Update bind96 to 9.6.3.1.ESV.7pl4 (BIND 9.6-ESV-R7-P4).

Here are change changes from release note.  Note security fixes except
CVE-2012-5166 should be already fixed in previous version of bind96 package.

Please refer https://kb.isc.org/article/AA-00795 for list of full bug fixes.


Security Fixes

* A deliberately constructed combination of records could cause named to hang
  while populating the additional section of a response. [CVE-2012-5166] [RT
  #31090]
* Prevents a named assert (crash) when queried for a record whose RDATA
  exceeds 65535 bytes [CVE-2012-4244] [RT #30416]
* Prevents a named assert (crash) when validating caused by using "Bad cache"
  data before it has been initialized. [CVE-2012-3817] [RT #30025]
* A condition has been corrected where improper handling of zero-length RDATA
  could cause undesirable behavior, including termination of the named
  process. [CVE-2012-1667] [RT #29644]


New Features

  None


Feature Changes

* Improves OpenSSL error logging [RT #29932]
* nslookup now returns a nonzero exit code when it is unable to get an answer.
  [RT #29492]
Update bind97 to 9.7.7 (BIND 9.7.7).

Here are change changes from release note.  Note security fixes except
CVE-2012-5166 should be already fixed in previous version of bind97 package.

Please refer https://kb.isc.org/article/AA-00796 for list of full bug fixes.


Security Fixes

* A deliberately constructed combination of records could cause named to hang
  while populating the additional section of a response. [CVE-2012-5166] [RT
  #31090]
* Prevents a named assert (crash) when queried for a record whose RDATA
  exceeds 65535 bytes [CVE-2012-4244] [RT #30416]
* Prevents a named assert (crash) when validating caused by using "Bad cache"
  data before it has been initialized. [CVE-2012-3817] [RT #30025]
* A condition has been corrected where improper handling of zero-length RDATA
  could cause undesirable behavior, including termination of the named
  process. [CVE-2012-1667] [RT #29644]


New Features

  None

Feature Changes

* Improves OpenSSL error logging [RT #29932]
* nslookup now returns a nonzero exit code when it is unable to get an answer.
  [RT #29492]
Update bind98 package to 9.8.4.

Here are change changes from release note.  Note security fixes except
CVE-2012-5166 should be already fixed in previous version of bind98 package.

Please refer https://kb.isc.org/article/AA-00797 for list of full bug fixes.


Security Fixes

* A deliberately constructed combination of records could cause named to hang
  while populating the additional section of a response. [CVE-2012-5166] [RT
  #31090]
* Prevents a named assert (crash) when queried for a record whose RDATA
  exceeds 65535 bytes [CVE-2012-4244] [RT #30416]
* Prevents a named assert (crash) when validating caused by using "Bad cache"
  data before it has been initialized. [CVE-2012-3817] [RT #30025]
* A condition has been corrected where improper handling of zero-length RDATA
  could cause undesirable behavior, including termination of the named
  process. [CVE-2012-1667] [RT #29644]


New Features

* Elliptic Curve Digital Signature Algorithm keys and signatures in DNSSEC are
  now supported per RFC 6605. [RT #21918]


Feature Changes

* Improves OpenSSL error logging [RT #29932]
* nslookup now returns a nonzero exit code when it is unable to get an answer.
  [RT #29492]
Update bind99 to 9.9.2 (BIND 9.9.2).

Here are change changes from release note.  Note security fixes except
CVE-2012-5166 should be already fixed in previous version of bind99 package.

Please refer https://kb.isc.org/article/AA-00798 for list of full bug fixes.


Security Fixes

* A deliberately constructed combination of records could cause named to hang
  while populating the additional section of a response. [CVE-2012-5166] [RT
  #31090]
* Prevents a named assert (crash) when queried for a record whose RDATA
  exceeds 65535 bytes.  [CVE-2012-4244] [RT #30416]
* Prevents a named assert (crash) when validating caused by using "Bad cache"
  data before it has been initialized. [CVE-2012-3817] [RT #30025]
* A condition has been corrected where improper handling of zero-length RDATA
  could cause undesirable behavior, including termination of the named
  process. [CVE-2012-1667] [RT #29644]
* ISC_QUEUE handling for recursive clients was updated to address a race
  condition that could cause a memory leak. This rarely occurred with UDP
  clients, but could be a significant problem for a server handling a steady
  rate of TCP queries. [CVE-2012-3868] [RT #29539 & #30233]


New Features

* Elliptic Curve Digital Signature Algorithm keys and signatures in DNSSEC are
  now supported per RFC 6605. [RT #21918]
* Introduces a new tool "dnssec-checkds" command that checks a zone to
  determine which DS records should be published in the parent zone, or which
  DLV records should be published in a DLV zone, and queries the DNS to ensure
  that it exists. (Note: This tool depends on python; it will not be built or
  installed on systems that do not have a python interpreter.)  [RT #28099]
* Introduces a new tool "dnssec-verify" that validates a signed zone, checking
  for the correctness of signatures and NSEC/NSEC3 chains.  [RT #23673]
* Adds configuration option "max-rsa-exponent-size <value>;" that can be used
  to specify the maximum rsa exponent size that will be accepted when
  validating [RT #29228]


Feature Changes

* Improves OpenSSL error logging [RT #29932]
* nslookup now returns a nonzero exit code when it is unable to get an answer.
  [RT #29492]
Note update of BIND pacakges:

	net/bind96	9.6.3.1.ESV.7pl4
	net/bind97	9.7.7
	net/bind98	9.8.4
	net/bind99	9.9.2