CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability

According to cve-security.com, CVE-2015-5477 lets remote attackers trigger a REQUIRE assertion failure and daemon exit through TKEY queries[1] in BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3. The Hacker News describes it as a denial-of-service bug that makes the DNS server exit.[2]BleepingComputer reports that the BIND bug was among eight vulnerabilities that were commonly targeted by the hackers[3] linked to China-based Integrity Technology Group. The FBI also seized seven domains[3] used to run two of the group's hacking tools, the outlet says.The Hacker News reports that the joint advisory marks 5 of the 8 with an asterisk and describes them as newly added[2] to CISA's Known Exploited Vulnerabilities catalog. However, the outlet said they were not in the catalog data that CISA publishes on GitHub (version 2026.10.04)[2] when it checked on October 8. OpenCVE, a separate tracker, still states that this CVE is not in the KEV list.[4]Red Hat said years ago that it has received reports about ongoing exploitation of this vulnerability.[5]