Description
buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.10.3P4-21.1 | openSUSE-SU-2024:10467-1 |
Advisories 2
- openSUSE-SU-2024:10467-1 bind-9.10.3P4-21.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1184 Internet Systems Consortium BIND: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 29, 2025
References
- https://kb.isc.org/article/AA-01336
- FEDORA-2016-f3517b9c4c vendor-advisory
- 1034740 vdb-entry
- 81314 vdb-entry
- GLSA-201610-07 vendor-advisory
- https://kb.isc.org/article/AA-01380
- http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
- FEDORA-2016-1ab53bf440 vendor-advisory