Description
ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service (daemon crash) in opportunistic circumstances by establishing an IPv6 lease in an environment where the lease expiration time is later reduced.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | isc-dhcp | 4.2.4-2 | — |
| Debian 12 | isc-dhcp | 4.2.4-2 | — |
| Debian 6.0 | isc-dhcp | 4.1.1-P1-15+squeeze8 | DSA-2551-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | dhcp +3 | 12:4.1.1-34.P1.el6 | RHSA-2013:0504 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dhcp | 4.3.3.P1-3.1 | openSUSE-SU-2024:10358-1 |
Advisories 3
- RHSA-2013:0504 Red Hat Security Advisory: dhcp security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2551-1 isc-dhcp - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10358-1 dhcp-4.3.3.P1-3.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- FEDORA-2012-14149 vendor-advisory
- openSUSE-SU-2012:1252 vendor-advisory
- USN-1571-1 vendor-advisory
- openSUSE-SU-2012:1234 vendor-advisory
- DSA-2551 vendor-advisory
- 51318 third-party-advisory
- MDVSA-2012:153 vendor-advisory
- FEDORA-2012-13910 vendor-advisory
- 55530 vdb-entry
- FEDORA-2012-14076 vendor-advisory
- RHSA-2013:0504 vendor-advisory
- https://blogs.oracle.com/sunsecurity/entry/cve_2012_3955_denial_of
- openSUSE-SU-2012:1254 vendor-advisory
- GLSA-201301-06 vendor-advisory
- https://kb.isc.org/article/AA-00779
- 1027528 vdb-entry