CVE-2017-15107

A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist.

A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist.

A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist.

This update for dnsmasq fixes the following issues:

Security issues fixed:

• CVE-2019-14834: Fixed a memory leak which could have allowed to remote attackers to cause denial of service via DHCP response creation (bsc#1154849)
• CVE-2017-15107: Fixed a vulnerability in DNSSEC implementation. Processing of wildcard synthesized NSEC records may result improper validation for non-existance (bsc#1076958).

Other issues addressed:

• Included linux/sockios.h to get SIOCGSTAMP (bsc#1156543).
• Removed cache size limit (bsc#1138743).
• bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the dnsmasq-2.86-1.1 package on the GA media of openSUSE Tumbleweed.

This update for dnsmasq fixes the following issues:

Security issue fixed:

• CVE-2017-15107: Fixed a vulnerability in DNSSEC implementation. Processing of wildcard synthesized NSEC records may result improper validation for non-existance. (bsc#1076958)

Non-security issue fixed:

• Removed cache size limit. (bsc#1138743)

This update for dnsmasq fixes the following issues:

Security issue fixed:

• CVE-2017-15107: Fixed a vulnerability in DNSSEC implementation. Processing of wildcard synthesized NSEC records may result improper validation for non-existance. (bsc#1076958)

Non-security issue fixed:

• Reload system dbus to pick up policy change on install (bsc#1054429).

This update for dnsmasq fixes the following issues:

Security issues fixed:

• CVE-2019-14834: Fixed a memory leak which could have allowed to remote attackers to cause denial of service via DHCP response creation (bsc#1154849)
• CVE-2017-15107: Fixed a vulnerability in DNSSEC implementation. Processing of wildcard synthesized NSEC records may result improper validation for non-existance (bsc#1076958).

Other issues addressed:

• Included linux/sockios.h to get SIOCGSTAMP (bsc#1156543).
• Removed cache size limit (bsc#1138743).
• Included config files from /etc/dnsmasq.d/*.conf (bsc#1152539).

This update for dnsmasq fixes the following issues:

Security issues fixed:

• CVE-2019-14834: Fixed a memory leak which could have allowed to remote attackers to cause denial of service via DHCP response creation (bsc#1154849)
• CVE-2017-15107: Fixed a vulnerability in DNSSEC implementation. Processing of wildcard synthesized NSEC records may result improper validation for non-existance (bsc#1076958).

Other issues addressed:

• Included linux/sockios.h to get SIOCGSTAMP (bsc#1156543).
• Removed cache size limit (bsc#1138743).
• bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .

It was discovered that Dnsmasq incorrectly handled certain wildcard synthesized NSEC records. A remote attacker could possibly use this issue to prove the non-existence of hostnames that actually exist. (CVE-2017-15107)

It was discovered that Dnsmasq incorrectly handled certain large DNS packets. A remote attacker could possibly use this issue to cause Dnsmasq to crash, resulting in a denial of service. (CVE-2019-14513)