CVE-2018-5744

Published: Oct 9, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A failure to free memory can occur when processing messages having a specific combination of EDNS options. Versions affected are: BIND 9.10.7 -> 9.10.8-P1, 9.11.3 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.10.7-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected.

Affected (16)

Products: Isc: Bind

Isc

1 product

Bind

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Isc Bind	From 9.10.7 to 9.10.8
Isc Bind	From 9.11.3 to 9.11.5
Isc Bind	From 9.12.0 to 9.12.3
Isc Bind	From 9.13.0 to 9.13.6
Isc Bind	Version 9.10.7 s1
Isc Bind	Version 9.10.8
Isc Bind	Version 9.10.8 p1
Isc Bind	Version 9.10.8 rc1
Isc Bind	Version 9.10.8 rc2
Isc Bind	Version 9.11.5
Isc Bind	Version 9.11.5 p1
Isc Bind	Version 9.11.5 rc1
Isc Bind	Version 9.11.5 s3
Isc Bind	Version 9.12.3
Isc Bind	Version 9.12.3 p1
Isc Bind	Version 9.12.3 rc1

Related CWEs

CWE-772

Missing Release of Resource after Effective Lifetime

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

References (2)

https://kb.isc.org/docs/cve-2018-5744

Source: security-officer@isc.org

Vendor Advisory

https://kb.isc.org/docs/cve-2018-5744

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.