GCVE - cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:isc:bind:9.9.3:s1:*:*:*:*:*:*

part: a version: 9.9.3 update: s1

Vendor	Isc (`4a2f2b37-98b6-5702-822d-72afcd17d050`)
Product	Bind (`ea404969-e27c-5a4f-ab6f-da9eff8fdf08`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/isc-projects/bind9`	purl2cpe	2026-06-01 10:15:11.177752
`pkg:gitlab/isc-projects/bind9`	purl2cpe	2026-06-01 10:15:11.177753

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-1975`	vulnerable	2026-06-08 06:27:15.165854	SIG(0) can be used to exhaust CPU resources HIGH (7.5) If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests. This issue affects BIND 9 versions 9.0.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.49-S1, and 9.18.11-S1 through 9.18.27-S1. Published: 2024-07-23T14:38:57.143Z Updated: 2025-02-13T17:32:28.908Z Open on db.gcve.eu Reference links https://kb.isc.org/docs/cve-2024-1975 http://www.openwall.com/lists/oss-security/2024/07/23/1 http://www.openwall.com/lists/oss-security/2024/07/31/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-2795`	vulnerable	2026-06-08 05:43:36.489384	Processing large delegations may severely degrade resolver performance MEDIUM (5.3) By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. Published: 2022-09-21T10:15:25.796Z Updated: 2024-11-29T12:04:33.614Z Open on db.gcve.eu Reference links https://kb.isc.org/docs/cve-2022-2795 http://www.openwall.com/lists/oss-security/2022/09/21/3 https://www.debian.org/security/2022/dsa-5235 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-6465`	vulnerable	2026-06-08 05:14:11.576968	Zone transfer controls for writable DLZ zones were not effective MEDIUM (5.3) Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465. Published: 2019-10-09T14:17:14.410Z Updated: 2024-09-16T20:37:52.694Z Open on db.gcve.eu Reference links https://kb.isc.org/docs/cve-2019-6465 https://access.redhat.com/errata/RHSA-2019:3552	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-3145`	vulnerable	2026-06-08 05:09:26.642376	Improper fetch cleanup sequencing in the resolver can cause named to crash HIGH (7.5) BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1. Published: 2019-01-16T20:00:00.000Z Updated: 2024-09-17T00:10:46.349Z Open on db.gcve.eu Reference links https://access.redhat.com/errata/RHSA-2018:0102 https://access.redhat.com/errata/RHSA-2018:0487 https://www.debian.org/security/2018/dsa-4089 https://access.redhat.com/errata/RHSA-2018:0488 https://access.redhat.com/errata/RHSA-2018:0101	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-3143`	vulnerable	2026-06-08 05:09:26.609881	An error in TSIG authentication can permit unauthorized dynamic updates HIGH (7.5) An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Affects BIND 9.4.0->9.8.8, 9.9.0->9.9.10-P1, 9.10.0->9.10.5-P1, 9.11.0->9.11.1-P1, 9.9.3-S1->9.9.10-S2, 9.10.5-S1->9.10.5-S2. Published: 2019-01-16T20:00:00.000Z Updated: 2024-09-16T16:14:21.796Z Open on db.gcve.eu Reference links https://kb.isc.org/docs/aa-01503 https://access.redhat.com/errata/RHSA-2017:1680 https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03772en_us https://access.redhat.com/errata/RHSA-2017:1679 http://www.securitytracker.com/id/1038809	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-3142`	vulnerable	2026-06-08 05:09:26.604726	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-3136`	vulnerable	2026-06-08 05:09:26.559444	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-3135`	vulnerable	2026-06-08 05:09:26.537632	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.