CVE-2015-5477

Published Jul 29, 2015

Last updated 13 days ago

Exploit knownCVSS high 7.5
ISC BIND
BIND

Overview

Description
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
Source
cve@mitre.org
NVD status
Analyzed
Products
junos, fedora, enterprise_linux, enterprise_linux_aus, debian_linux, vm_server, solaris, hp-ux, ubuntu_linux, clustered_data_ontap, os_x_server, dns, openvms, vcx, linux_enterprise_debuginfo, evergreen, opensuse, linux_enterprise_desktop, linux_enterprise_server, linux_enterprise_software_development_kit, bind

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity
HIGH

CVSS 2.0

Type
Primary
Base score
7.8
Impact score
6.9
Exploitability score
10
Vector string
AV:N/AC:L/Au:N/C:N/I:N/A:C

Known exploits

Data from CISA

Vulnerability name
ISC BIND Data Processing Errors Vulnerability
Exploit added on
Oct 8, 2026
Exploit action due
Oct 11, 2026
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

nvd@nist.gov
CWE-19
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-617

Social media

Hype score
Not currently trending

Configurations

Related CVEs

  1. A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.•CVE-2026-104045
  2. A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services.•CVE-2026-104046
  3. A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.•CVE-2026-104048
  4. A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.•CVE-2026-104047
  5. A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.•CVE-2026-88252

References

Sources include official advisories and independent security research.