CVE-2016-2088

resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
VendorProductVersion
iscbind
9.10.0
iscbind
9.10.0:a1
iscbind
9.10.0:a2
iscbind
9.10.0:b1
iscbind
9.10.0:b2
iscbind
9.10.0:p1
iscbind
9.10.0:p2
iscbind
9.10.0:rc1
iscbind
9.10.0:rc2
iscbind
9.10.1
iscbind
9.10.1:b1
iscbind
9.10.1:b2
iscbind
9.10.1:p1
iscbind
9.10.1:p2
iscbind
9.10.1:rc1
iscbind
9.10.1:rc2
iscbind
9.10.2:b1
iscbind
9.10.2:p1
iscbind
9.10.2:p2
iscbind
9.10.2:p3
iscbind
9.10.2:p4
iscbind
9.10.2:rc1
iscbind
9.10.2:rc2
iscbind
9.10.3
iscbind
9.10.3:b1
iscbind
9.10.3:p1
iscbind
9.10.3:p2
iscbind
9.10.3:p3
iscbind
9.10.3:rc1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
bind9
bullseye
1:9.16.50-1~deb11u2
fixed
bullseye (security)
1:9.16.50-1~deb11u1
fixed
bookworm
1:9.18.28-1~deb12u2
fixed
bookworm (security)
1:9.18.28-1~deb12u2
fixed
sid
1:9.20.2-1
fixed
trixie
1:9.20.2-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
bind9
wily
not-affected
trusty
not-affected
precise
not-affected