CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25035 – unbound: out-of-bounds write in sldns_bget_token_par
https://notcve.org/view.php?id=CVE-2019-25035
27 Apr 2021 — Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite una escritura fuera de límites en la función sldns_bget_token_par. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instalación de Unbound en funcionamiento ... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25036 – unbound: assertion failure and denial of service in synth_cname
https://notcve.org/view.php?id=CVE-2019-25036
27 Apr 2021 — Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un error de aserción y denegación de servicio en la función synth_cname. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instalación de Unbound e... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-617: Reachable Assertion CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25037 – unbound: assertion failure and denial of service in dname_pkt_copy via an invalid packet
https://notcve.org/view.php?id=CVE-2019-25037
27 Apr 2021 — Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy via an invalid packet. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un fallo de aserción y denegación de servicio en la función dname_pkt_copy por medio de un paquete no válido. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunqu... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-617: Reachable Assertion •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25038 – unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c
https://notcve.org/view.php?id=CVE-2019-25038
27 Apr 2021 — Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un desbordamiento de enteros en un cálculo de tamaño en el archivo dnscrypt/dnscrypt.c. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una in... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25039 – unbound: integer overflow in a size calculation in respip/respip.c
https://notcve.org/view.php?id=CVE-2019-25039
27 Apr 2021 — Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un desbordamiento de enteros en un cálculo de tamaño en el archivo respip/respip.c. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instalació... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25040 – unbound: infinite loop via a compressed name in dname_pkt_copy
https://notcve.org/view.php?id=CVE-2019-25040
27 Apr 2021 — Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un bucle infinito por medio de un nombre comprimido en la función dname_pkt_copy. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instalación de U... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25041 – unbound: assertion failure via a compressed name in dname_pkt_copy
https://notcve.org/view.php?id=CVE-2019-25041
27 Apr 2021 — Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5, permite un fallo de aserción por medio de un nombre comprimido en la función dname_pkt_copy. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instalaci... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-617: Reachable Assertion •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25042 – unbound: out-of-bounds write via a compressed name in rdata_copy
https://notcve.org/view.php?id=CVE-2019-25042
27 Apr 2021 — Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited ** EN DISPUTA ** Unbound versiones anteriores a 1.9.5 permite una escritura fuera de límites por medio de un nombre comprimido en la función rdata_copy. NOTA: El proveedor niega que esto sea una vulnerabilidad. Aunque el código puede ser vulnerable, una instal... • https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-28935 – Local symlink attack in Unbound and NSD
https://notcve.org/view.php?id=CVE-2020-28935
07 Dec 2020 — NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, maki... • https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-17366
https://notcve.org/view.php?id=CVE-2020-17366
05 Aug 2020 — An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation ".roa" files or X509 Certificate Revocation List files from the RPKI relying party's view. Se detectó un problema en NLnet Labs Routinator versiones 0.1.0 hasta 0.7.1. Permite a atacantes remotos omitir las restricciones de acceso previstas o causar una ... • https://github.com/NLnetLabs/routinator/issues/319 • CWE-295: Improper Certificate Validation •