← All CVEs

CVE-2016-2775

medium · 5.9

ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.

5.9
CVSS
63.3%
EPSS (exploit prob.)
99th
EPSS percentile
2016-07-19
Published

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-20

Affected products

VendorProductAffected versions
hphp-uxb.11.31
iscbind>= 9.0, <= 9.9.8
iscbind>= 9.10.0, <= 9.10.3
iscbind9.9.9
iscbind9.9.9
iscbind9.9.9
iscbind9.9.9
iscbind9.9.9
iscbind9.9.9
iscbind9.9.9
iscbind9.10.4
iscbind9.10.4
iscbind9.10.4
iscbind9.10.4
iscbind9.10.4
iscbind9.11.0
iscbind9.11.0
iscbind9.11.0
iscbind9.11.0
iscbind9.11.0
fedoraprojectfedora23
fedoraprojectfedora24
redhatenterprise_linux_desktop6.0
redhatenterprise_linux_desktop7.0
redhatenterprise_linux_eus7.2
redhatenterprise_linux_eus7.3
redhatenterprise_linux_eus7.4
redhatenterprise_linux_eus7.5
redhatenterprise_linux_eus7.6
redhatenterprise_linux_eus7.7
redhatenterprise_linux_server6.0
redhatenterprise_linux_server7.0
redhatenterprise_linux_server_aus7.2
redhatenterprise_linux_server_aus7.3
redhatenterprise_linux_server_aus7.6
redhatenterprise_linux_server_aus7.7
redhatenterprise_linux_server_tus7.2
redhatenterprise_linux_server_tus7.3
redhatenterprise_linux_server_tus7.6
redhatenterprise_linux_server_tus7.7

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-2775