BIND 9 nameservers using the DNS64 IPv6 transition mechanism are
vulnerable to a software defect that allows a crafted query to
crash the server with a REQUIRE assertion failure. Remote
exploitation of this defect can be achieved without extensive
effort, resulting in a denial-of-service (DoS) vector against
affected servers.
Security: 2892a8e2-3d68-11e2-8e01-0800273fe665
CVE-2012-5688
Feature safe: yes
Feature safe: yes
Changelog for version 2.64:
Handle DHCP FQDN options with all flag bits zero and --dhcp-client-update set.
Thanks to Bernd Krumbroeck for spotting the problem.
Finesse the check for /etc/hosts names which conflict with DHCP names.
Previously a name/address pair in /etc/hosts which didn't match the
name/address of a DHCP lease would generate a warning. Now that only
happesn if there is not also a match. This allows multiple addresses for
a name in /etc/hosts with one of them assigned via DHCP.
Fix broken vendor-option processing for BOOTP. Thanks to Hans-Joachim
Baader for the bug report.
Don't report spurious netlink errors, regression in 2.63. Thanks to
Vladislav Grishenko for the patch.
Flag DHCP or DHCPv6 in starup logging. Thanks to Vladislav Grishenko for
the patch.
Add SetServersEx method in DBus interface. Thanks to Dan Williams for
the patch.
Add SetDomainServers method in DBus interface. Thanks to Roy Marples for
the patch.
Fix build with later Lua libraries. Thansk to Cristian Rodriguez for the
patch.
Add --max-cache-ttl option. Thanks to Dennis Kaarsemaker for the patch.
Fix breakage of --host-record parsing, resulting in infinte loop at
startup. Regression in 2.63. Thanks to Haim Gelfenbeyn for spotting
this.
Set SO_REUSEADDRESS and SO_V6ONLY options on the DHCPv6 socket, this
allows multiple instances of dnsmasq on a single machine, in the same
way as for DHCPv4. Thanks to Gene Czarcinski and Vladislav Grishenko for
work on this.
Fix DHCPv6 to do access control correctly when it's configured with
--listen-address. Thanks to Gene Czarcinski for sorting this out.
Add a "wildcard" dhcp-range which works for any IPv6 subnet,
--dhcp-range=::,static Useful for Stateless DHCPv6. Thanks to Vladislav
Grishenko for the patch.
Don't include lease-time in DHCPACK replies to DHCPINFORM queries, since
RFC-2131 says we shouldn't. Thanks to Wouter Ibens for pointing this
out.
Makefile tweak to do dependency checking on header files. Thanks to
Johan Peeters for the patch.
Check interface for outgoing unsolicited router advertisements, rather
than relying on interface address configuration. Thanks to Gene
Czarinski for the patch.
Handle better attempts to transmit on interfaces which are still doing
DAD, and specifically do not just transmit without setting source
address and interface, since this can cause very puzzling effects when a
router advertisement goes astray. Thanks again to Gene Czarinski.
Get RA timers right when there is more than one dhcp-range on a subnet.
2012-11-26 irc/tr-ircd: No more public distfiles
2012-11-26 lang/imp-interpreter: No more public distfiles
2012-11-26 games/xquarto: No more public distfiles
2012-11-26 games/six: No more public distfiles
2012-11-26 finance/gfp: No more public distfiles
2012-11-26 games/44bsd-hunt: No more public distfiles
2012-11-26 graphics/ale: No more public distfiles
2012-11-26 german/digibux: No more public distfiles
2012-11-26 java/eclipse-clay-core: No more public distfiles
2012-11-26 games/xbloody: No more public distfiles
2012-11-26 dns/sqldjbdns: No more public distfiles
Feature safe: yes
ldns 1.6.14 and ldns 1.6.15 had a bug in creating empty
bitmaps for NSEC3 on empty non-terminals; and were
unable to build a loadable pyldns module.
This release has those two bugs resolved.
PR: 173626
Submitted by: Geoffroy Desvernay <dgeo@centrale-marseille.fr>
Approved by: maintainer
Feature safe: yes
- Shorten GOST option description, to fit in old dialog's line restrictions on 8.x
- Use standard EXAMPLES/DOXYGEN descriptions
- Remove quotes from option descriptions
Approved by: Jaap Akkerhuis <jaap at NLnetLabs.nl> (maintainer)
Feature safe: yes
- Trim header
Changes:
* Bugfixes
* New Feature: Use of writev, to improve TCP response time
PR: ports/173261
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
Feature safe: yes
chroot (NanoBSD for example). So use truncate -s... instead of dd
if=/dev/zero... to initialise the pdns DB.
PR: pors/172268
Submitted by: n_hibma
Feature safe: yes
- Add an entry to UPDATING about binary incompatibility in previous version of ldns
- Fix OptionsNG
- Bump PORTREVISION for all ports dependent on dns/ldns
- Remove ABI version numbers from LIB_DEPENDS while I'm here
PR: ports/173080 [1]
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer) [1]
Approved by: portmgr (erwin)
Feature safe: yes
2012-10-20 games/xripple: No more public distfiles
2012-10-20 games/wolf3d: No more public distfiles
2012-10-20 games/pets: No more public distfiles
2012-10-20 games/linux-enemyterritory-fortress: No more public distfiles
2012-10-20 games/linux-enemyterritory-etpub: No more public distfiles (for the .pk3)
2012-10-20 games/freesci: No more public distfiles
2012-10-20 dns/gresolver: No more public distfiles
2012-10-20 devel/vb2c: No more public distfiles
2012-10-20 devel/portlet-api: No more public distfiles
2012-10-20 devel/libsigc++: Abandoned upstream, no more depending ports
2012-10-20 devel/klassmodeler: Abandonware, depends on the deprecated wxGTK 2.4
2012-10-20 devel/ecos-tools: Depends on an obsolete version of wx, broken with gcc4.2 for long
2012-10-20 devel/datadesigner: Abandonware, depends on the deprecated wxGTK 2.4
Feature safe: yes
- add dns/py-dnspython to RUN_DEPENDS too, because easyzone will not
work w/o it
- remove some redundant python specific knobs: PYDISTUTILS_NOEGGINFO,
PYDISTUTILS_PKGNAME
- use PYEASYINSTALL_EGG in pkg-plist instead of redundant passing
PORTVERSION and PYTHON_VER there
- bump PORTREVISION because of dependencies change
PR: 172446
Submitted by: rm (myself)
Approved by: Attila Nagy <bra at fsn dot hu> (maintainer, by mail)
Feature safe: yes
