{"id":"CVE-2015-8705","aliases":["EUVD-2015-8582","GHSA-j4rq-g63g-h87j","MGASA-2016-0030","openSUSE-SU-2024:10467-1"],"status":"published","title":"buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows...","description":"buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.","severity":{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07863,"percentile":0.94734,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2016-01-20T15:00:00Z","modified":"2026-06-17T00:35:04Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.3.P3-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.3P4-21.1"}]}],"bundled":37}],"products":[{"vendor":"isc","product":"bind"}],"references":[{"url":"https://kb.isc.org/article/AA-01336","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175977.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.securitytracker.com/id/1034740","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.securityfocus.com/bid/81314","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201610-07","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://kb.isc.org/article/AA-01380","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176564.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8705"},{"url":"https://github.com/advisories/GHSA-j4rq-g63g-h87j"},{"url":"https://advisories.mageia.org/MGASA-2016-0030.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17541","tags":["report"]},{"url":"https://kb.isc.org/article/AA-01335","tags":["web"]},{"url":"https://kb.isc.org/article/AA-01346","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8864","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-8705","description":"buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.","status":"published","published":"2016-01-20T15:00:00Z","modified":"2024-08-06T08:29:21.425Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2015-8582","description":"buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.","status":"published","published":"2016-01-20T15:00:00Z","modified":"2024-08-06T08:29:21Z","updated_at":"2026-11-03T01:57:26.384611Z"}],"ghsa":[{"id":"GHSA-j4rq-g63g-h87j","title":"buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows...","description":"buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.","status":"published","published":"2022-05-14T02:13:42Z","modified":"2023-02-02T05:05:23Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:52:06.092141Z"}],"nvd":[{"id":"CVE-2015-8705","description":"buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.","status":"published","published":"2016-01-20T15:59:01.72Z","modified":"2026-06-17T00:35:04.053Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.6,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:15.746629Z"}],"osv":[{"id":"MGASA-2016-0030","title":"Updated bind packages fix security vulnerability","description":"In ISC BIND before 9.10.3-P3, a buffer size check used to guard against\noverflow could cause named to exit with an INSIST failure In apl_42.c\n(CVE-2015-8704).\n\nIn ISC BIND before 9.10.3-P3, errors can occur when OPT pseudo-RR data or\nECS options are formatted to text.  In 9.10.3 through 9.10.3-P2, the issue\nmay result in a REQUIRE assertion failure in buffer.c, causing a crash.\nThis can be avoided in named by disabling debug logging (CVE-2015-8705).\n","status":"published","published":"2016-01-20T17:53:26Z","modified":"2026-04-16T06:23:05.100107302Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10467-1","title":"bind-9.10.3P4-21.1 on GA media","description":"These are all security issues fixed in the bind-9.10.3P4-21.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:40:15.60024Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}