Summary
It was discovered that Unbound incorrectly handled string comparisons,
which could lead to a NULL pointer dereference. An attacker could
potentially use this issue to cause a denial of service. (CVE-2024-43167)
It was discovered that Unbound incorrectly handled memory in
cfg_mark_ports, which could lead to a heap buffer overflow. A local
attacker could potentially use this issue to cause a denial of service
or execute arbitrary code. (CVE-2024-43168)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | unbound | 1.9.4-2ubuntu1.8 |
| Ubuntu · 22.04 LTS 22.04:LTS | unbound | 1.13.1-1ubuntu5.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | unbound | 1.19.2-1ubuntu3.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | unbound | 1.4.22-1ubuntu4.14.04.3+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | unbound | 1.5.8-1ubuntu1.1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | unbound | 1.6.7-1ubuntu2.6+esm2 |
Vulnerabilities 2
-
Medium 4.8
Unbound: heap-buffer-overflow in unbound
DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a secu…
-
Low 2.8
Unbound: null pointer dereference in unbound
DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a secu…