Summary
[32:9.11.4-26.0.5.P2.16]
- Resolve CVE-2025-40778 [Orabug: 38699863]
[32:9.11.4-26.0.3.P2.16]
- Resolve CVE-2024-11187 [Orabug: 37616907]
[32:9.11.4-26.0.1.P2.16]
- Resolve CVE-2024-1975
- Resolve CVE-2024-1737
- Add ability to change runtime limits for max types and records per name
[32:9.11.4-26.P2.16]
- Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387
CVE-2023-50868)
- Add missing design by contract tests to dns_catz*
- Speed up parsing of DNS messages with many different names (CVE-2023-4408)
- Do not use header_prev in expire_lru_headers
[32:9.11.4-26.P2.15]
- Limit the amount of recursion possible in control channel (CVE-2023-3341)
[32:9.11.4-26.P2.14]
- Prevent the cache going over the configured limit (CVE-2023-2828)
[32:9.11.4-26.P2.13]
- Tighten cache protection against record from forwarders (CVE-2021-25220)
[32:9.11.4-26.P2.12]
- Include test of forwarders (CVE-2021-25220)
[32:9.11.4-26.P2.11]
- Prevent excessive resource use while processing large delegations.
(CVE-2022-2795)
[32:9.11.4-26.P2.10]
- Fix memory leak in ECDSA verify processing (CVE-2022-38177)
- Fix memory leak in EdDSA verify processing (CVE-2022-38178)
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | bind | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-chroot | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-devel | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-export-devel | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-export-libs | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-libs | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-libs-lite | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-license | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-lite-devel | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-pkcs11 | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-pkcs11-devel | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-pkcs11-libs | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-pkcs11-utils | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-sdb | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-sdb-chroot | 32:9.11.4-26.0.5.P2.el7_9.16 |
| Oracle Linux · 7 | bind-utils | 32:9.11.4-26.0.5.P2.el7_9.16 |
Vulnerabilities 1
-
High 8.6CVE-2025-40778 Public exploit
Cache poisoning attacks with unsolicited RRs
Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …