33-10.0.1.el10_1.2
Oracle Linux · 10 bind-libs 32:9.18.33-10.0.1.el10_1.2
Oracle Linux · 10 bind-license 32:9.18.33-10.0.1.el10_1.2
Oracle Linux · 10 bind-utils 32:9.18.33-10.0.1.el10_1.2

Vulnerabilities 3

  • High 8.6
    CVE-2025-40778 Public exploit

    Cache poisoning attacks with unsolicited RRs

    Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.6
    CVE-2025-40780

    Cache poisoning due to weak PRNG

    In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2025-8677 EPSS 11%

    Resource exhaustion via malformed DNSKEY handling

    Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi