Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-3123 State: PUBLISHED Published: 2017-08-11T19:00:00Z Last Updated: 2024-09-16T16:33:24.086Z Vendors: Adobe Systems Incorporated Products: Acrobat Reader Problem Types: Memory Corruption Description: Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data drawing position definition. Successful exploitation could lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb17-24.ht
CVE ID: CVE-2017-3124 State: PUBLISHED Published: 2017-08-11T19:00:00Z Last Updated: 2024-09-17T02:26:24.536Z Vendors: Adobe Systems Incorporated Products: Acrobat Reader Problem Types: Memory Corruption Description: Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the picture exchange (PCX) file format parsing module. Successful exploitation could lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/acrobat/apsb17-24.html - http://www.securitytracker.com/id/1039098 - http:
: - https://helpx.adobe.com/security/products/acrobat/apsb17-24.html - http://www.securitytracker.com/id/1039098 - http://www.securityfocus.com/bid/100179
CVE ID: CVE-2017-3125 State: PUBLISHED Published: 2017-04-12T15:00:00 Last Updated: 2024-10-25T14:35:22.847Z Vendors: Fortinet Products: FortiMail Problem Types: Information leak Description: An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0 - 5.3.8 could allow an attacker to execute arbitrary scripts in the security context of the browser of a victim logged in FortiMail, assuming the victim is social engineered into clicking an URL crafted by the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://fortiguard.com/psirt/FG-IR-17-011 - http://www.securityfocus.com/bid/97474
CVE ID: CVE-2017-3126 State: PUBLISHED Published: 2017-05-26T22:00:00 Last Updated: 2024-10-25T14:14:04.358Z Vendors: Fortinet, Inc. Products: Fortinet FortiAnalyzer, FortiManager Problem Types: Open redirect Description: An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1038540 - http://www.securityfocus.com/bid/98557 - http://www.securitytracker.com/id/1038539 - https://fortiguard.com/psirt/FG-IR-17-014
CVE ID: CVE-2017-3127 State: PUBLISHED Published: 2017-06-01T14:00:00 Last Updated: 2024-10-25T14:13:13.076Z Vendors: n/a Products: n/a Problem Types: Execution of unauthorized code or commands Description: A Cross-Site Scripting vulnerability in Fortinet FortiGate 5.2.0 through 5.2.10 allows attacker to execute unauthorized code or commands via the srcintf parameter during Firewall Policy Creation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/98048 - https://fortiguard.com/psirt/FG-IR-17-017 - http://www.securitytracker.com/id/1038367
CVE ID: CVE-2017-3128 State: PUBLISHED Published: 2017-05-23T17:00:00 Last Updated: 2024-10-25T14:35:09.293Z Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Execute unauthorized code or commands Description: A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or commands via the policy global-label parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-17-057 - http://www.securitytracker.com/id/1038541 - http://www.securityfocus.com/bid/98514
CVE ID: CVE-2017-3129 State: PUBLISHED Published: 2017-05-26T22:00:00 Last Updated: 2024-10-25T14:13:52.020Z Vendors: Fortinet, Inc. Products: Fortinet FortiWeb Problem Types: Execute unauthorized code or commands Description: A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands via an improperly sanitized POST parameter in the FortiWeb Site Publisher feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-17-076 - http://www.securityfocus.com/bid/98382
CVE ID: CVE-2017-3130 State: PUBLISHED Published: 2017-08-10T21:00:00Z Last Updated: 2024-10-25T14:33:41.905Z Vendors: Fortinet, Inc. Products: Fortinet FortiOS Problem Types: Information disclosure Description: An information disclosure vulnerability in Fortinet FortiOS 5.6.0, 5.4.4 and below versions allows attacker to get FortiOS version info by inspecting FortiOS IKE VendorID packets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-17-073 - http://www.securityfocus.com/bid/100211
CVE ID: CVE-2017-3131 State: PUBLISHED Published: 2017-09-12T02:00:00Z Last Updated: 2024-10-25T14:12:49.839Z Vendors: Fortinet, Inc. Products: Fortinet FortiOS Problem Types: Execute unauthorized code or commands Description: A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/100009 - http://www.securitytracker.com/id/1039020 - https://fortiguard.com/advisory/FG-IR-17-104 - https://www.exploit-db.com/exploits/4238
securitytracker.com/id/1039020 - https://fortiguard.com/advisory/FG-IR-17-104 - https://www.exploit-db.com/exploits/42388/
CVE ID: CVE-2017-3132 State: PUBLISHED Published: 2017-09-12T02:00:00Z Last Updated: 2024-10-25T14:12:36.355Z Vendors: Fortinet, Inc. Products: Fortinet FortiOS Problem Types: Execute unauthorized code or commands Description: A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/100009 - http://www.securitytracker.com/id/1039020 - https://fortiguard.com/advisory/FG-IR-17-104 - https://www.exploit-db.com/exploits/42388/
CVE ID: CVE-2017-3133 State: PUBLISHED Published: 2017-09-12T02:00:00Z Last Updated: 2024-10-25T14:12:25.502Z Vendors: Fortinet, Inc. Products: Fortinet FortiOS Problem Types: Execute unauthorized code or commands Description: A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/100009 - http://www.securitytracker.com/id/1039020 - https://fortiguard.com/advisory/FG-IR-17-104 - https://www.exploit-db.com/exploits/42388/
CVE ID: CVE-2017-3134 State: PUBLISHED Published: 2017-05-26T22:00:00 Last Updated: 2024-10-25T14:34:55.906Z Vendors: Fortinet, Inc. Products: Fortinet FortiWLC-SD Problem Types: Escalation of privilege Description: An escalation of privilege vulnerability in Fortinet FortiWLC-SD versions 8.2.4 and below allows attacker to gain root access via the CLI command 'copy running-config'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-17-097 - http://www.securityfocus.com/bid/97603
CVE ID: CVE-2017-3135 State: PUBLISHED Published: 2019-01-16T20:00:00Z Last Updated: 2024-09-16T17:53:49.488Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: Servers utilizing both DNS64 and RPZ are potentially susceptible to encountering this condition. When this condition occurs, it will result in either an INSIST assertion failure (and subsequent abort) or an attempt to read through a NULL pointer. On most platforms a NULL pointer read leads to a segmentation fault (SEGFAULT), which causes the process to be terminated. Only servers which are configured to simultaneously use both Response Policy Zones (RPZ) and DNS64 (a me
be terminated. Only servers which are configured to simultaneously use both Response Policy Zones (RPZ) and DNS64 (a method for synthesizing AAAA records from A records) can be affected by this vulnerability. Description: Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201708-01 - http://rh
Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201708-01 - http://rhn.redhat.com/errata/RHSA-2017-0276.html - https://security.netapp.com/advisory/ntap-20180926-0005/ - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03747en_us - http://www.securityfocus.com/bid/96150 - http://www.securitytracker.com/id/1037801 - https://www.debian.org/security/2017/dsa-3795 - https://kb.isc.org/docs/aa-01453
CVE ID: CVE-2017-3136 State: PUBLISHED Published: 2019-01-16T20:00:00Z Last Updated: 2024-09-17T00:51:35.181Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: Servers are at risk if they are configured to use DNS64 and if the option "break-dnssec yes;" is in use. Description: A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6,
onfigured to use the DNS64 feature and other preconditions were met. Affects BIND 9.8.0 -> 9.8.8-P1, 9.9.0 -> 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.0 -> 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0 -> 9.11.0-P3, 9.11.1b1->9.11.1rc1, 9.9.3-S1 -> 9.9.9-S8. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1095 - https://security.gentoo.org/glsa/201708-01 - https://security.netapp.com/advisory/ntap-20180802-0002/ - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03747en_us - https://www.debian.org/security/2017/dsa-3854 - http://www.securitytracker.com/id/1038259 - http://www.securityfocus.com/bid/97653 -
ebian.org/security/2017/dsa-3854 - http://www.securitytracker.com/id/1038259 - http://www.securityfocus.com/bid/97653 - https://access.redhat.com/errata/RHSA-2017:1105 - https://kb.isc.org/docs/aa-01465 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
CVE ID: CVE-2017-3137 State: PUBLISHED Published: 2019-01-16T20:00:00Z Last Updated: 2024-09-17T01:02:07.037Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: A server which is performing recursion can be forced to exit with an assertion failure if it can be caused to receive a response containing CNAME or DNAME resource records with certain ordering. An attacker can cause a denial of service by exploiting this condition. Recursive resolvers are at highest risk but authoritative servers are theoretically vulnerable if they perform recursion. Description: Mistaken assumptions about the ordering of records in the answer section
nerable if they perform recursion. Description: Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order. Affects BIND 9.9.9-P6, 9.9.10b1->9.9.10rc1, 9.10.4-P6, 9.10.5b1->9.10.5rc1, 9.11.0-P3, 9.11.1b1->9.11.1rc1, and 9.9.9-S8. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1095 - https://security.gentoo.org/glsa/201708-01 - http://www.securitytracker.com/id/1038258 - https://security.netapp.com/advisory/ntap-20
ity.gentoo.org/glsa/201708-01 - http://www.securitytracker.com/id/1038258 - https://security.netapp.com/advisory/ntap-20180802-0002/ - http://www.securitytracker.com/id/1040195 - https://access.redhat.com/errata/RHSA-2017:1582 - https://www.debian.org/security/2017/dsa-3854 - https://access.redhat.com/errata/RHSA-2017:1583 - http://www.securityfocus.com/bid/97651 - https://access.redhat.com/errata/RHSA-2017:1105 - https://kb.isc.org/docs/aa-01466
CVE ID: CVE-2017-3138 State: PUBLISHED Published: 2019-01-16T20:00:00Z Last Updated: 2024-09-16T22:40:54.323Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: The BIND control channel is not configured by default, but when configured will accept commands from those IP addresses that are specified in its access control list and/or from clients which present the proper transaction key. Using this defect, an attacker can cause a running server to stop if they can get it to accept control channel input from them. In most instances this is not as bad as it sounds, because existing commands permitted over the control channel (i.e
em. In most instances this is not as bad as it sounds, because existing commands permitted over the control channel (i.e. "rndc stop") can already be given to cause the server to stop. However, BIND 9.11.0 introduced a new option to allow "read only" commands over the command channel. Using this restriction, a server can be configured to limit specified clients to giving control channel commands which return information only (e.g. "rndc status") without affecting the operational state of the server. The defect described in this advisory, however, is not properly stopped by the "read only" restriction, in essence permitting a privilege escalation allowing a client which should only be permitt
the "read only" restriction, in essence permitting a privilege escalation allowing a client which should only be permitted the limited set of "read only" operations to cause the server to stop execution. Description: named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc. A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2
re sent a null command string. Affects BIND 9.9.9->9.9.9-P7, 9.9.10b1->9.9.10rc2, 9.10.4->9.10.4-P7, 9.10.5b1->9.10.5rc2, 9.11.0->9.11.0-P4, 9.11.1b1->9.11.1rc2, 9.9.9-S1->9.9.9-S9. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038260 - http://www.securityfocus.com/bid/97657 - https://security.gentoo.org/glsa/201708-01 - https://security.netapp.com/advisory/ntap-20180802-0002/ - https://www.debian.org/security/2017/dsa-3854 - https://kb.isc.org/docs/aa-01471
CVE ID: CVE-2017-3139 State: PUBLISHED Published: 2019-04-09T17:07:24 Last Updated: 2024-08-05T14:16:28.247Z Vendors: Red Hat Products: BIND Problem Types: Other Description: A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/cve-2017-3139 - https://bugzilla.redhat.com/show_bug.cgi?id=1447743
CVE ID: CVE-2017-3140 State: PUBLISHED Published: 2019-01-16T20:00:00Z Last Updated: 2024-09-17T04:10:30.985Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ISC Products: BIND 9 Problem Types: A server is potentially vulnerable to degradation of service if the server is configured to use RPZ, the server uses NSDNAME or NSIP policy rules, and an attacker can cause the server to process a specific query Successful exploitation of this condition will cause named to enter a state where it continues to loop while processing the query without ever reaching an end state. While in this state, named repeatedly queries the same sets of authoritative nameservers and this
reaching an end state. While in this state, named repeatedly queries the same sets of authoritative nameservers and this behavior will usually persist indefinitely beyond the normal client query processing timeout. By triggering this condition multiple times, an attacker could cause a deliberate and substantial degradation in service. Operators of servers that meet the above conditions 1. and 2. may also accidentally encounter this defect during normal operation. It is for this reason that the decision was made to issue this advisory despite its low CVSS score. Description: If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition w
If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query. Affects BIND 9.9.10, 9.10.5, 9.11.0->9.11.1, 9.9.10-S1, 9.10.5-S1. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038692 - https://security.gentoo.org/glsa/201708-01 - http://www.securityfocus.com/bid/99088 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us - https://security.netapp.com/advisory/ntap-20180926-0001/ - https://kb.isc.org/docs/aa-01495
CVE ID: CVE-2017-3141 State: PUBLISHED Published: 2019-01-16T20:00:00Z Last Updated: 2024-09-16T17:23:44.753Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: ISC Products: BIND 9 Problem Types: This vulnerability exists in the installer delivered with BIND for Windows and not within BIND itself. Non-Windows builds and installations are unaffected. A manual installation of BIND where the service path is quoted when added would not be at risk. Description: The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1-
to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201708-01 - https://kb.isc.org/docs/aa-01496 - http://www.securitytracker.com/id/1038693 - https://www.exploit-db.com/exploits/42121/ - https://security.netapp.com/advisory/ntap-20180926-0001/ - http://www.securityfocus.com/bid/99089
CVE ID: CVE-2017-3142 State: PUBLISHED Published: 2019-01-16T20:00:00Z Last Updated: 2024-09-16T17:08:46.835Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ISC Products: BIND 9 Problem Types: An unauthorized AXFR (full zone transfer) permits an attacker to view the entire contents of a zone. Protection of zone contents is often a commercial or business requirement. If accepted, a NOTIFY sets the zone refresh interval to 'now'. If there is not already a refresh cycle in progress then named will initiate one by asking for the SOA RR from its list of masters. If there is already a refresh cycle in progress, then named will queue the new refresh request. If th
s list of masters. If there is already a refresh cycle in progress, then named will queue the new refresh request. If there is already a queued refresh request, the new NOTIFY will be discarded. Bogus notifications can't be used to force a zone transfer from a malicious server, but could trigger a high rate of zone refresh cycles. Description: An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: prov
et. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of a zone to an unauthorized recipient or accepting bogus NOTIFY packets. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1680 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us - https://access.redhat.com/errata/RHSA-2017:1679 - http://www.securityfocus.com/bid/99339 - http://www.securitytracker.com/id/1038809 - https://www.deb
ta/RHSA-2017:1679 - http://www.securityfocus.com/bid/99339 - http://www.securitytracker.com/id/1038809 - https://www.debian.org/security/2017/dsa-3904 - https://kb.isc.org/docs/aa-01504 - https://security.netapp.com/advisory/ntap-20190830-0003/
CVE ID: CVE-2017-3143 State: PUBLISHED Published: 2019-01-16T20:00:00Z Last Updated: 2024-09-16T16:14:21.796Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: ISC Products: BIND 9 Problem Types: A server that relies solely on TSIG keys with no other address-based ACL protection could be vulnerable to malicious zone content manipulation using this technique. Note that the local update policy (configured with "update-policy local;" in named.conf) implicitly defines a key with a known key name (local-ddns) and default algorithm and no IP-based access controls on the zone updates. In conjunction with this failure in TSIG verification, "update-policy local" is poten
cess controls on the zone updates. In conjunction with this failure in TSIG verification, "update-policy local" is potentially very dangerous. Description: An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/aa-01503 - https://access.redhat.com/errata/RHSA-2017:1680 - https://h20566.www2
: References: - https://kb.isc.org/docs/aa-01503 - https://access.redhat.com/errata/RHSA-2017:1680 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us - https://access.redhat.com/errata/RHSA-2017:1679 - http://www.securitytracker.com/id/1038809 - https://www.debian.org/security/2017/dsa-3904 - http://www.securityfocus.com/bid/99337 - https://security.netapp.com/advisory/ntap-20190830-0003/