Mageia alert MGASA-2016-0030 (bind)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2016-0030: Updated bind packages fix security vulnerability 
Date:
    	     
 
Wed, 20 Jan 2016 18:54:07 +0100
Message-ID:
    	     
 
<20160120175407.CEBE821E830@valstar.mageia.org>
MGASA-2016-0030 - Updated bind packages fix security vulnerability

Publication date: 20 Jan 2016
URL: http://advisories.mageia.org/MGASA-2016-0030.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2015-8704,
     CVE-2015-8705

Description:
In ISC BIND before 9.10.3-P3, a buffer size check used to guard against
overflow could cause named to exit with an INSIST failure In apl_42.c
(CVE-2015-8704).

In ISC BIND before 9.10.3-P3, errors can occur when OPT pseudo-RR data or
ECS options are formatted to text.  In 9.10.3 through 9.10.3-P2, the issue
may result in a REQUIRE assertion failure in buffer.c, causing a crash.
This can be avoided in named by disabling debug logging (CVE-2015-8705).

References:
- https://bugs.mageia.org/show_bug.cgi?id=17541
- https://kb.isc.org/article/AA-01335
- https://kb.isc.org/article/AA-01336
- https://kb.isc.org/article/AA-01346
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8704
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8705

SRPMS:
- 5/core/bind-9.10.3.P3-1.mga5