The following flaw in BIND was reported by ISC: CVE: CVE-2015-8704 bind: specific APL data could trigger an INSIST in apl_42.c Versions affected: 9.3.0->9.8.8, 9.9.0->9.9.8-P2, 9.9.3-S1->9.9.8-S3, 9.10.0->9.10.3-P2 Severity: High Exploitable: Remotely 9.9.8 patch: https://bugzilla.redhat.com/attachment.cgi?id=1115781 ================================================================ CVE: CVE-2015-8705 bind: crash when converting OPT resource records and ECS options to text format Versions affected: 9.10.0->9.10.3-P2 Severity: Medium Exploitable: Remotely 9.10.3-rt41396-and-rt41397-CVE-2015-8704-and-CVE-2015-8705.diff: https://bugzilla.redhat.com/attachment.cgi?id=1115783 ================================================================== References: https://kb.isc.org/article/AA-01335/74/CVE-2015-8704%3A-Specific-APL-data-could-trigger-an-INSIST-in-apl_42.c.html https://kb.isc.org/article/AA-01336/74/CVE-2015-8705%3A-Problems-converting-OPT-resource-records-and-ECS-options-to-text-format-can-cause-BIND-to-terminate.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8704 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8705
master package update submitted http://patches.openembedded.org/patch/113511/
patch sent for jethro: Patchwork [jethro] bind: CVE-2015-8704 and CVE-2015-8705 http://patchwork.openembedded.org/patch/113677/ fido & dizzy: Patchwork [fido,dizzy] bind: CVE-2015-8704 http://patchwork.openembedded.org/patch/113675/
dizzy and fido use bind 9.9.5 so they are not affected by CVE-2015-8705
Fixed in jethro: http://git.yoctoproject.org/cgit/cgit.cgi/poky/log/?h=jethro&qt=grep&q=CVE-2015-8704+and+CVE-2015-8705 master: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=9967746a35d9217d074a79e67b4f05779ba01e43
Verified.