Description
ISC BIND 9.8.x before 9.8.4-P1 and 9.9.x before 9.9.2-P1, when DNS64 is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.8.4.dfsg.P1-1 | — |
| Debian 13 | bind9 | 1:9.8.4.dfsg.P1-1 | — |
| Debian 12 | bind9 | 1:9.8.4.dfsg.P1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | bind +5 | 32:9.8.2-0.10.rc1.el6_3.6 | RHSA-2012:1549 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.10.3P4-21.1 | openSUSE-SU-2024:10467-1 |
Advisories 2
- RHSA-2012:1549 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10467-1 bind-9.10.3P4-21.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2012:1549 vendor-advisory
- SSA:2012-341-01 vendor-advisory
- APPLE-SA-2013-09-12-1 vendor-advisory
- USN-1657-1 vendor-advisory
- https://kb.isc.org/article/AA-00828
- http://support.apple.com/kb/HT5880