BIND 9 Software Vulnerability Matrix

The BIND 9 Software Vulnerability Matrix details known security vulnerabilities in supported versions of BIND. Vulnerabilities are identified by their CVE ID: Common Vulnerabilities and Exposures.

This page was previously called the "BIND 9 Security Vulnerability Matrix".

Using this matrix

Each row with a CVE ID gives the version(s) that fix that problem.

Determining vulnerability

To determine if/how a given version is vulnerable:

• Find the column heading for the corresponding branch (9.X version)
• Read down that column to find the specific 9.X.Y version (or use "Find" in your browser)

To determine if a given CVE applies:

• Read down the "CVE ID" column to find the CVE ID (or use "Find" in your browser)
• If you do not know the CVE ID, consult the complete list of all BIND advisories

Once you find a given table row (CVE ID and/or version):

• The listed version(s) contain fixes for that CVE, and are not vulnerable to that CVE
• A dash (-) indicates no version of that branch (column) is vulnerable
• Any CVEs listed above that version (later in time) apply (vulnerable)
• Any CVEs listed below that version (earlier in time) do not apply (not vulnerable)

For table rows without a CVE:

• A dash (-) indicates that row does not apply to that branch

Supported Preview Edition

• Most CVEs apply equally to both the open source edition and the Supported Preview Edition (-S).
• If a row lists the -S1 suffix, the CVE applies only to the Supported Preview Edition.
• If no -S1 suffix is present, the CVE applies to both editions.

Other BIND versions

The major branches on this page will always reflect the currently-supported stable branch(es) of BIND. See ISC's Software Support Policy and Version Numbering.

Older branches of BIND are no longer supported, generally do not receive fixes, and may not even be assessed for vulnerability. For historical reference, please see matrices for obsolete branches.

Development, alpha, beta, or release candidate (RC) versions are not listed here. We recommend that you use only stable branches in any environment for which security is a concern.

The matrix

Each row with a CVE ID gives the version(s) that fix that problem.