CVE catalog

CVE-2020-19860

ldns: CVE-2020-19860

[CVE catalog]

Severity
Medium · CVSS 4.4CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.21% · Oct 25, 2026

When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read vulnerability. An attacker can leak information on the heap by constructing a zone file payload.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianldnssid1.9.2-1fixed
Debianldnsforky1.9.2-1fixed
Debianldnstrixie1.8.4-2fixed
Debianldnsbookworm1.8.3-1fixed
Ubuntuldnspro1.6.17-5vulnerable
Ubuntuldnspro1.6.17-7vulnerable
Ubuntuldnspro1.6.17-8vulnerable
Ubuntuldnspro1.6.17-8ubuntu0.1vulnerable
Ubuntuldnspro1.6.17-8ubuntu0.1+esm1fixed
Ubuntuldns18.041.7.0-1ubuntu1vulnerable
Ubuntuldns18.041.7.0-3ubuntu1vulnerable
Ubuntuldns18.041.7.0-3ubuntu2vulnerable
Ubuntuldns18.041.7.0-3ubuntu4vulnerable
Ubuntuldns18.041.7.0-3ubuntu4.1fixed
Ubuntuldnspro1.7.1-2build1vulnerable
Ubuntuldnspro1.7.1-2ubuntu1vulnerable
Ubuntuldnspro1.7.1-2ubuntu3vulnerable
Ubuntuldnspro1.7.1-2ubuntu4vulnerable
Ubuntuldnspro1.7.1-2ubuntu4+esm1fixed
Ubuntuldnspro1.7.1-2build1vulnerable
Ubuntuldnspro1.7.1-2ubuntu1vulnerable
Ubuntuldnspro1.7.1-2ubuntu3vulnerable
Ubuntuldnspro1.7.1-2ubuntu4vulnerable
Ubuntuldnspro1.7.1-2ubuntu4+esm1fixed
Ubuntuldns18.041.7.0-1ubuntu1vulnerable
Ubuntuldns18.041.7.0-3ubuntu1vulnerable
Ubuntuldns18.041.7.0-3ubuntu2vulnerable
Ubuntuldns18.041.7.0-3ubuntu4vulnerable
Ubuntuldns18.041.7.0-3ubuntu4.1fixed
Opensuseldnsleap 15.31.7.0-4.6.1fixed
Opensuseldnstumbleweed1.8.1-1.1fixed
Suseldnslinux enterprise module for basesystem 15 sp31.7.0-4.6.1fixed
Suseldnslinux enterprise module for development tools 15 sp31.7.0-4.6.1fixed
Suseldnslinux enterprise real time 15 sp21.7.0-4.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianldnssourcesid1.8.1-1not yet assignedNot reportedNot reported
Debianldnssourceforky1.8.1-1not yet assignedNot reportedNot reported
Debianldnssourcetrixie1.8.1-1not yet assignedNot reportedNot reported
Debianldnssourcebookworm1.8.1-1not yet assignedNot reportedNot reported
Ubuntuldnsdebpro1.6.17-8ubuntu0.1+esm1Not reportedUSN-5257-1Not reported
Ubuntuldnsdeb18.041.7.0-3ubuntu4.1Not reportedUSN-5257-1Not reported
Ubuntuldnsdebpro1.7.1-2ubuntu4+esm1Not reportedUSN-5257-2Not reported
Ubuntuldnsdebpro1.7.1-2ubuntu4+esm1Not reportedUBUNTU-CVE-2020-19860Not reported
Ubuntuldnsdeb18.041.7.0-3ubuntu4.1Not reportedUBUNTU-CVE-2020-19860Not reported
Opensuseldnsrpmleap 15.31.7.0-4.6.1Not reportedOPENSUSE-SU-2022:0675-1Not reported
Opensuseldnsrpmtumbleweed1.8.1-1.1Not reportedOPENSUSE-SU-2024:11802-1Not reported
Suseldnsrpmlinux enterprise module for basesystem 15 sp31.7.0-4.6.1Not reportedSUSE-SU-2022:0675-1Not reported
Suseldnsrpmlinux enterprise module for development tools 15 sp31.7.0-4.6.1Not reportedSUSE-SU-2022:0675-1Not reported
Suseldnsrpmlinux enterprise real time 15 sp21.7.0-4.6.1Not reportedSUSE-SU-2022:0675-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [ldns-devel]Unknown

    Source package: [ldns]

    Details (1)

    • 1.9.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.8.1-1.1

      Version impact unknown

      dsa · ldns · opensuse · tumbleweed

  • [libldns3]Unknown

    Source package: [ldns]

    Details (1)

    • 1.9.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.8.1-1.1

      Version impact unknown

      dsa · ldns · opensuse · tumbleweed

  • [perl-DNS-LDNS]Unknown

    Source package: [ldns]

    Details (1)

    • 1.9.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.8.1-1.1

      Version impact unknown

      dsa · ldns · opensuse · tumbleweed

  • [python3-ldns]Unknown

    Source package: [ldns]

    Details (1)

    • 1.9.2-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.8.1-1.1

      Version impact unknown

      dsa · ldns · opensuse · tumbleweed

  • [ldns]Fixed

    Source package: [ldns]

    Details (1)

    • 1.9.2-1.4 · x86_64 · tumbleweed

      Fixed · Fixed: 1.8.1-1.1

      dsa · ldns · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [ldnsutils]Fixed

    Source package: [ldns]

    Details (2)

    • 1.8.3-1+b1 · amd64 · bookworm

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · bookworm; dsa · ldns · debian · 12

    • 1.8.3-1+b1 · arm64 · bookworm

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · bookworm; dsa · ldns · debian · 12

  • [libldns3]Fixed

    Source package: [ldns]

    Details (2)

    • 1.8.3-1+b1 · amd64 · bookworm

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · bookworm; dsa · ldns · debian · 12

    • 1.8.3-1+b1 · arm64 · bookworm

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · bookworm; dsa · ldns · debian · 12

  • [libldns-dev]Fixed

    Source package: [ldns]

    Details (2)

    • 1.8.3-1+b1 · amd64 · bookworm

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · bookworm; dsa · ldns · debian · 12

    • 1.8.3-1+b1 · arm64 · bookworm

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · bookworm; dsa · ldns · debian · 12

  • [python3-ldns]Fixed

    Source package: [ldns]

    Details (2)

    • 1.8.3-1+b1 · amd64 · bookworm

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · bookworm; dsa · ldns · debian · 12

    • 1.8.3-1+b1 · arm64 · bookworm

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · bookworm; dsa · ldns · debian · 12

[Debian 13 (Trixie)]

  • [ldnsutils]Fixed

    Source package: [ldns]

    Details (2)

    • 1.8.4-2+b1 · amd64 · trixie

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · 13

    • 1.8.4-2+b1 · arm64 · trixie

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · 13

  • [libldns3t64]Fixed

    Source package: [ldns]

    Details (2)

    • 1.8.4-2+b1 · amd64 · trixie

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · 13

    • 1.8.4-2+b1 · arm64 · trixie

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · 13

  • [libldns-dev]Fixed

    Source package: [ldns]

    Details (2)

    • 1.8.4-2+b1 · amd64 · trixie

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · 13

    • 1.8.4-2+b1 · arm64 · trixie

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · 13

  • [python3-ldns]Fixed

    Source package: [ldns]

    Details (2)

    • 1.8.4-2+b1 · amd64 · trixie

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · 13

    • 1.8.4-2+b1 · arm64 · trixie

      Fixed · Fixed: 1.8.1-1

      dsa · ldns · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]