{"id":"CVE-2016-7069","aliases":["DEBIAN-CVE-2016-7069","EUVD-2016-7949","GHSA-v3pf-fvxp-8mjf","SUSE-SU-2023:2760-1","SUSE-SU-2023:2760-2","SUSE-SU-2023:2777-1","UBUNTU-CVE-2016-7069","openSUSE-SU-2024:12731-1"],"status":"published","title":"An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when...","description":"An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-06","score":0.0458,"percentile":0.91671,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-09-11T13:00:00Z","modified":"2026-10-24T10:30:20Z","fixes":[{"ecosystem":"Debian:12","package":"dnsdist","fixed_in":["1.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dnsdist","fixed_in":["1.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dnsdist","fixed_in":["1.2.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"luajit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3+git.1624618403.e9577376-150400.4.2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150100.3.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0~alpha2-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0~rc1-1.1"}]}],"bundled":2}],"products":[{"vendor":"open-xchange","product":"dnsdist"},{"vendor":"powerdns","product":"dnsdist"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7069","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.securityfocus.com/bid/100509","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2017-01.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7069"},{"url":"https://github.com/advisories/GHSA-v3pf-fvxp-8mjf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-7069","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232760-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1054799","tags":["report"]},{"url":"https://bugzilla.suse.com/1054802","tags":["report"]},{"url":"https://bugzilla.suse.com/1114511","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14663","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232760-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232777-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7069","tags":["report"]},{"url":"https://downloads.powerdns.com/patches/2017-01","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7069","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-7069","description":"An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash.","status":"published","published":"2018-09-11T13:00:00Z","modified":"2024-08-06T01:50:47.438Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:33:36.483151Z"}],"euvd":[{"id":"EUVD-2016-7949","description":"An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash.","status":"published","published":"2018-09-11T13:00:00Z","modified":"2024-08-06T01:50:47Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T02:22:34.032839Z"}],"ghsa":[{"id":"GHSA-v3pf-fvxp-8mjf","title":"An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when...","description":"An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash.","status":"published","published":"2022-05-13T01:38:41Z","modified":"2023-02-01T05:08:54Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:50:53.268012Z"}],"nvd":[{"id":"CVE-2016-7069","description":"An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash.","status":"published","published":"2018-09-11T13:29:00.84Z","modified":"2026-06-17T00:52:32.11Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:39.621168Z"}],"osv":[{"id":"CVE-2016-7069","description":"An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash.","status":"published","published":"2018-09-11T13:29:00.84Z","modified":"2026-10-24T10:30:20.81678655Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-7069","description":"An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash.","status":"published","published":"2018-09-11T13:29:00.84Z","modified":"2026-09-22T07:02:10.102756467Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-7069","description":"An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash.","status":"published","published":"2018-09-11T13:29:00Z","modified":"2025-10-24T04:45:52Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"openSUSE-SU-2024:12731-1","title":"dnsdist-1.8.0~rc1-1.1 on GA media","description":"These are all security issues fixed in the dnsdist-1.8.0~rc1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:36:47.909664Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:2760-1","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\n\n- update to 1.8.0\n  - Implements dnsdist in SLE15 (jsc#PED-3402)\n  - Security fix: fixes a possible record smugging with a crafted DNS query with trailing data (CVE-2018-14663, bsc#1114511)\n\n- update to 1.2.0 (bsc#1054799, bsc#1054802)\n  This release also addresses two security issues of low severity, CVE-2016-7069 and CVE-2017-7557. The first issue can lead to a\n  denial of service on 32-bit if a backend sends crafted answers,\n  and the second to an alteration of dnsdist’s ACL if the API is\n  enabled, writable and an authenticated user is tricked into\n  visiting a crafted website. \n","status":"published","published":"2023-12-06T09:47:21Z","modified":"2026-02-04T04:04:28.442725Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2760-2","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\n\n- update to 1.8.0\n  - Implements dnsdist in SLE15 (jsc#PED-3402)\n  - Security fix: fixes a possible record smugging with a crafted DNS query with trailing data (CVE-2018-14663, bsc#1114511)\n\n- update to 1.2.0 (bsc#1054799, bsc#1054802)\n  This release also addresses two security issues of low severity, CVE-2016-7069 and CVE-2017-7557. The first issue can lead to a\n  denial of service on 32-bit if a backend sends crafted answers,\n  and the second to an alteration of dnsdist’s ACL if the API is\n  enabled, writable and an authenticated user is tricked into\n  visiting a crafted website. \n","status":"published","published":"2023-12-06T09:47:21Z","modified":"2026-02-04T04:37:56.7693Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2777-1","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\n- Implements package 'dnsdist' with version 1.8.0 in SLE15. (jsc#PED-3402)\n- Downstream DNS resolver configuration should be chosen by the admin\n- Security fix: fixes a possible record smugging with a crafted DNS query with trailing data (CVE-2018-14663, bsc#1114511)\n- Security fix: There is an issue that can lead to a denial of service on 32-bit if a backend sends crafted answers. (CVE-2016-7069, bsc#1054799)\n- Security fix: Alteration of dnsdist's ACL if the API is enabled, writable and an authenticated user is tricked into visiting a crafted website. (CVE-2017-7557, bsc#1054799)\n- SNMP support, exporting statistics and sending traps\n- Preventing the packet cache from ageing responses when deployed in\n- Various DNSCrypt-related fixes and improvements, including automatic key rotation\n  ","status":"published","published":"2023-07-04T08:39:57Z","modified":"2026-02-04T03:52:30.910743Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}