Homepage
About Snyk

Use After Free Affecting bind-license package, versions <32:9.9.4-51.el7_4.2

0.0
high

Snyk CVSS

    Attack Complexity Low
    Availability High

    Threat Intelligence

    EPSS 6.25% (94th percentile)
Expand this section
NVD
7.5 high
Expand this section
Red Hat
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-CENTOS7-BINDLICENSE-2096274
  • published 26 Jul 2021
  • disclosed 16 Jan 2018
Report a new vulnerability Found a mistake?

Introduced: 16 Jan 2018

CVE-2017-3145 Open this link in a new tab
CWE-416 Open this link in a new tab

How to fix?

Upgrade Centos:7 bind-license to version 32:9.9.4-51.el7_4.2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream bind-license package and not the bind-license package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.