QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2017-3145

Back to search

CVE-2017-3145

Published: Jan 16, 2019

Modified: Sep 17, 2024

PUBLISHED

CVSS v3.0

7.5

HIGH

Description

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.

VendorProductVersions

ISC

BIND 9

affected
9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

References

RHSA-2018:0102
vendor-advisory
x_refsource_REDHAT
RHSA-2018:0487
vendor-advisory
x_refsource_REDHAT
DSA-4089
vendor-advisory
x_refsource_DEBIAN
RHSA-2018:0488
vendor-advisory
x_refsource_REDHAT
RHSA-2018:0101
vendor-advisory
x_refsource_REDHAT
1040195
vdb-entry
x_refsource_SECTRACK
102716
vdb-entry
x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now