CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability

The Hacker News describes CVE-2015-5477 as "a reachable assertion vulnerability in ISC BIND"[1] that lets a remote attacker cause a denial of service through TKEY queries.According to the CVE record cited by OpenCVE, named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 is affected, and the daemon exits after a REQUIRE assertion failure.[2] Red Hat said it has received reports about ongoing exploitation of this vulnerability.[3]SC Media reports that the other new entries affect ProFTPD (CVE-2015-3306), ONLYOFFICE Docs (CVE-2021-3199), Strapi (CVE-2023-22894), and Apache Struts (CVE-2016-3081).[4]The Hacker News says the additions coincide with a joint advisory released by Australia, Canada, Japan, New Zealand, Spain, the U.K., and the U.S.[1]SC Media reports that the campaigns involved tools like Microscan and FishHub[4].CISA's Chris Butera told The Hacker News that Chinese government-affiliated actors aim to disrupt "critical functions at a future time of their choosing"[1].According to SC Media, CISA has mandated federal agencies to remediate these vulnerabilities by October 11, 2026, and private organizations are also urged to address them.[4]The analysis site Innovation Network Design reports that ISC patched it in BIND 9.9.7 P2 and 9.10.2 P3[5] in July 2015.