Description
The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar backports for the fix for 2017-3137 may also be affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Debian | BIND9 | Debian BIND9 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.9.3.dfsg.P2-1 | — |
| Debian 13 | bind9 | 1:9.9.3.dfsg.P2-1 | — |
| Debian 12 | bind9 | 1:9.9.3.dfsg.P2-1 | — |
| Debian 7 | bind9 | 1:9.8.4.dfsg.P1-6+nmu2+deb7u20 | DLA-1285-1 |
Advisories 1
- DLA-1285-1 bind9 - security update Debian Security (DSA / DLA) · Mar 9, 2026