CVE-2012-5166 in the critical feed json
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote atta…
published 2012-10-10 14 y ago modified 2026-06-16 4 mo ago also EUVD-2012-5089
- cvss
- 7.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 32.7%
- EPSS 32.7% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.
Patch / fix
- isc bind 9.6-ESV-R7-P4, 9.7.6-P4, 9.8.3-P4, 9.9.1-P4
- bind9 Debian 14, Debian 13, Debian 12 1:9.8.1.dfsg.P1-4.3
debian advisories DEBIAN-CVE-2012-5166
- bind97 RHEL 5 32:9.7.0-10.P2.el5_8.4
- bind97-libs RHEL 5 32:9.7.0-10.P2.el5_8.4
- bind97-utils RHEL 5 32:9.7.0-10.P2.el5_8.4
- bind97-chroot RHEL 5 32:9.7.0-10.P2.el5_8.4
- bind RHEL 5 30:9.3.6-20.P1.el5_8.5
- bind RHEL 6 32:9.8.2-0.10.rc1.el6_3.5
- bind-sdb RHEL 5 30:9.3.6-20.P1.el5_8.5
- bind-sdb RHEL 6 32:9.8.2-0.10.rc1.el6_3.5
red hat advisories RHSA-2012:1365RHSA-2012:1364RHSA-2012:1363
- bind openSUSE Tumbleweed 9.10.3P4-21.1
opensuse advisories openSUSE-SU-2024:10467-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2012-5166 updated cvss 5.0
bind: Specially crafted DNS data can cause a lockup in named
-
Red Hat Enterprise Linux (v. 5 server) bind 9.3.6-20.P1.el5_8.5, bind97 9.7.0-10.P2.el5_8.4, bind-sdb 9.3.6-20.P1.el5_8.5, bind-libs 9.3.6-20.P1.el5_8.5, bind-utils 9.3.6-20.P1.el5_8.5, bind-chroot 9.3.6-20.P1.el5_8.5, +4 morefixed: vendor fix RHSA-2012:1363
-
Red Hat Enterprise Linux AS (v. 4 ELS) bind 9.2.4-41.el4, bind-libs 9.2.4-41.el4, bind-utils 9.2.4-41.el4, bind-chroot 9.2.4-41.el4fixed: vendor fix RHSA-2012:1365
-
Red Hat Enterprise Linux Desktop (v. 5 client) bind 9.3.6-20.P1.el5_8.5, bind-sdb 9.3.6-20.P1.el5_8.5, bind-libs 9.3.6-20.P1.el5_8.5, bind-utils 9.3.6-20.P1.el5_8.5, bind-chroot 9.3.6-20.P1.el5_8.5, caching-nameserver 9.3.6-20.P1.el5_8.5 Red Hat Enterprise Linux Desktop (v. 6) bind 9.8.2-0.10.rc1.el6_3.5, bind-sdb 9.8.2-0.10.rc1.el6_3.5, bind-libs 9.8.2-0.10.rc1.el6_3.5, bind-utils 9.8.2-0.10.rc1.el6_3.5, bind-chroot 9.8.2-0.10.rc1.el6_3.5 Red Hat Enterprise Linux Desktop Optional (v. 6) bind 9.8.2-0.10.rc1.el6_3.5, bind-sdb 9.8.2-0.10.rc1.el6_3.5, bind-libs 9.8.2-0.10.rc1.el6_3.5, bind-utils 9.8.2-0.10.rc1.el6_3.5, bind-chroot 9.8.2-0.10.rc1.el6_3.5fixed: vendor fix RHSA-2012:1363
-
Red Hat Enterprise Linux ES (v. 4 ELS) bind 9.2.4-41.el4, bind-libs 9.2.4-41.el4, bind-utils 9.2.4-41.el4, bind-chroot 9.2.4-41.el4fixed: vendor fix RHSA-2012:1365
-
Red Hat Enterprise Linux HPC Node (v. 6) bind 9.8.2-0.10.rc1.el6_3.5, bind-sdb 9.8.2-0.10.rc1.el6_3.5, bind-libs 9.8.2-0.10.rc1.el6_3.5, bind-utils 9.8.2-0.10.rc1.el6_3.5, bind-chroot 9.8.2-0.10.rc1.el6_3.5 Red Hat Enterprise Linux HPC Node Optional (v. 6) bind 9.8.2-0.10.rc1.el6_3.5, bind-sdb 9.8.2-0.10.rc1.el6_3.5, bind-libs 9.8.2-0.10.rc1.el6_3.5, bind-utils 9.8.2-0.10.rc1.el6_3.5, bind-chroot 9.8.2-0.10.rc1.el6_3.5 Red Hat Enterprise Linux Server (v. 6) bind 9.8.2-0.10.rc1.el6_3.5, bind-sdb 9.8.2-0.10.rc1.el6_3.5, bind-libs 9.8.2-0.10.rc1.el6_3.5, bind-utils 9.8.2-0.10.rc1.el6_3.5, bind-chroot 9.8.2-0.10.rc1.el6_3.5 Red Hat Enterprise Linux Server Optional (v. 6) bind 9.8.2-0.10.rc1.el6_3.5, bind-sdb 9.8.2-0.10.rc1.el6_3.5, bind-libs 9.8.2-0.10.rc1.el6_3.5, bind-utils 9.8.2-0.10.rc1.el6_3.5, bind-chroot 9.8.2-0.10.rc1.el6_3.5 Red Hat Enterprise Linux Workstation (v. 6) bind 9.8.2-0.10.rc1.el6_3.5, bind-sdb 9.8.2-0.10.rc1.el6_3.5, bind-libs 9.8.2-0.10.rc1.el6_3.5, bind-utils 9.8.2-0.10.rc1.el6_3.5, bind-chroot 9.8.2-0.10.rc1.el6_3.5 Red Hat Enterprise Linux Workstation Optional (v. 6) bind 9.8.2-0.10.rc1.el6_3.5, bind-sdb 9.8.2-0.10.rc1.el6_3.5, bind-libs 9.8.2-0.10.rc1.el6_3.5, bind-utils 9.8.2-0.10.rc1.el6_3.5, bind-chroot 9.8.2-0.10.rc1.el6_3.5fixed: vendor fix RHSA-2012:1363
+1 more productsfewer
Red Hat RHEL Desktop Workstation (v. 5 client) bind 9.3.6-20.P1.el5_8.5, bind97 9.7.0-10.P2.el5_8.4, bind-sdb 9.3.6-20.P1.el5_8.5, bind-libs 9.3.6-20.P1.el5_8.5, bind-utils 9.3.6-20.P1.el5_8.5, bind-chroot 9.3.6-20.P1.el5_8.5, +4 more
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
32.68% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Classification
- Weakness
-
- CWE-189 Numeric Errors
References
-
ibm.com
/support/docview.wss?uid=isg1IV30365
vendor-advisory
-
ibm.com
/support/docview.wss?uid=isg1IV30185
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2012-1363.html
vendor-advisory
-
slackware.com
/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.536004
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2012-1365.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2012-10/msg00013.html
vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2012-October/090346.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2012-10/msg00011.html
vendor-advisory
-
ibm.com
/support/docview.wss?uid=isg1IV30366
vendor-advisory
-
ibm.com
/support/docview.wss?uid=isg1IV30367
vendor-advisory
-
ibm.com
/support/docview.wss?uid=isg1IV30368
vendor-advisory
-
ibm.com
/support/docview.wss?uid=isg1IV30247
vendor-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2012:162
vendor-advisory
-
lists.apple.com
/archives/security-announce/2013/Sep/msg00002.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2012-1364.html
vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2012-October/090586.html
vendor-advisory
-
debian.org
/security/2012/dsa-2560
vendor-advisory
-
ibm.com
/support/docview.wss?uid=isg1IV30364
vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2012-October/090491.html
vendor-advisory
-
kb.isc.org
/article/AA-00801
vendor-advisory
- oracle.com /technetwork/topics/security/ovmbulletinjul2016-3090546.html
-
secunia.com
/advisories/50909
third-party-advisory
-
secunia.com
/advisories/50956
third-party-advisory
-
osvdb.org
/86118
vdb-entry
-
secunia.com
/advisories/50903
third-party-advisory
-
secunia.com
/advisories/51096
third-party-advisory
-
secunia.com
/advisories/51054
third-party-advisory
-
secunia.com
/advisories/51106
third-party-advisory
-
secunia.com
/advisories/51178
third-party-advisory
- isc.org /software/bind/advisories/cve-2012-5166
-
secunia.com
/advisories/51078
third-party-advisory
- aix.software.ibm.com /aix/efixes/security/bind9_advisory5.asc
- h20564.www2.hpe.com /portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19706
vdb-entry, signature
-
securityfocus.com
/bid/55852
vdb-entry
- blogs.oracle.com /sunsecurity/entry/cve_2012_5166_denial_of
- support.apple.com /kb/HT5880
- xerox.com /download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
Sources
- CVE List CVE-2012-5166
- NVD CVE-2012-5166
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Consolidate version constraints.