[Cucumber-linux-security] bind-server (security update is available)

[Scott C. <sc...@cu...>]

  Update Information

A security update is available for bind-server for the following
versions of Cucumber Linux:

  * 1.0
  * 1.1 Beta

Here are the details from the Cucumber 1.1 Beta changelog:

+----------------+
Wed Jan 17 09:03:19 EST 2018
net-extra/bind-server upgraded from 9.11.2 to 9.11.2_P1 to fix a few security
	vulnerabilities: CVE-2017-3145 (a use after free vulnerability),
	CVE-2017-3143 (a vulnerability which could result in unauthorized zone
	transfers) and CVE-2017-3140 (a vulnerability which could cause named
	to go into an infinite loop). For more information see:
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3145
		http://security.cucumberlinux.com/security/details.php?id=227
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3143
		http://security.cucumberlinux.com/security/details.php?id=229
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3140
		http://security.cucumberlinux.com/security/details.php?id=231
		https://lists.isc.org/pipermail/bind-announce/2018-January/001075.html
multilib/net-extra/bind-server upgraded from 9.11.2 to 9.11.2_P1 (x86_64 only)
* SECURITY FIX *
+----------------+

------------------------------------------------------------------------


  CLD and CVE Information

This update is associated with the following Cucumber Linux Deficiency
(CLD) and CVE numbers:

  * CLD-227 [CVE-2017-3145]
    (http://security.cucumberlinux.com/security/details.php?id=227)
  * CLD-229 [CVE-2017-3143]
    (http://security.cucumberlinux.com/security/details.php?id=229)
  * CLD-231 [CVE-2017-3140]
    (http://security.cucumberlinux.com/security/details.php?id=231)

More information about these CLDs can be found at their respective pages
on the Cucumber Linux Security Advisory Tracker (these are the URLs in
parenthesis above).

------------------------------------------------------------------------


  Installing the Update

The updated package can be installed via Pickle by running the following
commands (as root):

# pickle --update
# pickle

Make sure bind-server is selected on the update list, and then select
Ok. Pickle will then install the updated package.

If you prefer to download the updated package manually, it can be found
on the mirror at http://mirror.cucumberlinux.com/cucumber/.

------------------------------------------------------------------------
The Cucumber Linux Security Team
cuc...@li...
<mailto:cuc...@li...>
http://www.cucumberlinux.com/security.php