Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20550-1

Опубликовано: 16 апр. 2026
Источник: suse-cvrf

Описание

Security update for bind

This update for bind fixes the following issues:

  • Update to release 9.20.21
  • CVE-2026-1519: maliciously crafted DNSSEC-validated zone can lead to denial of service (bsc#1260805).
  • CVE-2026-3104: memory leak in code preparing DNSSEC proofs of non-existence allows for DoS (bsc#1260567).
  • CVE-2026-3119: authenticated queries containing a TKEY record may cause named to terminate unexpectedly (bsc#1260568).
  • CVE-2026-3591: stack use-after-return flaw in SIG(0) handling code allows for ACL bypass (bsc#1260569).

Список пакетов

openSUSE Leap 16.0
bind-9.20.21-160000.1.1
bind-doc-9.20.21-160000.1.1
bind-modules-bdbhpt-9.20.21-160000.1.1
bind-modules-generic-9.20.21-160000.1.1
bind-modules-ldap-9.20.21-160000.1.1
bind-modules-mysql-9.20.21-160000.1.1
bind-modules-perl-9.20.21-160000.1.1
bind-modules-sqlite3-9.20.21-160000.1.1
bind-utils-9.20.21-160000.1.1

Ссылки

Описание

If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.

Затронутые продукты
openSUSE Leap 16.0:bind-9.20.21-160000.1.1
openSUSE Leap 16.0:bind-doc-9.20.21-160000.1.1
openSUSE Leap 16.0:bind-modules-bdbhpt-9.20.21-160000.1.1
openSUSE Leap 16.0:bind-modules-generic-9.20.21-160000.1.1
Ссылки

Описание

A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

Затронутые продукты
openSUSE Leap 16.0:bind-9.20.21-160000.1.1
openSUSE Leap 16.0:bind-doc-9.20.21-160000.1.1
openSUSE Leap 16.0:bind-modules-bdbhpt-9.20.21-160000.1.1
openSUSE Leap 16.0:bind-modules-generic-9.20.21-160000.1.1
Ссылки

Описание

Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

Затронутые продукты
openSUSE Leap 16.0:bind-9.20.21-160000.1.1
openSUSE Leap 16.0:bind-doc-9.20.21-160000.1.1
openSUSE Leap 16.0:bind-modules-bdbhpt-9.20.21-160000.1.1
openSUSE Leap 16.0:bind-modules-generic-9.20.21-160000.1.1
Ссылки

Описание

A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

Затронутые продукты
openSUSE Leap 16.0:bind-9.20.21-160000.1.1
openSUSE Leap 16.0:bind-doc-9.20.21-160000.1.1
openSUSE Leap 16.0:bind-modules-bdbhpt-9.20.21-160000.1.1
openSUSE Leap 16.0:bind-modules-generic-9.20.21-160000.1.1
Ссылки