ISC BIND9

• CVE-2022-3080 High 7.5 BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly 2.0%
• CVE-2022-38178 High 7.5 Memory leaks in EdDSA DNSSEC verification code 3.1%
• CVE-2022-38177 High 7.5 Memory leak in ECDSA DNSSEC verification code 3.3%
• CVE-2022-2906 High 7.5 Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only) 2.0%
• CVE-2022-2881 Medium 5.5 Buffer overread in statistics channel code 1.4%
• CVE-2022-2795 Medium 5.3 Processing large delegations may severely degrade resolver performance 2.3%
• CVE-2022-1183 High 7.5 Destroying a TLS session early causes assertion failure 6.2%
• CVE-2021-25219 Medium 5.3 Lame cache can be abused to severely degrade resolver performance 11.2%
• CVE-2021-25218 High 7.5 A too-strict assertion check could be triggered when responses in BIND 9.16.19 and 9.17.16 require UDP fragmentation if RRL is in use 3.7%
• CVE-2021-25216 High 8.1 A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack 83.0%
• CVE-2021-25215 High 7.5 An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself 11.7%
• CVE-2021-25214 Medium 6.5 A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly 6.4%
• CVE-2020-8625 High 8.1 A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack 64.2%
• CVE-2020-8624 Medium 4.3 update-policy rules of type "subdomain" are enforced incorrectly 3.8%
• CVE-2020-8623 High 7.5 A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c 6.6%
• CVE-2020-8622 Medium 6.5 A truncated TSIG response can lead to an assertion failure 5.9%
• CVE-2020-8621 High 7.5 Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.c 3.1%
• CVE-2020-8620 High 7.5 In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing t 3.9%
• CVE-2020-8619 Medium 4.9 A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer 2.1%
• CVE-2020-8618 Medium 4.9 A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer 1.9%
• CVE-2020-8617 High 7.5 A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c 93.3%
• CVE-2020-8616 High 8.6 BIND does not sufficiently limit the number of fetches performed when processing referrals 10.9%