From: Evan Hunt <each@isc.org>
Date: Fri, 18 Jan 2013 22:19:36 +0000 (-0800)
Subject: [master] add CVE, correct change 3388
X-Git-Tag: v9.10.0a1~562
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3806133da574f4570db3005473e0d56b746cc6ea;p=thirdparty%2Fbind9.git

[master] add CVE, correct change 3388
---

diff --git a/CHANGES b/CHANGES
index e7f16ca0d75..da71c8feb4c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,6 @@
 3468.	[security]	RPZ rules to generate A records (but not AAAA records)
 			could trigger an assertion failure when used in
-			conjunction with DNS64. [RT #32141]
+			conjunction with DNS64 (CVE-2012-5689). [RT #32141]
 
 3467.	[bug]		Added checks in dnssec-keygen and dnssec-settime
 			to check for delete date < inactive date. [RT #31719]
@@ -237,7 +237,12 @@
 
 3389.	[bug]		Always return NOERROR (not 0) in TSIG. [RT #31275]
 
-3388.	[bug]		Fixed several Coverity warnings. [RT #30996]
+3388.	[bug]		Fixed several Coverity warnings.
+			Note: This change includes a fix for a bug that
+			was subsequently determined to be an exploitable
+			security vulnerability, CVE-2012-5688: named could
+			die on specific queries with dns64 enabled.
+			[RT #30996]
 
 3387.	[func]		DS digest can be disabled at runtime with
 			disable-ds-digests. [RT #21581]