Qifan Zhang (Palo Alto Networks)

Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name

Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration

Denial of service via IXFR queries

Out-of-bounds read in SetMacAddrAction

Possible NULL Dereference in Password-Based CMS Decryption

Use after free and crash under special conditions in RPZ code

Another 'ghost domain names' attack variant

Degradation of service with unbounded NSEC3 hash calculations