bind-9.18.7-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:12356-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z bind-9.18.7-1.1 on GA media These are all security issues fixed in the bind-9.18.7-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-12356 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2022-2795/ SUSE CVE CVE-2022-2795 page https://www.suse.com/security/cve/CVE-2022-2881/ SUSE CVE CVE-2022-2881 page https://www.suse.com/security/cve/CVE-2022-2906/ SUSE CVE CVE-2022-2906 page https://www.suse.com/security/cve/CVE-2022-3080/ SUSE CVE CVE-2022-3080 page https://www.suse.com/security/cve/CVE-2022-38178/ SUSE CVE CVE-2022-38178 page openSUSE Tumbleweed bind-9.18.7-1.1 bind-doc-9.18.7-1.1 bind-modules-bdbhpt-9.18.7-1.1 bind-modules-generic-9.18.7-1.1 bind-modules-ldap-9.18.7-1.1 bind-modules-mysql-9.18.7-1.1 bind-modules-perl-9.18.7-1.1 bind-modules-sqlite3-9.18.7-1.1 bind-utils-9.18.7-1.1 bind-9.18.7-1.1 as a component of openSUSE Tumbleweed bind-doc-9.18.7-1.1 as a component of openSUSE Tumbleweed bind-modules-bdbhpt-9.18.7-1.1 as a component of openSUSE Tumbleweed bind-modules-generic-9.18.7-1.1 as a component of openSUSE Tumbleweed bind-modules-ldap-9.18.7-1.1 as a component of openSUSE Tumbleweed bind-modules-mysql-9.18.7-1.1 as a component of openSUSE Tumbleweed bind-modules-perl-9.18.7-1.1 as a component of openSUSE Tumbleweed bind-modules-sqlite3-9.18.7-1.1 as a component of openSUSE Tumbleweed bind-utils-9.18.7-1.1 as a component of openSUSE Tumbleweed By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. CVE-2022-2795 openSUSE Tumbleweed:bind-9.18.7-1.1 openSUSE Tumbleweed:bind-doc-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-bdbhpt-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-generic-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-ldap-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-mysql-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-perl-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-sqlite3-9.18.7-1.1 openSUSE Tumbleweed:bind-utils-9.18.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-2795.html CVE-2022-2795 https://bugzilla.suse.com/1203614 SUSE Bug 1203614 https://bugzilla.suse.com/1205842 SUSE Bug 1205842 https://bugzilla.suse.com/1209913 SUSE Bug 1209913 The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process. CVE-2022-2881 openSUSE Tumbleweed:bind-9.18.7-1.1 openSUSE Tumbleweed:bind-doc-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-bdbhpt-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-generic-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-ldap-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-mysql-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-perl-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-sqlite3-9.18.7-1.1 openSUSE Tumbleweed:bind-utils-9.18.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-2881.html CVE-2022-2881 https://bugzilla.suse.com/1203615 SUSE Bug 1203615 An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service. CVE-2022-2906 openSUSE Tumbleweed:bind-9.18.7-1.1 openSUSE Tumbleweed:bind-doc-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-bdbhpt-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-generic-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-ldap-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-mysql-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-perl-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-sqlite3-9.18.7-1.1 openSUSE Tumbleweed:bind-utils-9.18.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-2906.html CVE-2022-2906 https://bugzilla.suse.com/1203616 SUSE Bug 1203616 By sending specific queries to the resolver, an attacker can cause named to crash. CVE-2022-3080 openSUSE Tumbleweed:bind-9.18.7-1.1 openSUSE Tumbleweed:bind-doc-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-bdbhpt-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-generic-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-ldap-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-mysql-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-perl-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-sqlite3-9.18.7-1.1 openSUSE Tumbleweed:bind-utils-9.18.7-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-3080.html CVE-2022-3080 https://bugzilla.suse.com/1203618 SUSE Bug 1203618 By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. CVE-2022-38178 openSUSE Tumbleweed:bind-9.18.7-1.1 openSUSE Tumbleweed:bind-doc-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-bdbhpt-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-generic-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-ldap-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-mysql-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-perl-9.18.7-1.1 openSUSE Tumbleweed:bind-modules-sqlite3-9.18.7-1.1 openSUSE Tumbleweed:bind-utils-9.18.7-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-38178.html CVE-2022-38178 https://bugzilla.suse.com/1203620 SUSE Bug 1203620