PT-2022-4860 · Isc+5 · Bind+5

Published 2022-09-21 · Updated 2025-12-01 · CVE-2022-2881

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions BIND versions (affected versions not specified)

Description The issue is related to a buffer overflow bug that can cause the process to read past the end of the buffer, potentially allowing an attacker to read memory that should not be accessible or crash the process. This can be exploited by a remote attacker to gain access to protected information or cause a denial of service. The vulnerability is also associated with boundary conditions when reusing an HTTP connection to request statistics from a statistics channel, which can lead to a read beyond bounds error or a denial of service attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2022-05984

CVE-2022-2881

OESA-2022-1981

OESA-2022-1982

OESA-2022-1983

OPENSUSE-SU-2024:12356-1

USN-5626-1

Affected Products

Bind

Bind Server

Debian

Linuxmint

Red Os

Ubuntu

References · 45

• http://openwall.com/lists/oss-security/2022/09/21/3 · Patch
• https://cve.org/CVERecord?id=CVE-2022-2881 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-2881 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2881 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1982 · Vendor Advisory
• https://security.gentoo.org/glsa/202210-25 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-38177 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-2881 · Vendor Advisory
• https://kb.isc.org/docs/cve-2022-2881 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2881 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2881 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2881 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-2881 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38177 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12356-1 · Vendor Advisory