ISC BIND 9.11.3

A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

BIND does not sufficiently limit the number of fetches performed when processing referrals

A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack

A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c

An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself

Some versions of BIND can improperly permit recursive query service to unauthorized clients

In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit.

Memory leak in ECDSA DNSSEC verification code

Memory leaks in EdDSA DNSSEC verification code

A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly

A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly

A race condition when discarding malformed packets can cause BIND to exit with an assertion failure

Lame cache can be abused to severely degrade resolver performance

Processing large delegations may severely degrade resolver performance

Cleaning an ECS-enabled cache may cause excessive CPU load

update-policy rules of type "subdomain" are enforced incorrectly