Index: vuln.xml =================================================================== --- vuln.xml (revision 485327) +++ vuln.xml (working copy) @@ -58,6 +58,47 @@ * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + powerdns -- Multiple vulnerabilities + + + powerdns + 4.1.5 + + + + +

PowerDNS Team reports:

+
CVE-2018-10851: An issue has been found in PowerDNS Authoritative Server allowing + an authorized user to cause a memory leak by inserting a specially crafted record + in a zone under their control, then sending a DNS query for that record. The issue + is due to the fact that some memory is allocated before the parsing and is not + always properly released if the record is malformed. When the PowerDNS + Authoritative Server is run inside the guardian (--guardian), or inside a + supervisor like supervisord or systemd, an out-of-memory crash will lead to an + automatic restart, limiting the impact to a somewhat degraded service.
+
CVE-2018-14626: An issue has been found in PowerDNS Authoritative Server allowing + a remote user to craft a DNS query that will cause an answer without DNSSEC + records to be inserted into the packet cache and be returned to clients asking for + DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname + and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients + will consider the answer to be bogus until it expires from the packet cache, + leading to a denial of service.
+

+ + + + https://doc.powerdns.com/authoritative/changelog/4.1.html + CVE-2018-10851 + CVE-2018-14626 + + + 2018-11-06 + 2018-11-19 + + + powerdns-recursor -- Multiple vulnerabilities