CVE-2019-16866

Published: 03 October 2019

Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.

Priority

CVSS 3 base score: 7.5

Status

Package	Release	Status
unbound Launchpad, Ubuntu, Debian	Upstream	Needs triage



	Ubuntu 18.04 LTS (Bionic Beaver)	Not vulnerable
	Ubuntu 16.04 LTS (Xenial Xerus)	Not vulnerable
	Ubuntu 14.04 ESM (Trusty Tahr)	Not vulnerable
	Patches: Upstream: https://nlnetlabs.nl/downloads/unbound/patch_cve_2019-16866.diff

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16866
https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt
https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog
https://usn.ubuntu.com/usn/usn-4149-1
NVD
Launchpad
Debian

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941692

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM