CVE-2018-5740: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 59.6% chance of exploitation in the next 30 days.

"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c. Affects BIND 9.7.0->9.8.8, 9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4, 9.12.0->9.12.2, 9.13.0->9.13.2.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• HP HP-Ux: affected versions not specified
• ISC BIND: from 9.7.0, before 9.8.8 (fixed in 9.8.8); from 9.9.0, before 9.9.13 (fixed in 9.9.13); from 9.10.0, before 9.10.8 (fixed in 9.10.8); from 9.11.0, before 9.11.4 (fixed in 9.11.4); from 9.12.0, before 9.12.2 (fixed in 9.12.2); from 9.13.0, before 9.13.2 (fixed in 9.13.2)
• Netapp Data Ontap Edge: affected versions not specified
• Opensuse Leap: version 15.0 only; version 15.1 only; version 42.3 only
• Red Hat Enterprise Linux Desktop: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Server: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.6 only
• Red Hat Enterprise Linux Server Eus: version 7.5 only; version 7.6 only
• Red Hat Enterprise Linux Workstation: version 6.0 only; version 7.0 only

Published 2019-01-16. Last modified 2026-06-17.