CVE-2019-16866

🟡 Monitoruj

Dostęp do niezinicjalizowanej pamięci w Unbound pozwala na zdalne wywołanie awarii.

CVSS

7.5

EPSS

3.5%

Exploit

none

Vendor

canonical

Opis źródłowy (NVD)

Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.

brak Brak patcha

Źródła i daty

Źródło	Wartość
NVD – CVSS	7.5
CISA KEV (aktywnie wykorzystywane)	Nie
FIRST EPSS (prawdopodobieństwo exploita)	3.5%
Opublikowano (NVD)	2019-10-03 19:15:09 UTC
Ostatnia modyfikacja (NVD)	2026-10-08 21:17:16 UTC

Referencje

https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog ([email protected]) [Product, Release Notes]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ/ ([email protected])
https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt ([email protected]) [Patch, Vendor Advisory]
https://seclists.org/bugtraq/2019/Oct/23 ([email protected])
https://usn.ubuntu.com/4149-1/ ([email protected]) [Third Party Advisory]
https://www.debian.org/security/2019/dsa-4544 ([email protected])