CVE-2016-8864: debian debian_linux Reachable Assertion

CVSS: 7.5v3.1HighModified

AliasesALPINE-CVE-2016-8864MGASA-2016-0365SUSE-SU-2016:2696-1+12 more

Published 02-11-2016Last modified 06-08-2024

Vulnerability summary

CVE-2016-8864 is a high (CVSS 7.5) Reachable Assertion vulnerability in debian debian_linux. EPSS estimates a 38.73% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities.

Overall risk

38/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

38.73%

0%100%

High · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

OPENSUSE-SU-2024:10467-1 RHSA-2017:1583

Timeline

02-11-2016
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.

CVSS metrics

7 scores · 5 sources · 3 versions

v3.17.5v3.07.5v2.05.0

EPSS trend

Probability

38.73%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 38.73% on 18-09-2026

18-09-202618-10-2026

EPSS score

38.73%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Affected systems

Redhat29 products

enterprise_linux_desktop5.0 | 6.0 | 7.0
enterprise_linux_eus6.7 | 7.2 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7
enterprise_linux_server5.0 | 6.0 | 7.0
enterprise_linux_server_aus6.2 | 6.4 | 6.5 | 6.6 | 7.2 | 7.3 | 7.4 | 7.6 | 7.7
enterprise_linux_server_tus6.5 | 6.6 | 7.2 | 7.3 | 7.6 | 7.7

enterprise_linux_workstation5.0 | 6.0 | 7.0
bind< 30:9.3.6-25.P1.el5_11.11 | < 32:9.8.2-0.47.rc1.el6_8.3 | < 32:9.9.4-38.el7_3 | < 32:9.8.2-0.37.rc1.el6_7.9 | < 32:9.7.3-8.P3.el6_2.6 | < 32:9.8.2-0.17.rc1.el6_4.10 | < 32:9.8.2-0.23.rc1.el6_5.5 | < 32:9.8.2-0.30.rc1.el6_6.7
bind-chroot< 30:9.3.6-25.P1.el5_11.11 | < 32:9.8.2-0.47.rc1.el6_8.3 | < 32:9.9.4-38.el7_3 | < 32:9.8.2-0.37.rc1.el6_7.9 | < 32:9.7.3-8.P3.el6_2.6 | < 32:9.8.2-0.17.rc1.el6_4.10 | < 32:9.8.2-0.23.rc1.el6_5.5 | < 32:9.8.2-0.30.rc1.el6_6.7
bind-debuginfo< 30:9.3.6-25.P1.el5_11.11 | < 32:9.8.2-0.47.rc1.el6_8.3 | < 32:9.9.4-38.el7_3 | < 32:9.8.2-0.37.rc1.el6_7.9 | < 32:9.7.3-8.P3.el6_2.6 | < 32:9.8.2-0.17.rc1.el6_4.10 | < 32:9.8.2-0.23.rc1.el6_5.5 | < 32:9.8.2-0.30.rc1.el6_6.7
bind-devel< 30:9.3.6-25.P1.el5_11.11 | < 32:9.8.2-0.47.rc1.el6_8.3 | < 32:9.9.4-38.el7_3 | < 32:9.8.2-0.37.rc1.el6_7.9 | < 32:9.7.3-8.P3.el6_2.6 | < 32:9.8.2-0.17.rc1.el6_4.10 | < 32:9.8.2-0.23.rc1.el6_5.5 | < 32:9.8.2-0.30.rc1.el6_6.7
bind-libbind-devel< 30:9.3.6-25.P1.el5_11.11
bind-libs< 30:9.3.6-25.P1.el5_11.11 | < 32:9.8.2-0.47.rc1.el6_8.3 | < 32:9.9.4-38.el7_3 | < 32:9.8.2-0.37.rc1.el6_7.9 | < 32:9.7.3-8.P3.el6_2.6 | < 32:9.8.2-0.17.rc1.el6_4.10 | < 32:9.8.2-0.23.rc1.el6_5.5 | < 32:9.8.2-0.30.rc1.el6_6.7
bind-libs-lite< 32:9.9.4-38.el7_3
bind-license< 32:9.9.4-38.el7_3
bind-lite-devel< 32:9.9.4-38.el7_3
bind-pkcs11< 32:9.9.4-38.el7_3
bind-pkcs11-devel< 32:9.9.4-38.el7_3
bind-pkcs11-libs< 32:9.9.4-38.el7_3
bind-pkcs11-utils< 32:9.9.4-38.el7_3
bind-sdb< 30:9.3.6-25.P1.el5_11.11 | < 32:9.8.2-0.47.rc1.el6_8.3 | < 32:9.9.4-38.el7_3 | < 32:9.8.2-0.37.rc1.el6_7.9 | < 32:9.7.3-8.P3.el6_2.6 | < 32:9.8.2-0.17.rc1.el6_4.10 | < 32:9.8.2-0.23.rc1.el6_5.5 | < 32:9.8.2-0.30.rc1.el6_6.7
bind-sdb-chroot< 32:9.9.4-38.el7_3
bind-utils< 30:9.3.6-25.P1.el5_11.11 | < 32:9.8.2-0.47.rc1.el6_8.3 | < 32:9.9.4-38.el7_3 | < 32:9.8.2-0.37.rc1.el6_7.9 | < 32:9.7.3-8.P3.el6_2.6 | < 32:9.8.2-0.17.rc1.el6_4.10 | < 32:9.8.2-0.23.rc1.el6_5.5 | < 32:9.8.2-0.30.rc1.el6_6.7
bind97< 32:9.7.0-21.P2.el5_11.9
bind97-chroot< 32:9.7.0-21.P2.el5_11.9
bind97-debuginfo< 32:9.7.0-21.P2.el5_11.9
bind97-devel< 32:9.7.0-21.P2.el5_11.9
bind97-libs< 32:9.7.0-21.P2.el5_11.9
bind97-utils< 32:9.7.0-21.P2.el5_11.9
caching-nameserver< 30:9.3.6-25.P1.el5_11.11

Show all 29

Suse21 products

bind&distro=SUSE Linux Enterprise Desktop 12 SP1< 9.9.9P1-49.1
bind&distro=SUSE Linux Enterprise Desktop 12 SP2< 9.9.9P1-49.1
bind&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 9.9.6P1-0.33.1
bind&distro=SUSE Linux Enterprise Server 11 SP2-LTSS< 9.9.6P1-0.33.1
bind&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 9.9.6P1-0.33.1

Show all 21

Netapp3 products

Debian2 products

bind9< 1:9.10.3.dfsg.P4-11 | < 1:9.9.5.dfsg-9+deb8u8 | < 1:9.8.4.dfsg.P1-6+nmu2+deb7u13
debian_linuxEOL8.0

Alpine1 product

bind≥ 9.0.0, < 9.10.4_p4-r0

Isc1 product

bind≥ 9.0.0, < 9.9.9 | ≥ 9.10.0, < 9.10.4 | 9.9.9 | 9.9.9:beta1 | 9.9.9:beta2 | 9.9.9:p1 | 9.9.9:p2 | 9.9.9:p3 | 9.10.4 | 9.10.4:beta1 | 9.10.4:beta2 | 9.10.4:beta3 | 9.10.4:p1 | 9.10.4:p2 | 9.10.4:p3 | 9.11.0 | 9.11.0:alpha1 | 9.11.0:alpha2 | 9.11.0:alpha3 | 9.11.0:beta1 | 9.11.0:beta2 | 9.11.0:beta3

Mageia1 product

bind< 9.10.3.P4-1.2.mga5

Ubuntu1 product

bind9< 1:9.9.5.dfsg-3ubuntu0.10 | < 1:9.10.3.dfsg.P4-8ubuntu1.2

8 vendors · 59 products

References

44 links

kb.isc.org/article/AA-01438X Refsource CONFIRMBroken Link
rhn.redhat.com/errata/RHSA-2016-2871.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.securitytracker.com/id/1037156VDB EntryX Refsource SECTRACKThird Party Advisory
security.netapp.com/advisory/ntap-20180926-0005/X Refsource CONFIRMThird Party Advisory
www.debian.org/security/2016/dsa-3703Vendor AdvisoryX Refsource DEBIANThird Party Advisory
security.freebsd.org/advisories/FreeBSD-SA-16:34.bind.ascVendor AdvisoryX Refsource FREEBSDThird Party Advisory
kb.isc.org/article/AA-01435X Refsource CONFIRMBroken Link
access.redhat.com/errata/RHSA-2017:1583Vendor AdvisoryX Refsource REDHATThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-2141.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
security.gentoo.org/glsa/201701-26Vendor AdvisoryX Refsource GENTOOThird Party Advisory

Show all 44 references

rhn.redhat.com/errata/RHSA-2016-2142.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
kb.isc.org/article/AA-01437X Refsource CONFIRMBroken Link
kb.isc.org/article/AA-01436X Refsource CONFIRMBroken Link
www.securityfocus.com/bid/94067VDB EntryX Refsource BIDThird Party Advisory
kb.isc.org/article/AA-01434X Refsource CONFIRMVendor AdvisoryWEBARTICLEREPORT
rhn.redhat.com/errata/RHSA-2016-2615.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05381687X Refsource CONFIRMThird Party Advisory
security.alpinelinux.org/vuln/CVE-2016-8864Advisory
advisories.mageia.org/MGASA-2016-0365.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=19698REPORT
www.ubuntu.com/usn/usn-3119-1/WEB
www.suse.com/support/update/announcement/2016/suse-su-20162696-1/Advisory
bugzilla.suse.com/1007829REPORT
www.suse.com/security/cve/CVE-2016-8864WEB
www.suse.com/support/update/announcement/2016/suse-su-20162697-1/Advisory
bugzilla.suse.com/965748REPORT
www.suse.com/support/update/announcement/2016/suse-su-20162697-2/Advisory
www.suse.com/support/update/announcement/2016/suse-su-20162706-1/Advisory
access.redhat.com/errata/RHSA-2016:2141Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1389652REPORT
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2141.jsonAdvisory
access.redhat.com/security/cve/CVE-2016-8864REPORT
www.cve.org/CVERecord?id=CVE-2016-8864AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2016-8864Advisory
access.redhat.com/errata/RHSA-2016:2142Advisory
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2142.jsonAdvisory
access.redhat.com/errata/RHSA-2016:2615Advisory
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2615.jsonAdvisory
access.redhat.com/errata/RHSA-2016:2871Advisory
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2871.jsonAdvisory
ubuntu.com/security/CVE-2016-8864REPORT
ubuntu.com/security/notices/USN-3119-1Advisory
security-tracker.debian.org/tracker/CVE-2016-8864Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities