CVE-2016-5427
High · 7.5CVSS
7.5
EPSS
63.0%
Published
Sep 21, 2016
CISA due date
—
The record
PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels, which allows remote attackers to cause a denial of service (backend CPU consumption) via a crafted DNS query.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | pdns | 0 | 4.0.0~alpha1-1 |
| Debian:12 | pdns | 0 | 4.0.0~alpha1-1 |
| Debian:13 | pdns | 0 | 4.0.0~alpha1-1 |
| Debian:14 | pdns | 0 | 4.0.0~alpha1-1 |
| Debian:7 | pdns | 0 | 3.1-4.1+deb7u2 |
| Debian:8 | pdns | 0 | 3.4.1-4+deb8u6 |
| Mageia:5 | pdns | 0 | 3.3.3-1.2.mga5 |
| Ubuntu:16.04:LTS | pdns | 0 | 4.0.0~alpha2-3build1 |
Related vulnerabilities
- CVE-2016-5426 PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a… Also affects pdns
- CVE-2015-5311 PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to… Also affects pdns
- CVE-2015-5470 The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before… Also affects pdns
- CVE-2015-1868 The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and… Also affects pdns
- CVE-2026-41983 Null pointer dereference vulnerability in the browser module. Impact: Successful… CWE-399
- CVE-2015-9252 An issue was discovered in QPDF before 7.0.0. CWE-399
- CVE-2012-0881 Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of… CWE-399
- CVE-2015-7944 The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x… CWE-399