This document summarizes changes since the last production release of BIND on the corresponding major release branch.
The latest versions of BIND 9 software can always be found at http://www.isc.org/downloads/. There you will find additional information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems.
Insufficient testing when parsing a message allowed records with an incorrect class to be be accepted, triggering a REQUIRE failure when those records were subsequently cached. This flaw is disclosed in CVE-2015-8000. [RT #40987]
Incorrect reference counting could result in an INSIST failure if a socket error occurred while performing a lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945]
Specific APL data could trigger an INSIST. This flaw is disclosed in CVE-2015-8704. [RT #41396]
Updated the compiled in addresses for H.ROOT-SERVERS.NET.
The default preferred glue is now the address type of the transport the query was received over.
On machines with 2 or more processors (CPU), the default value for the number of UDP listeners has been changed to the number of detected processors minus one.
Zone transfers now use smaller message sizes to improve message compression. This results in reduced network usage.
The server could crash due to a use-after-free if a zone transfer timed out. [RT #41297]
Authoritative servers that were marked as bogus (e.g. blackholed in configuration or with invalid addresses) were being queried anyway. [RT #41321]
BIND 9.9 (Extended Support Version) will be supported until December, 2017. https://www.isc.org/downloads/software-support-policy/
Thank you to everyone who assisted us in making this release possible. If you would like to contribute to ISC to assist us in continuing to make quality open source software, please visit our donations page at http://www.isc.org/donate/.