vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2017-3145

Improper fetch cleanup sequencing in the resolver can cause named to crash

HIGH
7.5
CVSS Score
Published: January 16, 2019 at 08:00 PM UTC
Updated: June 17, 2026 at 01:17 AM UTC
38 products affected across 6 vendorsDebian LinuxEnterprise Linux DesktopEnterprise Linux Server

Using BIND 9 by ISC?

Get instant alerts when new vulnerabilities affect BIND 9 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 28%

Description

BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux· Debiandrupal
95%
7.08.09.0
BIND· Isc
95%
9.0.0 ≤ v ≤ 9.12.0rc19.10.0 ≤ v ≤ 9.10.69.11.0 ≤ v ≤ 9.11.29.4.0 ≤ v ≤ 9.8.89.9.0 ≤ v ≤ 9.9.119.10.5 s19.10.6 s19.12.0 alpha19.12.0 b19.12.0 b29.12.0 rc19.9.11 s19.9.3 s1
Junos· Juniper Networks
95%
12.1x46-d7612.3x48-d7015.1x49-d14017.4r218.1r218.2r1
juniper-srx100 (environment) · juniper-srx110 (environment) · juniper-srx1400 (environment) · juniper-srx1500 (environment) · juniper-srx210 (environment) · juniper-srx220 (environment) · juniper-srx240 (environment) · juniper-srx240h2 (environment) · juniper-srx240m (environment) · juniper-srx300 (environment) · juniper-srx320 (environment) · juniper-srx340 (environment) · juniper-srx3400 (environment) · juniper-srx345 (environment) · juniper-srx3600 (environment) · juniper-srx380 (environment) · juniper-srx4000 (environment) · juniper-srx4100 (environment) · juniper-srx4200 (environment) · juniper-srx4600 (environment) · juniper-srx5000 (environment) · juniper-srx5400 (environment) · juniper-srx550 (environment) · juniper-srx550-hm (environment) · juniper-srx550m (environment) · juniper-srx5600 (environment) · juniper-srx5800 (environment) · juniper-srx650 (environment)
Data Ontap Edge· NetApp
95%
All versions
Enterprise Linux Desktop· Red Hatrubygems
95%
6.07.0
Enterprise Linux Server· Red Hatrubygems
95%
6.07.0
Enterprise Linux Server Aus· Red Hatrubygems
95%
6.46.56.67.27.37.47.6
Enterprise Linux Server Eus· Red Hatrubygems
95%
6.77.37.47.57.6
Enterprise Linux Server Tus· Red Hatrubygems
95%
6.67.27.37.6
Enterprise Linux Workstation· Red Hatrubygems
95%
6.07.0

References (11)

VDB Entryx_refsource_BIDBroken LinkThird Party Advisory
Source: [email protected]
http://www.securityfocus.com/bid/102716
VDB Entryx_refsource_SECTRACKBroken LinkThird Party Advisory
Source: [email protected]
http://www.securitytracker.com/id/1040195
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2018:0101
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2018:0102
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2018:0487
Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2018:0488
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://kb.isc.org/docs/aa-01542
Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2018/01/msg00029.html

CVSS

7.5HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card