01 Record

CVE-2017-3145

Improper fetch cleanup sequencing in the resolver can cause named to crash

HighPUBLISHEDCNA: isc

CNA base score7.5 CVSS v3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View raw JSON

02 Description

Improper fetch cleanup sequencing in the resolver can cause named to crash

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 27.93% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 97.9% of scored records. A rank, not a probability.
NVD base score: 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2019-01-16 20:00Z7 YR AGO

Last updated

2024-09-17 00:10Z1 YR AGO

Reserved

2016-12-02

Assigning CNA

isc

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-416Use After FreeVariant

Data version

5.1

Document digest

d4e05758c35d3010a3ba6f42e6bb80ec8c41e1c144393e24035dfd1b375486e1

05 Affected products

VendorProductVersionsPlatforms

ISCBIND 99.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1—

06 References

access.redhat.comRHSA-2018:0102https://access.redhat.com/errata/RHSA-2018:0102vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2018:0487https://access.redhat.com/errata/RHSA-2018:0487vendor-advisoryx_refsource_REDHAT
www.debian.orgDSA-4089https://www.debian.org/security/2018/dsa-4089vendor-advisoryx_refsource_DEBIAN
access.redhat.comRHSA-2018:0488https://access.redhat.com/errata/RHSA-2018:0488vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2018:0101https://access.redhat.com/errata/RHSA-2018:0101vendor-advisoryx_refsource_REDHAT
www.securitytracker.com1040195http://www.securitytracker.com/id/1040195vdb-entryx_refsource_SECTRACK
kb.isc.orghttps://kb.isc.org/docs/aa-01542x_refsource_CONFIRM
www.securityfocus.com102716http://www.securityfocus.com/bid/102716vdb-entryx_refsource_BID
lists.debian.org[debian-lts-announce] 20180121 [SECURITY] [DLA 1255-1] bind9 security updatehttps://lists.debian.org/debian-lts-announce/2018/01/msg00029.htmlmailing-listx_refsource_MLIST
security.netapp.comhttps://security.netapp.com/advisory/ntap-20180117-0003/x_refsource_CONFIRM
supportportal.juniper.nethttps://supportportal.juniper.net/s/article/2018-07-Security-Bulletin-SRX-Series-Vulnerabilities-in-ISC-BIND-namedvendor-advisoryx_refsource_CONFIRM

07 Remediation

Upgrade to the patched release most closely related to your current version of BIND. These can all be downloaded from http://www.isc.org/downloads. BIND 9 version 9.9.11-P1 BIND 9 version 9.10.6-P1 BIND 9 version 9.11.2-P1 BIND 9 version 9.12.0rc2 BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers. BIND 9 version 9.9.11-S2 BIND 9 version 9.10.6-S2

01 Record index

CVE-2017-3145

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

07 Remediation

02 Records

CVE-2017-3145

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

07 Remediation