CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25036 – unbound: assertion failure and denial of service in synth_cname
https://notcve.org/view.php?id=CVE-2019-25036
27 Apr 2021 — Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un error de aserción y denegación de servicio en la función synth_cname. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instalación de Unbound e... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-617: Reachable Assertion CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25037 – unbound: assertion failure and denial of service in dname_pkt_copy via an invalid packet
https://notcve.org/view.php?id=CVE-2019-25037
27 Apr 2021 — Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy via an invalid packet. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un fallo de aserción y denegación de servicio en la función dname_pkt_copy por medio de un paquete no válido. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunqu... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-617: Reachable Assertion •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25038 – unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c
https://notcve.org/view.php?id=CVE-2019-25038
27 Apr 2021 — Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un desbordamiento de enteros en un cálculo de tamaño en el archivo dnscrypt/dnscrypt.c. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una in... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25039 – unbound: integer overflow in a size calculation in respip/respip.c
https://notcve.org/view.php?id=CVE-2019-25039
27 Apr 2021 — Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un desbordamiento de enteros en un cálculo de tamaño en el archivo respip/respip.c. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instalació... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25040 – unbound: infinite loop via a compressed name in dname_pkt_copy
https://notcve.org/view.php?id=CVE-2019-25040
27 Apr 2021 — Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un bucle infinito por medio de un nombre comprimido en la función dname_pkt_copy. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instalación de U... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25041 – unbound: assertion failure via a compressed name in dname_pkt_copy
https://notcve.org/view.php?id=CVE-2019-25041
27 Apr 2021 — Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un fallo de aserción por medio de un nombre comprimido en la función dname_pkt_copy. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instalaci... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-617: Reachable Assertion •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25042 – unbound: out-of-bounds write via a compressed name in rdata_copy
https://notcve.org/view.php?id=CVE-2019-25042
27 Apr 2021 — Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5 permite una escritura fuera de límites por medio de un nombre comprimido en la función rdata_copy. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instal... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-28935 – Local symlink attack in Unbound and NSD
https://notcve.org/view.php?id=CVE-2020-28935
07 Dec 2020 — NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, maki... • https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10772 – unbound: incomplete fix for CVE-2020-12662 in RHEL7
https://notcve.org/view.php?id=CVE-2020-10772
22 Jun 2020 — An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound. Una corrección incompleta fue entregad... • https://bugzilla.redhat.com/show_bug.cgi?id=1846026 • CWE-400: Uncontrolled Resource Consumption CWE-406: Insufficient Control of Network Message Volume (Network Amplification) •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2020-12662 – unbound: amplification of an incoming query into a large number of queries directed to a target
https://notcve.org/view.php?id=CVE-2020-12662
19 May 2020 — Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records. Unbound versiones anteriores a 1.10.1, presenta un Control Insuficiente del Volumen de Mensajes de Red, también se conoce como un problema de "NXNSAttack". Esto es activado por subdominios aleatorios en NSDNAME en registros NS. A network amplification vulnerability was found in Unbound, in the way it processes delegation messages from one a... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html • CWE-400: Uncontrolled Resource Consumption •