CVE catalog

CVE-2018-5736

bind9: CVE-2018-5736

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
18.02% · Oct 25, 2026

An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. This defect could be deliberately exercised by an attacker who is permitted to cause a vulnerable server to initiate zone transfers (for example: by sending valid NOTIFY messages), causing the named process to exit after failing the assertion test. Affects BIND 9.12.0 and 9.12.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbind9sid1:9.20.30-1not affected
Debianbind9forky1:9.20.30-1not affected
Debianbind9trixie1:9.20.26-1~deb13u1not affected
Debianbind9trixie-security1:9.20.30-1~deb13u1not affected
Debianbind9bookworm1:9.18.49-1~deb12u1not affected
Debianbind9bookworm-security1:9.18.49-1~deb12u3not affected
Alpinebind3.109.12.1_p2-r0fixed
Alpinebind3.119.12.1_p2-r0fixed
Alpinebind3.129.12.1_p2-r0fixed
Alpinebind3.139.12.1_p2-r0fixed
Alpinebind3.149.12.1_p2-r0fixed
Alpinebind3.159.12.1_p2-r0fixed
Alpinebind3.169.12.1_p2-r0fixed
Alpinebind3.179.12.1_p2-r0fixed
Alpinebind3.189.12.1_p2-r0fixed
Alpinebind3.199.12.1_p2-r0fixed
Alpinebind3.209.12.1_p2-r0fixed
Alpinebind3.219.12.1_p2-r0fixed
Alpinebind3.229.12.1_p2-r0fixed
Alpinebind3.239.12.1_p2-r0fixed
Alpinebind3.249.12.1_p2-r0fixed
Alpinebind3.89.12.1_p2-r0fixed
Alpinebind3.99.12.1_p2-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbind9sourcesidNot affectedunimportantNot reportedNot reported
Debianbind9sourceforkyNot affectedunimportantNot reportedNot reported
Debianbind9sourcetrixieNot affectedunimportantNot reportedNot reported
Debianbind9sourcebookwormNot affectedunimportantNot reportedNot reported
Alpinebindapk3.109.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.119.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.129.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.139.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.149.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.159.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.169.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.179.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.189.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.199.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.209.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.219.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.229.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.239.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.249.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.89.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported
Alpinebindapk3.99.12.1_p2-r0Not reportedALPINE-CVE-2018-5736Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [bind9]Unknown
    Details (6)

    • 1:9.18.49-1~deb12u1 · amd64 · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u1 · arm64 · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · amd64 · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · arm64 · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · amd64 · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · arm64 · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

  • [bind9-dev]Unknown

    Source package: [bind9]

    Details (6)

    • 1:9.18.49-1~deb12u1 · amd64 · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u1 · arm64 · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · amd64 · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · arm64 · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · amd64 · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · arm64 · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

  • [bind9-dnsutils]Unknown

    Source package: [bind9]

    Details (6)

    • 1:9.18.49-1~deb12u1 · amd64 · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u1 · arm64 · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · amd64 · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · arm64 · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · amd64 · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · arm64 · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

  • [bind9-doc]Unknown

    Source package: [bind9]

    Details (6)

    • 1:9.18.49-1~deb12u1 · all · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u1 · all · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · all · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · all · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · all · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · all · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

  • [bind9-host]Unknown

    Source package: [bind9]

    Details (6)

    • 1:9.18.49-1~deb12u1 · amd64 · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u1 · arm64 · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · amd64 · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · arm64 · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · amd64 · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · arm64 · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

  • [bind9-libs]Unknown

    Source package: [bind9]

    Details (6)

    • 1:9.18.49-1~deb12u1 · amd64 · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u1 · arm64 · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · amd64 · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · arm64 · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · amd64 · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · arm64 · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

  • [bind9-utils]Unknown

    Source package: [bind9]

    Details (6)

    • 1:9.18.49-1~deb12u1 · amd64 · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u1 · arm64 · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · amd64 · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.20.23-1~deb13u1~bpo12+1 · arm64 · bookworm-backports

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · amd64 · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · arm64 · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

  • [bind9utils]Unknown

    Source package: [bind9]

    Details (4)

    • 1:9.18.49-1~deb12u1 · all · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u1 · all · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · all · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · all · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

  • [dnsutils]Unknown

    Source package: [bind9]

    Details (4)

    • 1:9.18.49-1~deb12u1 · all · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u1 · all · bookworm

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · all · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

    • 1:9.18.49-1~deb12u2 · all · bookworm-security

      Not affected

      dsa · bind9 · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]