Detections
Analytics

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Bind vulnerabilities (USN-8929-1)

high Nessus Plugin ID 367203

Synopsis

The remote Ubuntu host is missing one or more security updates.

Description

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8929-1 advisory.

 Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
 (CVE-2025-8677)

 Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind incorrectly accepted certain records from answers. A remote attacker could possibly use this issue to perform a cache poisoning attack.
 This issue only affected Ubuntu 18.04 LTS. (CVE-2025-40778)

 Samy Medjahed discovered that Bind incorrectly handled insecure delegation validation. A remote attacker could possibly use this issue to cause excessive NSEC3 iterations, consuming CPU resources, and leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-1519)

 It was discovered that Bind incorrectly accepted NSEC3 records whose signer name did not match the owning zone. A remote attacker could possibly use this issue to perform NSEC3 impersonation attacks, bypassing DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-10723)

 It was discovered that Bind incorrectly handled Key Records using the PRIVATEDNS algorithm. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-10822)

 It was discovered that Bind incorrectly handled wildcard CNAME expansion in Response Policy Zones. A remote attacker could possibly use this issue to bypass configured RPZ policies. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11331)

 It was discovered that Bind incorrectly tracked memory usage in the DNS cache. A remote attacker could possibly use this issue to cause Bind to use memory beyond configured limits, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-11622)

 It was discovered that Bind incorrectly handled signed wildcard records with label count discrepancies and RRSIG validation. A remote attacker could possibly use this issue to perform cache poisoning attacks. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
 (CVE-2026-11721)

 It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13204)

 It was discovered that Bind incorrectly validated out-of-zone NSEC next owner names during DNSSEC validation. A remote attacker could possibly use this issue to bypass DNSSEC validation. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-13321)

 It was discovered that Bind incorrectly served zone transfer data before verifying the TSIG signature on multi-message transfers. A remote attacker could possibly use this issue to send unauthorized zone contents to a secondary server. (CVE-2026-19033)

 It was discovered that Bind incorrectly handled the lifetime of cached DNSSEC proofs, leading to a use- after-free. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19662)

 It was discovered that Bind incorrectly handled certain malformed answers when configured to use DNS64. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
 (CVE-2026-19666)

 It was discovered that Bind incorrectly handled oversized negative answers when storing them in the negative cache. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-19667)

 It was discovered that Bind incorrectly handled large numbers of certain invalid DNSSEC records during validation. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19668)

 It was discovered that Bind incorrectly accepted inapplicable NSEC records as proof that no wildcard existed. A remote attacker could possibly use this issue to forge NXDOMAIN responses, masking the existence of wildcard records. (CVE-2026-19941)

 It was discovered that Bind incorrectly handled repeated copies of records that should only appear once, such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use excessive memory, leading to a denial of service. (CVE-2026-75029)

 It was discovered that Bind incorrectly handled TKEY queries when the configuration did not contain a global options block. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-76163)

 It was discovered that Bind incorrectly accepted NSEC3 records from unrelated sibling zones as proof of an insecure delegation. A remote attacker could possibly use this issue to bypass DNSSEC validation and inject forged unsigned answers. (CVE-2026-77119)

 It was discovered that Bind incorrectly handled DNS-over-HTTPS requests containing invalid SIG(0) records when the connection was closed prematurely. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-77692)

 It was discovered that Bind incorrectly treated NS or DNAME records above the zone origin as zone cuts. An attacker could possibly use this issue to cause Bind to serve or cache out-of-zone data, resulting in cache poisoning. (CVE-2026-78301)

 It was discovered that Bind incorrectly handled wildcard answers with both NSEC3 and NSEC proofs at the same owner name. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-80274)

 It was discovered that Bind incorrectly released resources when processing SVCB and HTTPS AliasMode records. A remote attacker could possibly use this issue to cause Bind to exhaust resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-81563)

 It was discovered that Bind incorrectly limited additional processing for cached SVCB and HTTPS AliasMode records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-81736)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://ubuntu.com/security/notices/USN-8929-1

Plugin Details

Severity: High

ID: 367203

File Name: ubuntu_USN-8929-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/19/2026

Updated: 10/19/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.2

Percentile: 96.33

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-13321

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:canonical:ubuntu_linux:14.04:-:lts, cpe:/o:canonical:ubuntu_linux:16.04:-:lts, cpe:/o:canonical:ubuntu_linux:18.04:-:lts, cpe:/o:canonical:ubuntu_linux:20.04:-:lts, cpe:/o:canonical:ubuntu_linux:22.04:-:lts, cpe:/o:canonical:ubuntu_linux:24.04:-:lts, cpe:/o:canonical:ubuntu_linux:26.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:bind9-dnsutils, p-cpe:/a:canonical:ubuntu_linux:bind9-host, p-cpe:/a:canonical:ubuntu_linux:bind9-libs, p-cpe:/a:canonical:ubuntu_linux:bind9-utils, p-cpe:/a:canonical:ubuntu_linux:bind9, p-cpe:/a:canonical:ubuntu_linux:bind9utils, p-cpe:/a:canonical:ubuntu_linux:dnsutils, p-cpe:/a:canonical:ubuntu_linux:host, p-cpe:/a:canonical:ubuntu_linux:libbind9-140, p-cpe:/a:canonical:ubuntu_linux:libbind9-160, p-cpe:/a:canonical:ubuntu_linux:libbind9-90, p-cpe:/a:canonical:ubuntu_linux:libdns-export1100, p-cpe:/a:canonical:ubuntu_linux:libdns-export162, p-cpe:/a:canonical:ubuntu_linux:libdns100, p-cpe:/a:canonical:ubuntu_linux:libdns1100, p-cpe:/a:canonical:ubuntu_linux:libdns162, p-cpe:/a:canonical:ubuntu_linux:libirs-export141, p-cpe:/a:canonical:ubuntu_linux:libirs-export160, p-cpe:/a:canonical:ubuntu_linux:libirs141, p-cpe:/a:canonical:ubuntu_linux:libirs160, p-cpe:/a:canonical:ubuntu_linux:libisc-export160, p-cpe:/a:canonical:ubuntu_linux:libisc-export169, p-cpe:/a:canonical:ubuntu_linux:libisc160, p-cpe:/a:canonical:ubuntu_linux:libisc169, p-cpe:/a:canonical:ubuntu_linux:libisc95, p-cpe:/a:canonical:ubuntu_linux:libisccc-export140, p-cpe:/a:canonical:ubuntu_linux:libisccc-export160, p-cpe:/a:canonical:ubuntu_linux:libisccc140, p-cpe:/a:canonical:ubuntu_linux:libisccc160, p-cpe:/a:canonical:ubuntu_linux:libisccc90, p-cpe:/a:canonical:ubuntu_linux:libisccfg-export140, p-cpe:/a:canonical:ubuntu_linux:libisccfg-export160, p-cpe:/a:canonical:ubuntu_linux:libisccfg140, p-cpe:/a:canonical:ubuntu_linux:libisccfg160, p-cpe:/a:canonical:ubuntu_linux:libisccfg90, p-cpe:/a:canonical:ubuntu_linux:liblwres141, p-cpe:/a:canonical:ubuntu_linux:liblwres160, p-cpe:/a:canonical:ubuntu_linux:liblwres90, p-cpe:/a:canonical:ubuntu_linux:lwresd

Required KB Items: Host/cpu, Host/Debian/dpkg-l, Host/Ubuntu, Host/Ubuntu/release

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/14/2026

Vulnerability Publication Date: 10/22/2025

Reference Information

CVE: CVE-2025-40778, CVE-2025-8677, CVE-2026-10723, CVE-2026-10822, CVE-2026-11331, CVE-2026-11622, CVE-2026-11721, CVE-2026-13204, CVE-2026-13321, CVE-2026-1519, CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736

IAVA: 2025-A-0800-S, 2026-A-0269-S, 2026-A-0764-S, 2026-A-1029

USN: 8929-1