CVE-2013-2266

NameCVE-2013-2266
Descriptionlibdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running a named process.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-2656-1
Debian Bugs704174

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
bind9 (PTS)bullseye (security), bullseye1:9.16.48-1fixed
bookworm, bookworm (security)1:9.18.24-1fixed
sid, trixie1:9.19.24-185-g392e7199df2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
bind9sourcesqueeze1:9.7.3.dfsg-1~squeeze10DSA-2656-1
bind9source(unstable)1:9.8.4.dfsg.P1-6+nmu1704174

Search for package or bug name: Reporting problems