From mboxrd@z Thu Jan  1 00:00:00 1970
From: Matthias Fischer <matthias.fischer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] bind: Update to 9.11.0-P3
Date: Fri, 10 Feb 2017 22:44:58 +0100
Message-ID: <20170210214458.15316-1-matthias.fischer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============3545951038504250179=="
List-Id: <development.lists.ipfire.org>

--===============3545951038504250179==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

For details see:
https://ftp.isc.org/isc/bind9/9.11.0-P3/RELEASE-NOTES-bind-9.11.0-P3.html

"BIND 9.11.0-P3 addresses the security issue described in CVE-2017-3135,
and fixes a regression introduced in a prior security release.

BIND 9.11.0-P2 addresses the security issues described in CVE-2016-9131,
CVE-2016-9147, CVE-2016-9444 and CVE-2016-9778.

BIND 9.11.0-P1 addresses the security issue described in CVE-2016-8864.

...

Security Fixes

If a server is configured with a response policy zone (RPZ) that rewrites an
answer with local data, and is also configured for DNS64 address mapping, a
NULL pointer can be read triggering a server crash. This flaw is disclosed in
CVE-2017-3135. [RT #44434]

A coding error in the nxdomain-redirect feature could lead to an assertion
failure if the redirection namespace was served from a local authoritative
data source such as a local zone or a DLZ instead of via recursive lookup.
This flaw is disclosed in CVE-2016-9778. [RT #43837]

named could mishandle authority sections with missing RRSIGs, triggering an
assertion failure. This flaw is disclosed in CVE-2016-9444. [RT #43632]

named mishandled some responses where covering RRSIG records were returned
without the requested data, resulting in an assertion failure. This flaw is
disclosed in CVE-2016-9147.
[RT #43548]

named incorrectly tried to cache TKEY records which could trigger an assertion
failure when there was a class mismatch. This flaw is disclosed in CVE-2016-9=
131.
[RT #43522]

It was possible to trigger assertions when processing responses containing an=
swers
of type DNAME. This flaw is disclosed in CVE-2016-8864. [RT #43465]"

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org>
---
 lfs/bind | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lfs/bind b/lfs/bind
index d25c2df9f..e178219c2 100644
--- a/lfs/bind
+++ b/lfs/bind
@@ -25,7 +25,7 @@
=20
 include Config
=20
-VER        =3D 9.11.0-P2
+VER        =3D 9.11.0-P3
=20
 THISAPP    =3D bind-$(VER)
 DL_FILE    =3D $(THISAPP).tar.gz
@@ -43,7 +43,7 @@ objects =3D $(DL_FILE)
=20
 $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE)
=20
-$(DL_FILE)_MD5 =3D b8ccec541de18ac2716e7a8268baaaba
+$(DL_FILE)_MD5 =3D 311787a0a69345a1f1cf7869b0266bf0
=20
 install : $(TARGET)
=20
--=20
2.11.0


--===============3545951038504250179==--