Mageia alert MGASA-2015-0341 (bind)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2015-0341: Updated bind packages fix security vulnerabilities 
Date:
    	     
 
Tue, 8 Sep 2015 09:21:13 +0200
Message-ID:
    	     
 
<20150908072114.13C3B48B1B@valstar.mageia.org>
MGASA-2015-0341 - Updated bind packages fix security vulnerabilities

Publication date: 08 Sep 2015
URL: http://advisories.mageia.org/MGASA-2015-0341.html
Type: security
Affected Mageia releases: 4, 5
CVE: CVE-2015-5722,
     CVE-2015-5986

Description:
Updated bind packages fix security vulnerability:

Parsing a malformed DNSSEC key can cause a validating resolver to exit due to
a failed assertion in buffer.c.  It is possible for a remote attacker to
deliberately trigger this condition, for example by using a query which
requires a response from a zone containing a deliberately malformed key
(CVE-2015-5722).

An incorrect boundary check in openpgpkey_61.c can cause named to terminate
due to a REQUIRE assertion failure.  This defect can be deliberately exploited
by an attacker who can provide a maliciously constructed response in answer to
a query (CVE-2015-5986).

References:
- https://bugs.mageia.org/show_bug.cgi?id=16695
- https://kb.isc.org/article/AA-01287
- https://kb.isc.org/article/AA-01291
- https://kb.isc.org/article/AA-01300
- https://kb.isc.org/article/AA-01301
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5722
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5986

SRPMS:
- 4/core/bind-9.9.7.P3-1.mga4
- 5/core/bind-9.10.2.P4-1.mga5