8966 2016-01-21 07:04:11 +0000 bind: CVE-2015-8704, CVE-2015-8705 2016-02-08 09:52:36 +0000 1 1 7 Build System, Metadata & Runtime OE-Core connectivity unspecified All Multiple VERIFIED FIXED High normal 2.1 M2 1 sona.sarmadi sona.sarmadi akuster bogdanx.a.voiculescu derek meta.mr.watcher meta.watcher alexandru.costinx.roman --- --- No (bug/feature does not impact docs) oldest_to_newest 58034 0 sona.sarmadi 2016-01-21 07:04:11 +0000 The following flaw in BIND was reported by ISC: CVE: CVE-2015-8704 bind: specific APL data could trigger an INSIST in apl_42.c Versions affected: 9.3.0->9.8.8, 9.9.0->9.9.8-P2, 9.9.3-S1->9.9.8-S3, 9.10.0->9.10.3-P2 Severity: High Exploitable: Remotely 9.9.8 patch: https://bugzilla.redhat.com/attachment.cgi?id=1115781 ================================================================ CVE: CVE-2015-8705 bind: crash when converting OPT resource records and ECS options to text format Versions affected: 9.10.0->9.10.3-P2 Severity: Medium Exploitable: Remotely 9.10.3-rt41396-and-rt41397-CVE-2015-8704-and-CVE-2015-8705.diff: https://bugzilla.redhat.com/attachment.cgi?id=1115783 ================================================================== References: https://kb.isc.org/article/AA-01335/74/CVE-2015-8704%3A-Specific-APL-data-could-trigger-an-INSIST-in-apl_42.c.html https://kb.isc.org/article/AA-01336/74/CVE-2015-8705%3A-Problems-converting-OPT-resource-records-and-ECS-options-to-text-format-can-cause-BIND-to-terminate.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8704 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8705 58165 1 akuster 2016-01-24 23:03:31 +0000 master package update submitted http://patches.openembedded.org/patch/113511/ 58215 2 sona.sarmadi 2016-01-26 07:49:34 +0000 patch sent for jethro: Patchwork [jethro] bind: CVE-2015-8704 and CVE-2015-8705 http://patchwork.openembedded.org/patch/113677/ fido & dizzy: Patchwork [fido,dizzy] bind: CVE-2015-8704 http://patchwork.openembedded.org/patch/113675/ 58246 3 derek 2016-01-26 16:59:50 +0000 dizzy and fido use bind 9.9.5 so they are not affected by CVE-2015-8705 58708 4 sona.sarmadi 2016-02-08 07:33:44 +0000 Fixed in jethro: http://git.yoctoproject.org/cgit/cgit.cgi/poky/log/?h=jethro&qt=grep&q=CVE-2015-8704+and+CVE-2015-8705 master: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=9967746a35d9217d074a79e67b4f05779ba01e43 58714 5 alexandru.costinx.roman 2016-02-08 09:52:36 +0000 Verified.