CVE-2017-3135: Combination of DNS64 and RPZ Can Lead to Crash
Vulnerability summary
CVE-2017-3135 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 17.11% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 17% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 16-01-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leading to either an INSIST assertion failure or an attempt to read through a NULL pointer. Affects BIND 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1.
CVSS metrics
7 scores · 6 sources · 2 versions- NVDNIST5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
17.11%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
Decrease -0.13 pp
From 17.24% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat21 products
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.3 | 7.4 | 7.6
- enterprise_linux_server_eus7.3 | 7.4 | 7.5 | 7.6
- enterprise_linux_server_tus7.3 | 7.6
Suse20 products
- bind&distro=SUSE Linux Enterprise Desktop 12 SP1< 9.9.9P1-56.1
- bind&distro=SUSE Linux Enterprise Desktop 12 SP2< 9.9.9P1-56.1
- bind&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 9.9.6P1-0.39.1
- bind&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 9.9.6P1-0.39.1
- bind&distro=SUSE Linux Enterprise Server 11 SP3-TERADATA< 9.9.6P1-0.39.1
Debian2 products
- bind9< 1:9.10.3.dfsg.P4-12 | < 1:9.9.5.dfsg-9+deb8u10 | < 1:9.8.4.dfsg.P1-6+nmu2+deb7u15
- debian_linuxEOL8.0 | 9.0
Isc2 products
- bind9.9.3 | 9.9.3:s1 | 9.9.8 | 9.9.9:p5 | 9.9.9:s7 | 9.9.10:beta1 | 9.10.0 | 9.10.4:p1 | 9.10.4:p2 | 9.10.4:p3 | 9.10.4:p4 | 9.10.4:p5 | 9.10.5:beta1 | 9.11.0 | 9.11.0:p1 | 9.11.0:p2 | 9.11.1:beta1
- bind 9BIND 9 9.8.8, 9.9.3-S1 -> 9.9.9-S7, 9.9.3 -> 9.9.9-P5, 9.9.10b1, 9.10.0 -> 9.10.4-P5, 9.10.5b1, 9.11.0 -> 9.11.0-P2, 9.11.1b1
Netapp2 products
Alpine1 product
- bind< 9.10.4_p6-r0
Ubuntu1 product
- bind9< 1:9.9.5.dfsg-3ubuntu0.13 | < 1:9.10.3.dfsg.P4-8ubuntu1.5
7 vendors · 49 products
References
25 links- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03747en_usX Refsource CONFIRMThird Party Advisory
