ALT-PU-2025-14394-1

Package update bind in branch p10_e2k

Version9.16.50-alt3

Task#0

Published2025-11-11

Max severityHIGH

Severity:

Closed issues (3)

HIGH8.6

Уязвимость DNS-сервера BIND, связанная с загрузкой внешних ненадёжных данных вместе с надёжными данными, позволяющая нарушителю перенаправить трафик на вредоносный сайт

Published: 2025-11-01Modified: 2026-05-06

CVSS 3.xHIGH 8.6

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CVSS 2.0HIGH 7.8

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:C/A:N

References

HIGH8.6

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Published: 2025-10-22Modified: 2026-04-15

CVSS 3.xHIGH 8.6

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References

HIGH8.6

In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Published: 2025-10-22Modified: 2026-04-15

CVSS 3.xHIGH 8.6

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References