Every CVESearch/Get API key

CVE-2015-4620

name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when...

7.8 HighFix available

CVE-2015-4620 is a high vulnerability (CVSS 7.8) in Isc Bind, published January 27, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 38.8%, the 98th percentile. Fixed in bind9 1:9.9.5.dfsg-10.

What does this mean?
Severity
7.8 HighCVSS 2.0, NVD
Exploit chance
38.8%EPSS, 98th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1:9.9.5.dfsg-10bind9 +85 more

Description

name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.

Exploit likelihood

38.8%Up 12.4 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bind9
Debian:12
before 1:9.9.5.dfsg-10
1:9.9.5.dfsg-10
bind9
Debian:13
before 1:9.9.5.dfsg-10
1:9.9.5.dfsg-10
bind9
Debian:14
before 1:9.9.5.dfsg-10
1:9.9.5.dfsg-10
bind9
Debian:6.0
before 9.7.3.dfsg-1~squeeze15
9.7.3.dfsg-1~squeeze15
bind9
Debian:7
before 1:9.8.4.dfsg.P1-6+nmu2+deb7u5, plus listed versions
1:9.8.4.dfsg.P1-6+nmu21:9.8.4.dfsg.P1-6+nmu2+deb7u11:9.8.4.dfsg.P1-6+nmu2+deb7u1~bpo60+11:9.8.4.dfsg.P1-6+nmu2+deb7u21:9.8.4.dfsg.P1-6+nmu2+deb7u2~bpo60+11:9.8.4.dfsg.P1-6+nmu2+deb7u31:9.8.4.dfsg.P1-6+nmu2+deb7u4
1:9.8.4.dfsg.P1-6+nmu2+deb7u5
bind9
Debian:8
before 1:9.9.5.dfsg-9+deb8u1, plus listed versions
1:9.9.5.dfsg-9
1:9.9.5.dfsg-9+deb8u1
bind
Mageia:4
before 9.9.7.P1-1.mga4
9.9.7.P1-1.mga4
bind
Mageia:5
before 9.10.2.P2-1.mga5
9.10.2.P2-1.mga5
bind
Red Hat:enterprise_linux:7::client
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-debuginfo
Red Hat:enterprise_linux:7::client
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
Show 76 moreShow less
Affected packages
PackageAffectedFixed
bind-libs
Red Hat:enterprise_linux:7::client
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-libs-lite
Red Hat:enterprise_linux:7::client
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-license
Red Hat:enterprise_linux:7::client
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-utils
Red Hat:enterprise_linux:7::client
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-chroot
Red Hat:enterprise_linux:7::client
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-devel
Red Hat:enterprise_linux:7::client
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-lite-devel
Red Hat:enterprise_linux:7::client
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-sdb
Red Hat:enterprise_linux:7::client
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-sdb-chroot
Red Hat:enterprise_linux:7::client
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind
Red Hat:enterprise_linux:7::computenode
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-debuginfo
Red Hat:enterprise_linux:7::computenode
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-libs
Red Hat:enterprise_linux:7::computenode
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-libs-lite
Red Hat:enterprise_linux:7::computenode
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-license
Red Hat:enterprise_linux:7::computenode
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-utils
Red Hat:enterprise_linux:7::computenode
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-chroot
Red Hat:enterprise_linux:7::computenode
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-devel
Red Hat:enterprise_linux:7::computenode
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-lite-devel
Red Hat:enterprise_linux:7::computenode
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-sdb
Red Hat:enterprise_linux:7::computenode
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-sdb-chroot
Red Hat:enterprise_linux:7::computenode
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind
Red Hat:enterprise_linux:7::server
before 32:9.9.4-18.ael7b_1.2
32:9.9.4-18.ael7b_1.2
bind-chroot
Red Hat:enterprise_linux:7::server
before 32:9.9.4-18.ael7b_1.2
32:9.9.4-18.ael7b_1.2
bind-debuginfo
Red Hat:enterprise_linux:7::server
before 32:9.9.4-18.ael7b_1.2
32:9.9.4-18.ael7b_1.2
bind-libs
Red Hat:enterprise_linux:7::server
before 32:9.9.4-18.ael7b_1.2
32:9.9.4-18.ael7b_1.2
bind-libs-lite
Red Hat:enterprise_linux:7::server
before 32:9.9.4-18.ael7b_1.2
32:9.9.4-18.ael7b_1.2
bind-license
Red Hat:enterprise_linux:7::server
before 32:9.9.4-18.ael7b_1.2
32:9.9.4-18.ael7b_1.2
bind-utils
Red Hat:enterprise_linux:7::server
before 32:9.9.4-18.ael7b_1.2
32:9.9.4-18.ael7b_1.2
bind-devel
Red Hat:enterprise_linux:7::server
before 32:9.9.4-18.ael7b_1.2
32:9.9.4-18.ael7b_1.2
bind-lite-devel
Red Hat:enterprise_linux:7::server
before 32:9.9.4-18.ael7b_1.2
32:9.9.4-18.ael7b_1.2
bind-sdb
Red Hat:enterprise_linux:7::server
before 32:9.9.4-18.ael7b_1.2
32:9.9.4-18.ael7b_1.2
bind-sdb-chroot
Red Hat:enterprise_linux:7::server
before 32:9.9.4-18.ael7b_1.2
32:9.9.4-18.ael7b_1.2
bind
Red Hat:enterprise_linux:7::workstation
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-chroot
Red Hat:enterprise_linux:7::workstation
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-debuginfo
Red Hat:enterprise_linux:7::workstation
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-libs
Red Hat:enterprise_linux:7::workstation
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-libs-lite
Red Hat:enterprise_linux:7::workstation
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-license
Red Hat:enterprise_linux:7::workstation
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-utils
Red Hat:enterprise_linux:7::workstation
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-devel
Red Hat:enterprise_linux:7::workstation
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-lite-devel
Red Hat:enterprise_linux:7::workstation
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-sdb
Red Hat:enterprise_linux:7::workstation
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind-sdb-chroot
Red Hat:enterprise_linux:7::workstation
before 32:9.9.4-18.el7_1.2
32:9.9.4-18.el7_1.2
bind
Red Hat:enterprise_linux:6::client
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-debuginfo
Red Hat:enterprise_linux:6::client
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-libs
Red Hat:enterprise_linux:6::client
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-utils
Red Hat:enterprise_linux:6::client
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-chroot
Red Hat:enterprise_linux:6::client
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-devel
Red Hat:enterprise_linux:6::client
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-sdb
Red Hat:enterprise_linux:6::client
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind
Red Hat:enterprise_linux:6::computenode
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-debuginfo
Red Hat:enterprise_linux:6::computenode
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-libs
Red Hat:enterprise_linux:6::computenode
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-utils
Red Hat:enterprise_linux:6::computenode
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-chroot
Red Hat:enterprise_linux:6::computenode
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-devel
Red Hat:enterprise_linux:6::computenode
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-sdb
Red Hat:enterprise_linux:6::computenode
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind
Red Hat:enterprise_linux:6::server
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-chroot
Red Hat:enterprise_linux:6::server
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-debuginfo
Red Hat:enterprise_linux:6::server
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-libs
Red Hat:enterprise_linux:6::server
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-utils
Red Hat:enterprise_linux:6::server
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-devel
Red Hat:enterprise_linux:6::server
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-sdb
Red Hat:enterprise_linux:6::server
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind
Red Hat:enterprise_linux:6::workstation
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-chroot
Red Hat:enterprise_linux:6::workstation
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-debuginfo
Red Hat:enterprise_linux:6::workstation
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-libs
Red Hat:enterprise_linux:6::workstation
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-utils
Red Hat:enterprise_linux:6::workstation
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-devel
Red Hat:enterprise_linux:6::workstation
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind-sdb
Red Hat:enterprise_linux:6::workstation
before 32:9.8.2-0.37.rc1.el6_7.1
32:9.8.2-0.37.rc1.el6_7.1
bind
SUSE:Linux Enterprise Desktop 12
From an advisory covering 2 CVEs
before 9.9.6P1-18.1
9.9.6P1-18.1
bind
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 2 CVEs
before 9.9.6P1-18.1
9.9.6P1-18.1
bind
SUSE:Linux Enterprise Server 12
From an advisory covering 2 CVEs
before 9.9.6P1-18.1
9.9.6P1-18.1
bind
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 2 CVEs
before 9.9.6P1-18.1
9.9.6P1-18.1
bind9
Ubuntu:14.04:LTS
before 1:9.9.5.dfsg-3ubuntu0.3, plus listed versions
1:9.9.3.dfsg.P2-4ubuntu11:9.9.3.dfsg.P2-4ubuntu21:9.9.3.dfsg.P2-4ubuntu31:9.9.5.dfsg-21:9.9.5.dfsg-31:9.9.5.dfsg-3ubuntu0.11:9.9.5.dfsg-3ubuntu0.2
1:9.9.5.dfsg-3ubuntu0.3
bind
openSUSE:Tumbleweed
From an advisory covering 37 CVEs
before 9.10.3P4-21.1
9.10.3P4-21.1

What each source reports

NVD Score used7.8

name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.

Record
CVE-2015-4620
CVSS 2.0
7.8 HighAV:N/AC:L/Au:N/C:N/I:N/A:C
Weakness
CWE-17
Updated
2026-11-02
CVE ListNo score

name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.

Record
CVE-2015-4620
Updated
2026-11-02
EUVDEUVD-2015-4639No score

name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.

Record
EUVD-2015-4639
Updated
2026-11-03
GitHub AdvisoriesGHSA-m8gj-8mqg-2pwgNo score

name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when...

name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.

Record
GHSA-m8gj-8mqg-2pwg
Updated
2026-11-02
OSVNo score

name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.

Record
CVE-2015-4620
Updated
2026-11-02
OSVDEBIAN-CVE-2015-4620No score

name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.

Record
DEBIAN-CVE-2015-4620
Updated
2026-11-02
Show 6 moreShow less
OSVMGASA-2015-0272No score

Updated bind package fixes security vulnerability

A recursive resolver that is performing DNSSEC validation can be deliberately terminated by any attacker who can cause a query to be performed against a maliciously constructed zone. This will result in a denial of service to clients who rely on that resolver (CVE-2015-4620).

Note that DNSSEC validation is not enabled by default.

Record
MGASA-2015-0272
Updated
2026-11-02
OSVopenSUSE-SU-2024:10467-1No score

bind-9.10.3P4-21.1 on GA media

These are all security issues fixed in the bind-9.10.3P4-21.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10467-1
Updated
2026-11-02
OSVSUSE-SU-2015:1204-1No score

Security update for bind

bind was updated to fix two security issues.

These security issues were fixed:

  • CVE-2015-1349: Named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allowed remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use (bsc#918330).
  • CVE-2015-4620: Fixed resolver crash when validating (bsc#936476).
Record
SUSE-SU-2015:1204-1
Updated
2026-11-02
OSVSUSE-SU-2015:1205-1No score

Security update for bind

This update fixes a DoS vulnerability in bind when handling malformed NSEC3-signed zones. CVE-2014-0591 has been assigned to this issue.

Security Issue references:

* CVE-2014-0591
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0591>
Record
SUSE-SU-2015:1205-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-4620No score

name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.

Record
UBUNTU-CVE-2015-4620
Updated
2026-11-02
OSVUSN-2669-1No score

bind9 vulnerability

Breno Silveira Soares discovered that Bind incorrectly handled certain zone data when configured to perform DNSSEC validation. A remote attacker could use this issue with specially crafted zone data to cause Bind to crash, resulting in a denial of service.

Record
USN-2669-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 81 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open