CVE-2022-2881 : The underlying bug might cause read past end of the buffer and either read memor

The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process.

Published 2022-09-21 11:15:10

Updated 2022-11-16 20:12:03

View at NVD, CVE.org

Products affected by CVE-2022-2881

ISC » Bind »
Versions from including (>=) 9.19.0 and before (<) 9.19.5
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*
Matching versions
ISC » Bind »
Versions from including (>=) 9.18.0 and before (<) 9.18.7
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*
Matching versions

Top countries where our scanners detected CVE-2022-2881

Top open port discovered on systems with this issue 53

IPs affected by CVE-2022-2881 18,127

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2022-2881!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 48 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	3.9	4.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: High
5.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H	1.2	4.2	Internet Systems Consortium (ISC)
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: High

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

https://security.gentoo.org/glsa/202210-25

ISC BIND: Multiple Vulnerabilities (GLSA 202210-25) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://kb.isc.org/docs/cve-2022-2881

CVE-2022-2881: Buffer overread in statistics channel code
Patch;Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/09/21/3

oss-security - ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178)
Mailing List;Patch;Third Party Advisory

CVEs referencing this url

Jump to