Source: unbound Version: 1.9.3-1 Severity: important Tags: security upstream Control: found -1 1.9.0-2
Hi, The following vulnerability was published for unbound. CVE-2019-16866[0]: | Unbound before 1.9.4 accesses uninitialized memory, which allows | remote attackers to trigger a crash via a crafted NOTIFY query. The | source IP address of the query must match an access-control rule. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2019-16866 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16866 [1] https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt Please adjust the affected versions in the BTS as needed. If I checked correctly, then this issue was really only introduced upstream in 1.7.1, thus not affecting stretch. Please double-check. Regards, Salvatore
