What’s Vulnerable › Vulnerabilities

CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability

• Severity: high (CVSS 7.8 v2.0)
• Exploited in the wild: yes — in CISA KEV since 2026-10-08
• EPSS: 99.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2015-07-29 · updated 2026-10-09
• Weakness: CWE-19

Description

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

Affected products

• Apple Os X Server: 4.1.5
• Canonical Ubuntu Linux: 12.04
• Debian Linux: 7.0, 8.0
• Fedoraproject Fedora: 21, 22
• Hewlett Packard Enterprise (HPE) HP-UX: 11.11, 11.23, 11.31
• HP Openvms: 5.7
• HPE Dns: 9.2.3, 9.3
• HPE Vcx: before 9.8.18 — fixed in 9.8.18
• ISC BIND: from 9.1.0 before 9.9.7; from 9.10.0 before 9.10.2; 9.10.2-p1 — fixed in 9.10.2, 9.9.7
• Juniper Junos OS: before 12.1; from 13.1 before 13.2; 12.1, 12.1-r11, 12.1r, 12.1x44, 12.1x44-d10, 12.1x44-d15 (+101) — fixed in 12.1, 13.2
• Clustered Data ONTAP: all versions
• openSUSE Evergreen: 11.4
• Opensuse: 13.1, 13.2
• Oracle Corporation Solaris Operating System: 10, 11.2
• Oracle Vm Server: 3.2
• Red Hat Enterprise Linux: 5.0, 6.0, 7.0
• RedHat Enterprise Linux Aus: 6.4, 6.5, 6.6
• SUSE Linux Enterprise Debuginfo: 11-sp3, 11-sp4
• SUSE Linux Enterprise Server 15 SP1: 11-sp3, 11-sp4, 12
• SUSE Linux Enterprise Server: 10-sp4, 11-sp1, 11-sp2, 11-sp3, 11-sp4, 12
• SUSE Linux Enterprise Software Development Kit: 11-sp3, 11-sp4, 12

How to fix

Upgrade to a fixed version: HPE Vcx 9.8.18; ISC BIND 9.10.2, 9.9.7; Juniper Junos OS 12.1, 13.2. Check the vendor advisory for mitigations.

References

• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10718
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163006.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163007.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163015.html
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00043.html
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00044.html
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00045.html
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00048.html
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00050.html
• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00033.html
• http://marc.info/?l=bugtraq&m=144000632319155&w=2

Get alerted when CVE-2015-5477 or the next vulnerability affects your stack