ISC BIND any version

Zone transfer controls for writable DLZ zones were not effective

DoS from specifically crafted TCP packets

Processing large delegations may severely degrade resolver performance

Unbounded resend loop in BIND 9 resolver

Amplification vulnerabilities via self-pointed glue records

An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys

A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer

A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer

ISC BIND before 9.7.2-P2, when DNSSEC validation is enabled, does not properly handle certain bad signatures if multiple trust anchors exist for a single zone, which allows remote attackers to cause a denial of service (daemon crash) via a DNS query.

The (1) NSID_SHUFFLE_ONLY and (2) NSID_USE_POOL PRNG algorithms in ISC BIND 8 before 8.4.7-P1 generate predictable DNS query identifiers when sending outgoing queries such as NOTIFY messages when answering questions as a resolver, which allows remote attackers to poison DNS caches via unknown vectors. NOTE: this issue is different from CVE-2007-2926.

update-policy rules of type "subdomain" are enforced incorrectly