CVE-2019-16866

Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.

Published: Oct 3, 2019
Updated: Apr 13, 2023
CVE: CVE-2019-16866
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:N/I:N/A:P

CWEs:

CWE-755
CWE-908

Affected Software
References

Software	From	Fixed in
nlnetlabs / unbound	-	1.9.4
canonical / ubuntu_linux	19.04	19.04.x

https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog
https://lists.fedoraproject.org/archives/list/[email protected]/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC/
https://lists.fedoraproject.org/archives/list/[email protected]/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ/
https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt
https://seclists.org/bugtraq/2019/Oct/23
https://usn.ubuntu.com/4149-1/
https://www.debian.org/security/2019/dsa-4544

Vulnerability Database

289,689

CVE-2019-16866