Summary
Leon Weber discovered that the ldns-keygen tool incorrectly set permissions
on private keys. A local attacker could possibly use this issue to obtain
generated private keys. This issue only applied to Ubuntu 14.04 LTS.
(CVE-2014-3209)
Stephan Zeisberg discovered that ldns incorrectly handled memory when
processing data. A remote attacker could use this issue to cause ldns to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2017-1000231, CVE-2017-1000232)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | ldns | 1.6.17-1ubuntu0.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | ldns | 1.6.17-8ubuntu0.1 |
Vulnerabilities 3
-
Unscored —
The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow l…
-
Unscored —
A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.
-
Unscored —
A double-free vulnerability in str2host.c in ldns 1.7.0 have unspecified impact and attack vectors.