CVE-2015-8705

HIGH

ISC BIND 9.10.x < 9.10.3-P3 - Denial of Service via OPT Data or ECS Option

Title source: llm
STIX 2.1

Description

buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.

References (8)

Core 8
Core References
Vendor Advisory x_refsource_confirm
https://kb.isc.org/article/AA-01336
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175977.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034740
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/81314
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201610-07
Various Sources x_refsource_confirm
https://kb.isc.org/article/AA-01380
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176564.html

Scores

CVSS v3 7.0
EPSS 0.2359
EPSS Percentile 96.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Details

CWE
CWE-20
Status published
Products (34)
isc/bind 9.0
isc/bind 9.0.1
isc/bind 9.1
isc/bind 9.1.1
isc/bind 9.1.2
isc/bind 9.1.3
isc/bind 9.2
isc/bind 9.2.0
isc/bind 9.2.1
isc/bind 9.2.2 (2 CPE variants)
... and 24 more
Published Jan 20, 2016
Tracked Since Feb 18, 2026