Arch Linux Security Advisory ASA-201910-6 ========================================= Severity: High Date : 2019-10-11 CVE-ID : CVE-2019-16866 Package : unbound Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1042 Summary ======= The package unbound before version 1.9.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.9.4-1. # pacman -Syu "unbound>=1.9.4-1" The problem has been fixed upstream in version 1.9.4. Workaround ========== None. Description =========== Due to an error in parsing NOTIFY queries, it is possible for Unbound from 1.7.1 up to and including 1.9.3 to continue processing malformed queries and may ultimately result in a pointer dereference in uninitialized memory. This results in a crash of the Unbound daemon. Impact ====== A remote attacker might be able to crash the Unbound server via crafted NOTIFY queries. References ========== https://www.nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt https://github.com/NLnetLabs/unbound/commit/b60c4a472c856f0a98120b7259e991b3... https://security.archlinux.org/CVE-2019-16866