VulnerableCode Package Details - pkg:alpm/archlinux/powerdns-recursor@4.0.7-1

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-a7xd-fyh3-xuaq	An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate (default).	CVE-2017-15094
VCID-mbq1-b3dr-1uc4	A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.	CVE-2017-15092
VCID-tcp4-6r2n-6uer	When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor's configuration.	CVE-2017-15093
VCID-urr2-qrfd-vfeh	An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records.	CVE-2017-15090

Vulnerability

Summary

Aliases

VCID-a7xd-fyh3-xuaq

An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially crafted DNSSEC ECDSA keys. These keys are only parsed when validation is enabled by setting dnssec to a value other than off or process-no-validate (default).

CVE-2017-15094

VCID-mbq1-b3dr-1uc4

A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was displayed without any escaping, allowing a remote attacker to inject HTML and Javascript code into the web interface, altering the content.

CVE-2017-15092

VCID-tcp4-6r2n-6uer

When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and including 3.7.4 allows an authorized user to update the Recursor's ACL by adding and removing netmasks, and to configure forward zones. It was discovered that the new netmask and IP addresses of forwarded zones were not sufficiently validated, allowing an authenticated user to inject new configuration directives into the Recursor's configuration.

CVE-2017-15093

VCID-urr2-qrfd-vfeh

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of man-in-the-middle to alter the content of records by issuing a valid signature for the crafted records.

CVE-2017-15090

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-06T05:35:35.573238+00:00	Arch Linux Importer	Fixing	VCID-urr2-qrfd-vfeh	https://security.archlinux.org/AVG-520	38.1.0
2026-04-06T05:35:35.547632+00:00	Arch Linux Importer	Fixing	VCID-mbq1-b3dr-1uc4	https://security.archlinux.org/AVG-520	38.1.0
2026-04-06T05:35:35.521861+00:00	Arch Linux Importer	Fixing	VCID-tcp4-6r2n-6uer	https://security.archlinux.org/AVG-520	38.1.0
2026-04-06T05:35:35.494706+00:00	Arch Linux Importer	Fixing	VCID-a7xd-fyh3-xuaq	https://security.archlinux.org/AVG-520	38.1.0
2026-04-01T18:27:08.284626+00:00	Arch Linux Importer	Fixing	VCID-urr2-qrfd-vfeh	https://security.archlinux.org/AVG-520	38.0.0
2026-04-01T18:27:08.254769+00:00	Arch Linux Importer	Fixing	VCID-mbq1-b3dr-1uc4	https://security.archlinux.org/AVG-520	38.0.0
2026-04-01T18:27:08.227652+00:00	Arch Linux Importer	Fixing	VCID-tcp4-6r2n-6uer	https://security.archlinux.org/AVG-520	38.0.0
2026-04-01T18:27:08.199091+00:00	Arch Linux Importer	Fixing	VCID-a7xd-fyh3-xuaq	https://security.archlinux.org/AVG-520	38.0.0