CVE-2019-25033: Integer Overflow
First published: Tue Apr 27 2021(Updated: )
** DISPUTED ** Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, a running Unbound installation cannot be remotely or locally exploited.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/unbound | <1.9.6 | 1.9.6 |
| libunbound | <1.9.5 | |
| Debian GNU/Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html
- https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/
- https://security.netapp.com/advisory/ntap-20210507-0007/
- https://github.com/NLnetLabs/unbound/commit/09707fc403a7e0d7f5ef0029c597c2645ba49dd5
- https://github.com/NLnetLabs/unbound/commit/226298bbd36f1f0fd9608e98c2ae85988b7bbdb8
- https://access.redhat.com/errata/RHSA-2024:0749
- https://bugzilla.redhat.com/show_bug.cgi?id=1954775
Frequently Asked Questions
What is CVE-2019-25033?
CVE-2019-25033 is a vulnerability in Unbound before 1.9.5 that allows an integer overflow in the regional allocator.
What is the severity of CVE-2019-25033?
CVE-2019-25033 has a severity rating of critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2019-25033?
Unbound versions prior to 1.9.5 are affected by CVE-2019-25033.
How can CVE-2019-25033 be exploited?
The vendor disputes that CVE-2019-25033 is a vulnerability and states that a running Unbound installation cannot be remotely or locally exploited.
Are there any references for CVE-2019-25033?
Yes, you can find references for CVE-2019-25033 at the following links: [Link 1](https://lists.debian.org/debian-lts-announce/2021/05/msg00007.html), [Link 2](https://ostif.org/our-audit-of-unbound-dns-by-x41-d-sec-full-results/), [Link 3](https://security.netapp.com/advisory/ntap-20210507-0007/).
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-25033
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/status
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/weakness
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- package-manager/redhat
- vendor/nlnetlabs
- canonical/libunbound
- vendor/debian
- canonical/debian gnu/linux
- version/debian gnu/linux/9.0
- status/disputed