in

the

Qualcomm

Wi-Fi

module

in

Android

before

allows

remote

attackers

to

cause

a

denial

of

service

(framework

crash)

or

possibly

have

unspecified

other

impact

via

an

access

point

that

has

a

malformed

SSID

with

GBK

encoding

aka

Qualcomm

internal

bug

CR


RESTEasy enables GZIPInterceptor which allows remote attackers to cause a denial of service via unspecified vectors.


IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data performing of unauthorized administrative operations and potentially causing a denial of service.


fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls as demonstrated by a loop that triggers exponential growth in the number of mounts.


The

RESOLV::lookup

iRule

command

in

BIG-IP

LTM

APM

ASM

and

Link

Controller

through

before

before

and

before

BIG-IP

AAM

AFM

and

PEM

before

before

and

before

BIG-IP

Analytics

before

before

and

before

BIG-IP

DNS

before

BIG-IP

Edge

Gateway

WebAccelerator

and

WOM

through

and

BIG-IP

GTM

through

before

and

before

and

BIG-IP

PSM

through

and

through

allows

remote

DNS

servers

to

cause

a

denial

of

service

(CPU

consumption

or

Traffic

Management

Microkernel

crash)

via

a

crafted

PTR

response.


Cisco IOS 15.2 through 15.6 and IOS XE 3.6 through 3.17 and 16.1 allow remote attackers to cause a denial of service (device restart) via a malformed IPv6 Protocol Independent Multicast (PIM) register packet aka Bug ID CSCuy16399.


The FTP service in Cisco AsyncOS on Email Security Appliance (ESA) devices 9.6.0-000 through 9.9.6-026 Web Security Appliance (WSA) devices 9.0.0-162 through 9.5.0-444 and Content Security Management Appliance (SMA) devices allows remote attackers to cause a denial of service via a flood of FTP traffic aka Bug IDs CSCuz82907 CSCuz84330 and CSCuz86065.


in

a

Qualcomm

driver

in

Android

before

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

visualizer

data

length

aka

Qualcomm

internal

bug

CR


The sys_thrsigdivert function in kern/kern_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) via a negative \ts.tv_sec\ value.


epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 uses an incorrect integer data type which allows remote attackers to cause a denial of service (large loop) via a crafted packet.


The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3 as used in PHP before 7.0.9 allows remote attackers to cause a denial of service (application crash) via an invalid color index.


The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call.


A denial of service vulnerability in Mediaserver in Android before 2016-11-05 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-31244612. References: NVIDIA N-CVE-2016-6747.


ext/session/session.c in PHP before 5.5.38 5.6.x before 5.6.24 and 7.x before 7.0.9 does not properly maintain a certain hash data structure which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.


A remote denial of service vulnerability in Mediaserver in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-31092462.


Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.1 through 3.9 allow remote attackers to cause a denial of service (device restart) via a crafted IPv4 Multicast Source Discovery Protocol (MSDP) Source-Active (SA) message aka Bug ID CSCud36767.


The \process-execute\ and \process-spawn\ procedures did not free memory correctly when the execve() call failed resulting in a memory leak. This could be abused by an attacker to cause resource exhaustion or a denial of service. This affects all releases of CHICKEN up to and including 4.11 (it will be fixed in 4.12 and 5.0 which are not yet released).


Memory leak in Huawei S9300 S5300 S5700 S6700 S7700 S9700 and S12700 devices allows remote attackers to cause a denial of service (memory consumption and restart) via a large number of malformed packets.


The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564 CHM-TL00C01 before CHM-TL00C01B564 and CHM-TL00C00 before CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application a different vulnerability than CVE-2016-6180 CVE-2016-6181 CVE-2016-6183 and CVE-2016-6184.


The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet which triggers a communication loop.


The rate-limit feature in the 802.11 protocol implementation on Cisco Aironet 1800 2800 and 3800 devices with software before 8.2.121.0 and 8.3.x before 8.3.102.0 allows remote attackers to cause a denial of service (device reload) via crafted 802.11 frames aka Bug ID CSCva06192.


The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.


SQL injection vulnerability in SAP Business Intelligence platform before January 2017 allows remote attackers to obtain sensitive information modify data cause a denial of service (data deletion) or launch administrative operations or possibly OS commands via a crafted SQL query. The vendor response is SAP Security Note 2361633.


NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server crash) via a zone transfer with unlimited data.


The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the descriptor buffer.


The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length.


The Data in Motion (DMo) application in Cisco IOS 15.6(1)T and IOS XE when the IOx feature set is enabled allows remote attackers to cause a denial of service via a crafted packet aka Bug IDs CSCuy82904 CSCuy82909 and CSCuy82912.


A denial of service vulnerability in the Input Manager Service in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a local malicious application to cause the device to continually reboot. This issue is rated as Moderate because it is a temporary denial of service that requires a factory reset to fix. Android ID: A-30568284.


epan/dissectors/packet-packetbb.c in the PacketBB dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted packet.


The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (free of unallocated memory) via a crafted X.509 certificate.


Cisco AsyncOS through 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many HTTP requests for overlapping byte ranges simultaneously aka Bug ID CSCuz27219.


The AAA service in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.1 through 3.18 and 16.2 allows remote attackers to cause a denial of service (device reload) via a failed SSH connection attempt that is mishandled during generation of an error-log message aka Bug ID CSCuy87667.


The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564 CHM-TL00C01 before CHM-TL00C01B564 and CHM-TL00C00 before CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application a different vulnerability than CVE-2016-6180 CVE-2016-6181 CVE-2016-6182 and CVE-2016-6184.


The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy which allows local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option.


A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593765.


The build_huffcodes function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause denial of service (out-of-bounds write) via a crafted jpeg file.


PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.


ext/snmp/snmp.c in PHP before 5.5.38 5.6.x before 5.6.24 and 7.x before 7.0.9 improperly interacts with the unserialize implementation and garbage collection which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data a related issue to CVE-2016-5773.


fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing which allows local users to cause a denial of service (system crash) via a rename system call that specifies a self-hardlink.


A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4. Android ID: A-31833604.


Huawei AC6003 AC6005 AC6605 and ACU2 access controllers with software before V200R006C10SPC200 allows remote authenticated users to cause a denial of service (device restart) via crafted CAPWAP packets.


The sound driver in the kernel in Android before 2016-10-05 on Nexus 5 Nexus 5X Nexus 6 Nexus 6P and Nexus Player devices allows attackers to cause a denial of service (reboot) via a crafted application aka internal bug 28838221.


The pstm_reverse function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid memory read and crash) via a (1) zero value or (2) the key's modulus for the secret key during RSA key exchange.


The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.


The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read.c in libtiff before 4.0.7 allows remote attackers to cause a denial of service (crash) or possibly obtain sensitive information via a negative index in a file-content buffer.


The Adaptive Wireless Intrusion Prevention System (wIPS) feature on Cisco Wireless LAN Controller (WLC) devices before 8.0.140.0 8.1.x and 8.2.x before 8.2.121.0 and 8.3.x before 8.3.102.0 allows remote attackers to cause a denial of service (device restart) via a malformed wIPS packet aka Bug ID CSCuz40263.


Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery which allows local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check.


in

a

Qualcomm

driver

in

Android

before

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

crafted

parameter

data

aka

Qualcomm

internal

bug

CR


OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a large size in a getdents system call.


A denial of service vulnerability in Telephony could enable a local malicious application to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of local permanent denial of service. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0. Android ID: A-31530456.


epan/dissectors/packet-ldss.c in the LDSS dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 mishandles conversations which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop stack overflow and crash) via a cycle in the references of remembered mangled types.


os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm which might allow local users to obtain sensitive information cause a denial of service (application crash) or have unspecified other impact by leveraging use of the current working directory for temporary files.


net/core/skbuff.c in the Linux kernel 4.7-rc6 allows local users to cause a denial of service (panic) or possibly have unspecified other impact via certain IPv6 socket operations.


epan/proto.c in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a denial of service (OpenFlow dissector large loop) via a crafted packet.


statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length which might allow remote attackers to cause a denial of service (memory consumption) via crafted DTLS messages.


Cisco Carrier Routing System (CRS) 5.1 and 5.1.4 as used in CRS Carrier Grade Services for CRS-1 and CRS-3 devices allows remote attackers to cause a denial of service (line-card reload) via crafted IPv6-over-MPLS packets aka Bug ID CSCva32494.


Arista EOS 4.15 before 4.15.8M 4.16 before 4.16.7M and 4.17 before 4.17.0F on DCS-7050 series devices allow remote attackers to cause a denial of service (device reboot) by sending crafted packets to the control plane.


epan/dissectors/packet-mmse.c in the MMSE dissector in Wireshark 1.12.x before 1.12.13 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


Format string vulnerability in Huawei AR100 AR120 AR150 AR200 AR500 AR550 AR1200 AR2200 AR2500 AR3200 and AR3600 routers with software before V200R007C00SPC900 and NetEngine 16EX routers with software before V200R007C00SPC900 allows remote authenticated users to cause a denial of service via format string specifiers in vectors involving partial commands.


Cisco IOS 12.2 and 15.0 through 15.3 allows remote attackers to cause a denial of service (traffic-processing outage) via a crafted series of Common Industrial Protocol (CIP) requests aka Bug ID CSCur69036.


Cisco IOS XE 3.1 through 3.17 and 16.1 through 16.2 allows remote attackers to cause a denial of service (device reload) via crafted ICMP packets that require NAT aka Bug ID CSCuw85853.


The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length which allows remote attackers to cause a denial of service via a ticket that is too short.


The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564 CHM-TL00C01 before CHM-TL00C01B564 and CHM-TL00C00 before CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application a different vulnerability than CVE-2016-6180 CVE-2016-6182 CVE-2016-6183 and CVE-2016-6184.


A remote denial of service vulnerability in Mediaserver in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30822755.


The CORBA IDL dissectors in Wireshark 2.x before 2.0.5 on 64-bit Windows platforms do not properly interact with Visual C++ compiler options which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


ISC BIND through 9.9.9-P1 9.10.x through 9.10.4-P1 and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.


The setup_imginfo_jpg function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause a denial of service (segmentation fault) via a crafted jpeg file.


The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.


A denial of service vulnerability in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 7.0. Android ID: A-31449945.


The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large size value.


thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a crafted value in the tsp parameter of the __thrsleep system call.


Huawei AnyMail before 2.6.0301.0060 allows remote attackers to cause a denial of service (application crash) via a crafted compressed email attachment.


drivers/video/msm/mdss/mdss_mdp_pp.c in the Qualcomm MDSS driver in Android before 2016-10-05 allows attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via unknown vectors aka Qualcomm internal bug CR 1004933.


The Data in Motion (DMo) component in Cisco IOS 15.6(1)T and IOS XE when the IOx feature set is enabled allows remote attackers to cause a denial of service (out-of-bounds access) via crafted traffic aka Bug ID CSCuy54015.


The SpamCall Activity component in Telecom application on Samsung Note device L(5.0/5.1) and M(6.0) allows attackers to cause a denial of service (crash and reboot) or possibly gain privileges via a malformed serializable object.


OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode on the mnt_vnodelist.


The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms which might allow context-dependent attackers to cause a denial of service (hang) as demonstrated by applications compiled using gccgo related to backtrace generation.


Cisco IOS 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.18 and 16.1 allow remote attackers to cause a denial of service (memory consumption or device reload) via fragmented IKEv1 packets aka Bug ID CSCuy47382.


in

a

Qualcomm

driver

in

Android

before

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

large

negative

value

for

the

data

length

aka

Qualcomm

internal

bug

CR


The DHCP Relay implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4.7.29 and 9.1.7.4 allows remote attackers to cause a denial of service (interface wedge) via a crafted rate of DHCP packet transmission aka Bug ID CSCuy66942.


The mod_dontdothat component of the mod_dav_svn Apache module in Subversion as packaged in Red Hat Enterprise Linux 5.11 does not properly detect recursion during entity expansion which allows remote authenticated users with access to the webdav repository to cause a denial of service (memory consumption and httpd crash). NOTE: Exists as a regression to CVE-2009-1955.


Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service (device reload) via crafted (1) SSL or (2) TLS packets aka Bug ID CSCvb16317.


XML external entity (XXE) vulnerability in the Hyper Management Module (HMM) in Huawei E9000 rack servers with software before V100R001C00SPC296 allows remote authenticated users to read arbitrary files or cause a denial of service (web service outage) via a crafted XML document.


epan/dissectors/packet-wbxml.c in the WBXML dissector in Wireshark 2.x before 2.0.5 does not restrict the recursion depth which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service (segmentation fault) via a large frame a related issue to CVE-2017-14266.


Cisco IOS XR 5.2.2 allows remote attackers to cause a denial of service (process restart) via a crafted OSPF Link State Advertisement (LSA) update aka Bug ID CSCvb05643.


The lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) before 2015 SP5 and 2016 before R1 SP1 as used by Citrix License Server for Windows before 11.14.0.1 and Citrix License Server VPX before 11.14.0.1 allows remote attackers to cause a denial of service (crash) via a type 2F packet with a '01 19' opcode.


A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0. Android ID: A-31681434.


OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (assertion failure and kernel panic) via a large ident value in a kevent system call.


The pstm_exptmod function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid free and crash) via a base zero value for the modular exponentiation.


in

a

Qualcomm

driver

in

Android

before

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

an

invalid

data

length

aka

Qualcomm

internal

bug

CR


Cisco IOS 12.2 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.17 and 16.2 allow remote attackers to cause a denial of service (device reload) via crafted fields in an H.323 message aka Bug ID CSCux04257.


The SmartCall Activity component in Telecom application on Samsung Note device L(5.0/5.1) and M(6.0) allows attackers to cause a denial of service (crash and reboot) or possibly gain privileges via a malformed serializable object.


Cisco Wireless LAN Controller (WLC) devices before 8.0.140.0 8.1.x and 8.2.x before 8.2.121.0 and 8.3.x before 8.3.102.0 allow remote attackers to cause a denial of service (device reload) by sending crafted Inter-Access Point Protocol (IAPP) packets and then sending a traffic stream metrics (TSM) information request over SNMP aka Bug ID CSCuz40221.


OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service (kernel panic) by mounting a tmpfs with a VNOVAL in the (1) username (2) groupname or (3) device name of the root node.


The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause an infinite loop denial of service via a crafted SWF file.


The DNS forwarder in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.15 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (data corruption or device reload) via a crafted DNS response aka Bug ID CSCup90532.


The WiFi driver in Huawei Honor 6 smartphones with software H60-L01 before H60-L01C00B850 H60-L11 before H60-L11C00B850 H60-L21 before H60-L21C00B850 H60-L02 before H60-L02C00B850 H60-L12 before H60-L12C00B850 and H60-L03 before H60-L03C01B850 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application.


A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack specifically a so-called \HPACK Bomb\ attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4 096 or better meaning that 16kB of data can decompress to 64MB of data on the target machine.


Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment related to temporary files.


epan/dissectors/packet-wap.c in Wireshark 2.x before 2.0.5 omits an overflow check in the tvb_get_guintvar function which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet related to the MMSE WAP WBXML and WSP dissectors.


The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length which might allow remote attackers to cause a denial of service (memory consumption) via crafted TLS messages related to statem/statem.c and statem/statem_lib.c.


The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564 CHM-TL00C01 before CHM-TL00C01B564 and CHM-TL00C00 before CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application a different vulnerability than CVE-2016-6180 CVE-2016-6181 CVE-2016-6182 and CVE-2016-6183.


epan/dissectors/packet-wsp.c in the WSP dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


Eye of GNOME (aka eog) 3.16.5 3.17.x 3.18.x before 3.18.3 3.19.x and 3.20.x before 3.20.4 when used with glib before 2.44.1 allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.


** DISPUTED ** The SwarmKit toolkit 1.12.0 for Docker allows remote authenticated users to cause a denial of service (prevention of cluster joins) via a long sequence of join and quit actions. NOTE: the vendor disputes this issue stating that this sequence is not \removing the state that is left by old nodes. At some point the manager obviously stops being able to accept new nodes since it runs out of memory. Given that both for Docker swarm and for Docker Swarmkit nodes are *required* to provide a secret token (it's actually the only mode of operation) this means that no adversary can simply join nodes and exhaust manager resources. We can't do anything about a manager running out of memory and not being able to add new legitimate nodes to the system. This is merely a resource provisioning issue and definitely not a CVE worthy vulnerability.\


The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613; RH2288 V3 servers with software before V100R003C00SPC617; RH2288H V3 servers with software before V100R003C00SPC515; RH5885 V3 servers with software before V100R003C10SPC102; and XH620 V3 XH622 V3 and XH628 V3 servers with software before V100R003C00SPC610 allows local users to cause a denial of service (iBMC resource consumption) via unspecified vectors.


Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active.


Cisco IOS 12.2 and IOS XE 3.14 through 3.16 and 16.1 allow remote attackers to cause a denial of service (device reload) via crafted IP Detail Record (IPDR) packets aka Bug ID CSCuu35089.


The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564 CHM-TL00C01 before CHM-TL00C01B564 and CHM-TL00C00 before CHM-TL00HC00B564 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application a different vulnerability than CVE-2016-6181 CVE-2016-6182 CVE-2016-6183 and CVE-2016-6184.


A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593752.


The Aggregated MAC Protocol Data Unit (AMPDU) implementation on Cisco Aironet 1800 2800 and 3800 devices with software before 8.2.121.0 and 8.3.x before 8.3.102.0 allows remote attackers to cause a denial of service (device reload) via a crafted AMPDU header aka Bug ID CSCuz56288.


Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash) via a large zone transfer for (1) DDNS (2) AXFR or (3) IXFR.


A denial of service vulnerability in Proxy Auto Config in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as Moderate because it requires an uncommon device configuration. Android ID: A-30100884.


The process_file function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause a denial of service (crash) via a crafted jpeg file.


The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink which allows local users to cause a denial of service (system crash) via a rename system call related to fs/namei.c and fs/open.c.


epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.3 does not ensure that data is available before array allocation which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The File Bookmark component in Apple OS X before 10.12 mishandles scoped-bookmark file descriptors which allows attackers to cause a denial of service via a crafted app.


epan/dissectors/packet-spice.c in the SPICE dissector in Wireshark 2.x before 2.0.2 mishandles capability data which allows remote attackers to cause a denial of service (large loop) via a crafted packet.


The read_binary function in buffer.c in pgpdump before 0.30 allows context-dependent attackers to cause a denial of service (infinite loop and CPU consumption) via crafted input as demonstrated by the \\xa3\\x03 string.


The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8 when used without the ASN1_DECODE_FLAG_STRICT_DER flag allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate.


The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.


The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface.


QEMU (aka Quick Emulator) when built with VMWARE PVSCSI paravirtual SCSI bus emulation support allows local guest OS administrators to cause a denial of service (out-of-bounds array access) via vectors related to the (1) PVSCSI_CMD_SETUP_RINGS or (2) PVSCSI_CMD_SETUP_MSG_RING SCSI command.


SetsucoCMS all versions allows remote attackers to cause a denial of service via unspecified vectors.


epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 2.0.x before 2.0.3 does not properly initialize memory for search patterns which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.


HPE Release Control (RC) 9.13 9.20 and 9.21 before 9.21.0005 p4 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks and consequently obtain sensitive information or cause a denial of service via unspecified vectors.


The NFS dissector in Wireshark 2.x before 2.0.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Foxit Reader and PhantomPDF before 7.3.4 on Windows improperly report format errors recursively which allows remote attackers to cause a denial of service (application hang) via a crafted PDF.


Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to cause a denial of service.


wpa_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters which allows local users to trigger arbitrary library loading and consequently gain privileges or cause a denial of service (daemon outage) via a crafted (1) SET (2) SET_CRED or (3) SET_NETWORK command.


The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted application on (1) a system with more than 32 Gb of memory related to the program reference count or (2) a 1 Tb system related to the map reference count.


The mxml_write_node function in mxml-file.c in mxml 2.9 2.7 and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file.


Huawei FusionCompute before V100R005C10SPC700 allows remote authenticated users to cause a denial of service (resource consumption) via a large number of crafted packets.


XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files cause a denial of service conduct server-side request forgery (SSRF) attacks or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp. NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials.


Multiple unspecified vulnerabilities in HPE Integrated Lights-Out 3 (aka iLO 3) firmware before 1.88 Integrated Lights-Out 4 (aka iLO 4) firmware before 2.44 and Integrated Lights-Out 4 (aka iLO 4) mRCA firmware before 2.32 allow remote attackers to obtain sensitive information modify data or cause a denial of service via unknown vectors.


Virtual servers in F5 BIG-IP 11.5.4 when SSL profiles are enabled allow remote attackers to cause a denial of service (resource consumption and Traffic Management Microkernel restart) via an SSL alert during the handshake.


epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (deep recursion stack consumption and application crash) via a packet that specifies deeply nested data.


HPE Performance Center before 12.50 and LoadRunner before 12.50 allow remote attackers to cause a denial of service via unspecified vectors.


The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file involving xmlParseName.


in

the

Linux

kernel

before

allows

local

users

to

cause

a

denial

of

service

(kernel

memory

write

operation)

or

possibly

have

unspecified

other

impact

via

a

crafted

number

of

planes

in

a

ioctl

call.


hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters in passphrase parameters which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.


Corega CG-WLBARAGM devices allow remote attackers to cause a denial of service (reboot) via unspecified vectors.


The mxmlDelete function in mxml-node.c in mxml 2.9 2.7 and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file.


XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service.


Login Window in Apple OS X before 10.11.6 does not properly initialize memory which allows local users to cause a denial of service via unspecified vectors.


epan/dissectors/packet-gsm_cbch.c in the GSM CBCH dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses the wrong variable to index an array which allows remote attackers to cause a denial of service (out-of-bounds access and application crash) via a crafted packet.


The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35 5.6.x before 5.6.21 and 7.x before 7.0.6 accepts a negative integer for the scale argument which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.


The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.


A denial of service vulnerability exists in the IOCTL handling functionality of Kaspersky Internet Security KL1 driver. A specially crafted IOCTL signal can cause an access violation in KL1 kernel driver resulting in local system denial of service. An attacker can run a program from user-mode to trigger this vulnerability.


client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.


The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore.


ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time.


HPE

LoadRunner

through

patch

through

patch

through

patch

through

patch

and

through

patch

and

Performance

Center

through

patch

through

patch

through

patch

through

patch

and

through

patch

allow

remote

attackers

to

cause

a

denial

of

service

via

unspecified

vectors.


Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections which allows remote attackers to reconfigure the device or cause a denial of service via a (1) stop application program (2) change value or (3) modify application command.


The Enqueue Server in SAP NetWeaver JAVA AS 7.1 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted request aka SAP Security Note 2258784.


epan/reassemble.c in TShark in Wireshark 2.0.x before 2.0.3 relies on incorrect special-case handling of truncated Tvb data structures which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet.


The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document.


Panasonic FPWIN Pro 5.x through 7.x before 7.130 allows local users to cause a denial of service or possibly have unspecified other impact via vectors that leverage \type confusion.\


An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write blobs or cause a denial of service attack on the Director VM. This vulnerability requires that the unauthenticated clients guess or find a URL matching an existing GUID.


The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.


Divide-by-zero vulnerability in the opj_tcd_init_tile function in tcd.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (application crash) via a crafted jp2 file. NOTE: this issue exists because of an incorrect fix for CVE-2014-7947.


The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors involving an SCSI command.


epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not verify BER identifiers which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) via a crafted packet.


handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).


Samsung devices with Android KK(4.4) L(5.0/5.1) or M(6.0) allow attackers to cause a denial of service (system crash) via a crafted system call to TvoutService_C.


The

attemptAuthentication

function

in

in

Symfony

before

before

before

and

before

does

not

limit

the

length

of

a

username

stored

in

a

session

which

allows

remote

attackers

to

cause

a

denial

of

service

(session

storage

consumption)

via

a

series

of

authentication

attempts

with

long

non-existent

usernames.


Foxit Reader and PhantomPDF before 7.3.4 on Windows allow remote attackers to cause a denial of service (application crash) via a crafted content stream.


The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35 5.6.x before 5.6.21 and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in the second argument leading to a parser level of zero.


The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure which allows local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions that reference an incorrect file descriptor.


A denial of service vulnerability exists in the syscall filtering functionality of Kaspersky Internet Security KLIF driver. A specially crafted native api call can cause a access violation in KLIF kernel driver resulting in local denial of service. An attacker can run program from user-mode to trigger this vulnerability.


XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4 when not in validating mode allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.


The Data Provisioning Agent (aka DP Agent) in SAP HANA allows remote attackers to cause a denial of service (process crash) via unspecified vectors aka SAP Security Note 2262710.


ntpd in NTP 4.x before 4.2.8p8 when autokey is enabled allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.


OSIsoft PI AF Server before 2016 2.8.0 allows remote authenticated users to cause a denial of service (service outage) via a message.


The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption or QEMU process crash) via vectors involving s->state.


Pulse Connect Secure (PCS) 8.2 before 8.2r1 8.1 before 8.1r3 8.0 before 8.0r11 and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.


epan/dissectors/packet-iax2.c in the IAX2 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses an incorrect integer data type which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


For the NVIDIA Quadro NVS and GeForce products improper sanitization of parameters in the NVStreamKMS.sys API layer caused a denial of service vulnerability (blue screen crash) within the NVIDIA Windows graphics drivers.


A denial of service vulnerability exists in the syscall filtering functionality of the Kaspersky Internet Security KLIF driver. A specially crafted native api call request can cause a access violation exception in KLIF kernel driver resulting in local denial of service. An attacker can run program from user-mode to trigger this vulnerability.


OSIsoft PI SQL Data Access Server (aka OLE DB) 2016 1.5 allows remote authenticated users to cause a denial of service (service outage and data loss) via a message.


A local denial of service vulnerability exists in window broadcast message handling functionality of Kaspersky Anti-Virus software. Sending certain unhandled window messages an attacker can cause application termination and in the same way bypass KAV self-protection mechanism.


ber-decoder.c in Libksba before 1.3.3 does not properly handle decoder stack overflows which allows remote attackers to cause a denial of service (abort) via crafted BER data.


YoruFukurou (NightOwl) before 2.85 relies on support for emoji skin-tone modifiers even though this support is missing from the CoreText CTFramesetter API on OS X 10.9 which allows remote attackers to cause a denial of service (application crash) via a crafted emoji character sequence.


The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.


The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario as demonstrated by triggering an incorrect leap indication.


The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.


The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet.


Panasonic FPWIN Pro 5.x through 7.x before 7.130 accesses an uninitialized pointer which allows local users to cause a denial of service or possibly have unspecified other impact via unknown vectors.


An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the \ntfs\ component which misparses disk images and allows attackers to cause a denial of service via a crafted app.


The IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not properly restrict element lists which allows remote attackers to cause a denial of service (deep recursion and application crash) via a crafted packet related to epan/dissectors/packet-capwap.c and epan/dissectors/packet-ieee80211.c.


Samsung devices with Android KK(4.4) or L(5.0/5.1) allow local users to cause a denial of service (IAndroidShm service crash) via crafted data in a service call.


Application Firewall in Apple OS X before 10.12 allows local users to cause a denial of service via vectors involving a crafted SO_EXECPATH environment variable.


The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list a related issue to CVE-2015-8558.


epan/proto.c in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not limit the protocol-tree depth which allows remote attackers to cause a denial of service (stack memory consumption and application crash) via a crafted packet.


The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.


The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.


The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35 5.6.x before 5.6.21 and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the _zero_ _one_ or _two_ global variable which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.


epan/dissectors/packet-dcerpc-spoolss.c in the SPOOLS component in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles unexpected offsets which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


The igdkmd64 module in the Intel Graphics Driver through 15.33.42.435 15.36.x through 15.36.30.4385 and 15.40.x through 15.40.4404 on Windows allows local users to cause a denial of service (crash) or gain privileges via a crafted D3DKMTEscape request.


in

Blink

as

used

in

Google

Chrome

before

does

not

prevent

certain

constructor

calls

which

allows

remote

attackers

to

cause

a

denial

of

service

(use-after-free)

or

possibly

have

unspecified

other

impact

via

crafted

JavaScript

code.


Virtual servers in F5 BIG-IP systems 11.6.1 before 11.6.1 HF1 and 12.1.x before 12.1.2 when configured to parse RADIUS messages via an iRule allow remote attackers to cause a denial of service (Traffic Management Microkernel restart) via crafted network traffic.


programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol but has a required security update from the libreswan vendor; as of 2016-06-10 it is expected that several other IKEv1 implementations will have vendor-required security updates with separate CVE IDs assigned to each.


Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.


The dwarf_get_aranges_list function in libdwarf before 20160923 allows remote attackers to cause a denial of service (infinite loop and crash) via a crafted DWARF section.


The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.


The USB subsystem in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles class types which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


epan/dissectors/packet-pktap.c in the Ethernet dissector in Wireshark 2.x before 2.0.4 mishandles the packet-header data type which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The icalproperty_new_clone function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file.


The

EditingStyle::mergeStyle

function

in

in

Blink

as

used

in

Google

Chrome

before

on

Windows

and

OS

X

and

before

on

Linux

mishandles

custom

properties

which

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

web

site

that

leverages

\type

confusion\

in

the

StylePropertySerializer

class.


dwarf_elf_access.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file related to relocation records.


in

Blink

as

used

in

Google

Chrome

before

on

Windows

and

OS

X

and

before

on

Linux

has

an

Indexed

Database

(aka

IndexedDB)

API

implementation

that

does

not

properly

restrict

key-path

evaluation

which

allows

remote

attackers

to

cause

a

denial

of

service

(use-after-free)

or

possibly

have

unspecified

other

impact

via

crafted

JavaScript

code

that

leverages

certain

side

effects.


The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function.


The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode.


Use-after-free

vulnerability

in

in

the

Extensions

subsystem

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

related

to

script

deletion.


js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter.


Siemens SIMATIC NET PC-Software before 13 SP2 allows remote attackers to cause a denial of service (OPC UA service outage) via crafted TCP packets.


SAP SAPCAR does not check the return value of file operations when extracting files which allows remote attackers to cause a denial of service (program crash) via an invalid file name in an archive file aka SAP Security Note 2312905.


Huawei Oceanstor 5800 before V300R002C10SPC100 allows remote attackers to cause a denial of service (CPU consumption) via a large number of crafted HTTP packets.


Memory leak in Huawei AR3200 before V200R007C00SPC900 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted Multiprotocol Label Switching (MPLS) packets.


The _TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted Tiff image.


The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.


PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux mishandles timers which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted PDF document related to fpdfsdk/javascript/JS_Object.cpp and fpdfsdk/javascript/app.cpp.


The parser_get_next_char function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function.


The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support allows local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command.


NetApp OnCommand System Manager 8.3.x before 8.3.2P5 allows remote authenticated users to cause a denial of service via unspecified vectors.


epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles the lack of an EAPOL_RSN_KEY which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


in

Blink

as

used

in

Google

Chrome

before

does

not

properly

consider

getter

side

effects

during

array

key

conversion

which

allows

remote

attackers

to

cause

a

denial

of

service

(use-after-free)

or

possibly

have

unspecified

other

impact

via

crafted

Indexed

Database

(aka

IndexedDB)

API

calls.


For the NVIDIA Quadro NVS and GeForce products improper sanitization of parameters in the NVAPI support layer causes a denial of service vulnerability (blue screen crash) within the NVIDIA Windows graphics drivers.


The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.


gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0 as used in certain custom PHP 5.5.x configurations allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.


Use-after-free

vulnerability

in

in

Blink

as

used

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

crafted

JavaScript

code

involving

an

@import

at-rule

in

a

Cascading

Style

Sheets

(CSS)

token

sequence

in

conjunction

with

a

rel=import

attribute

of

a

LINK

element.


wiretap/toshiba.c in the Toshiba file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing which allows remote attackers to cause a denial of service (application crash) via a crafted file.


in

Google

Chrome

before

does

not

process

fullscreen

toggle

requests

during

a

fullscreen

transition

which

allows

remote

attackers

to

cause

a

denial

of

service

(unsuppressed

popup)

via

a

crafted

web

site.


PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.


The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafted tiff image.


Memory leak in the __res_vinit function in the IPv6 name server management code in libresolv in GNU C Library (aka glibc or libc6) before 2.24 allows remote attackers to cause a denial of service (memory consumption) by leveraging partial initialization of internal resolver data structures.


The Web Animations implementation in Blink as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux improperly relies on list iteration which allows remote attackers to cause a denial of service (use-after-destruction) or possibly have unspecified other impact via a crafted web site.


magick/render.c in GraphicsMagick before 1.3.24 allows remote attackers to cause a denial of service (arithmetic exception and application crash) via a crafted svg file.


IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


The XML parser in Expat does not use sufficient entropy for hash initialization which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.


IBM

WebSphere

Portal

through

through

through

through

and

before

allows

remote

authenticated

users

to

cause

a

denial

of

service

by

uploading

temporary

files.


epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles the reserved C/T value which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.


The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state which allows local users to cause a denial of service (invalid process state or TM Bad Thing exception and system crash) or possibly have unspecified other impact by starting and suspending a transaction before an exec system call.


dwarf_form.c in libdwarf 20160115 allows remote attackers to cause a denial of service (crash) via a crafted elf file.


The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.


Virtual servers in F5 BIG-IP systems 11.2.1 HF11 through HF15 11.4.1 HF4 through HF10 11.5.3 through 11.5.4 11.6.0 HF5 through HF7 and 12.0.0 when configured with a TCP profile allow remote attackers to cause a denial of service (Traffic Management Microkernel restart) via crafted network traffic.


wiretap/netscreen.c in the NetScreen file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing which allows remote attackers to cause a denial of service (application crash) via a crafted file.


The parse_chunk_header function in libtorrent before 1.1.1 allows remote attackers to cause a denial of service (crash) via a crafted (1) HTTP response or possibly a (2) UPnP broadcast.


The WRITE_UNALIGNED function in dwarf_elf_access.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted DWARF section.


epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length values which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.


The Web Cryptography API (aka WebCrypto) implementation in Blink as used in Google Chrome before 52.0.2743.116 does not properly copy data buffers which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp.


BIG-IP

LTM

Analytics

APM

ASM

and

Link

Controller

before

before

before

and

before

BIG-IP

AAM

AFM

and

PEM

before

before

and

before

BIG-IP

DNS

before

BIG-IP

Edge

Gateway

WebAccelerator

and

WOM

before

and

BIG-IP

GTM

before

before

and

before

BIG-IP

PSM

before

and

through

Enterprise

Manager

BIG-IQ

Cloud

and

Security

through

BIG-IQ

Device

through

BIG-IQ

ADC

BIG-IQ

Centralized

Management

BIG-IQ

Cloud

and

Orchestration

and

iWorkflow

when

Packet

Filtering

is

enabled

on

virtual

servers

and

possibly

self

IP

addresses

allow

remote

attackers

to

cause

a

denial

of

service

(Traffic

Management

Microkernel

restart)

and

possibly

have

unspecified

other

impact

via

crafted

network

traffic.


wiretap/cosine.c in the CoSine file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing which allows remote attackers to cause a denial of service (application crash) via a crafted file.


PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels which allows remote attackers to cause a denial of service (backend CPU consumption) via a crafted DNS query.


The DrawDashPolygon function in magick/render.c in GraphicsMagick before 1.3.24 and the SVG renderer in ImageMagick allow remote attackers to cause a denial of service (infinite loop) by converting a circularly defined SVG file.


arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms when CONFIG_KVM_BOOK3S_64_HV is enabled allows guest OS users to cause a denial of service (host OS infinite loop) by making a H_CEDE hypercall during the existence of a suspended transaction.


The icalparser_parse_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted ics file.


The dwarf_get_xu_hash_entry function in libdwarf before 20160923 allows remote attackers to cause a denial of service (crash) via a crafted file.


extensions/renderer/event_bindings.cc in the event bindings in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux attempts to process filtered events after failure to add an event matcher which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.


Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.


Cisco IOS 15.2(4)E on Industrial Ethernet 2000 devices allows remote attackers to cause a denial of service (device reload) via crafted Cisco Discovery Protocol (CDP) packets aka Bug ID CSCuy27746.


The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome before 52.0.2743.82 does not properly consider object lifetimes during progress observation which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site.


Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG as used in PDFium in Google Chrome before 49.0.2623.87 allow remote attackers to cause a denial of service (incorrect cast and out-of-bounds write) or possibly have unspecified other impact via crafted JPEG 2000 data.


goform/WClientMACList on Cisco EPC3928 devices allows remote attackers to cause a denial of service (device crash) via a long h_sortWireless parameter related to a \Gateway Client List Denial of Service\ issue aka Bug ID CSCux24948.


The Active Directory (AD) integration component in Cisco Identity Service Engine (ISE) before 1.2.0.899 patch 7 when AD group-membership authorization is enabled allows remote attackers to cause a denial of service (authentication outage) via a crafted Password Authentication Protocol (PAP) authentication request aka Bug ID CSCun25815.


Cisco IOS 15.5(3)S3 15.6(1)S2 15.6(2)S1 and 15.6(2)T1 does not properly dequeue invalid NTP packets which allows remote attackers to cause a denial of service (interface wedge) by sending many crafted NTP packets aka Bug ID CSCva35619.


Cisco IOS XR 6.0 and 6.0.1 on NCS 6000 devices allows remote attackers to cause a denial of service (OSPFv3 process reload) via crafted OSPFv3 packets aka Bug ID CSCuz66289.


The HTTPS Proxy feature in Cisco AsyncOS before 8.5.3-051 and 9.x before 9.0.0-485 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (service outage) by leveraging certain intranet connectivity and sending a malformed HTTPS request aka Bug ID CSCuu24840.


The LoadIC::UpdateCaches function in ic/ic.cc in Google V8 as used in Google Chrome before 48.0.2564.82 does not ensure receiver compatibility before performing a cast of an unspecified variable which allows remote attackers to cause a denial of service or possibly have unknown other impact via crafted JavaScript code.


The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 allows remote attackers to cause a denial of service (device reload) via crafted DHCPv6 packets aka Bug ID CSCus23248.


Use-after-free

vulnerability

in

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

by

triggering

an

image

download

after

a

certain

data

structure

is

deleted

as

demonstrated

by

a

favicon.ico

download.


Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21 as used in Mozilla Firefox before 44.0 allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.


dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to the option length.


The nsZipArchive function in Mozilla Firefox before 44.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect use of a pointer during processing of a ZIP archive.


Cisco AsyncOS before 8.5.3-069 and 8.6 through 8.8 on Web Security Appliance (WSA) devices mishandles memory allocation for HTTP requests which allows remote attackers to cause a denial of service (proxy-process reload) via a crafted request aka Bug ID CSCuu02529.


rdataset.c in ISC BIND 9 Supported Preview Edition 9.9.8-S before 9.9.8-S5 when nxdomain-redirect is enabled allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via crafted flag values in a query.


Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted extension.


in

Google

Chrome

before

does

not

consider

side

effects

during

creation

of

an

array

of

extension

views

which

allows

remote

attackers

to

cause

a

denial

of

service

(use-after-free)

or

possibly

have

unspecified

other

impact

via

vectors

related

to

extensions.


The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames leading to recursive pagefault handling.


Cisco IOS 12.4 and 15.0 through 15.5 and IOS XE 3.13 through 3.17 allow remote authenticated users to cause a denial of service (device reload) via crafted attributes in a BGP message aka Bug ID CSCuz21061.


The REST interface in Cisco Spark 2015-06 allows remote attackers to cause a denial of service (resource outage) by accessing an administrative page aka Bug ID CSCuv84125.


Blink as used in Google Chrome before 50.0.2661.94 mishandles assertions in the WTF::BitArray and WTF::double_conversion::Vector classes which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted web site.


Embedthis Appweb as used in J-Web in Juniper Junos OS before 12.1X44-D60 12.1X46 before 12.1X46-D45 12.1X47 before 12.1X47-D30 12.3 before 12.3R10 12.3X48 before 12.3X48-D20 13.2X51 before 13.2X51-D20 13.3 before 13.3R8 14.1 before 14.1R6 and 14.2 before 14.2R5 allows remote attackers to cause a denial of service (J-Web crash) via unspecified vectors.


ownCloud Server before 8.0.10 8.1.x before 8.1.5 and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service (CPU consumption) via the force parameter to index.php/apps/files/ajax/scan.php.


The kernel in Cisco TelePresence Server 3.0 through 4.2(4.18) on Mobility Services Engine (MSE) 8710 devices allows remote attackers to cause a denial of service (panic and reboot) via a crafted sequence of IPv6 packets aka Bug ID CSCuu46673.


Juniper

Junos

OS

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before

allow

remote

attackers

to

cause

a

denial

of

service

(socket

consumption)

via

crafted

TCP

timestamps.


Juniper Junos OS 14.1X53 before 14.1X53-D30 on QFX Series switches allows remote attackers to cause a denial of service (PFE panic) via a high rate of unspecified VXLAN packets.


Cisco IOS XR 5.x through 5.2.5 on NCS 6000 devices allows remote attackers to cause a denial of service (timer consumption and Route Processor reload) via crafted SSH traffic aka Bug ID CSCux76819.


FreeBSD 9.3 before p33 10.1 before p26 and 10.2 before p9 allow remote attackers to cause a denial of service (kernel crash) via vectors related to creating a TCP connection with the TCP_MD5SIG and TCP_NOOPT socket options.


named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface related to alist.c and sexpr.c.


The XML parser in Cisco Information Server (CIS) 6.2 allows remote attackers to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue aka Bug ID CSCuy39059.


The media subsystem in Google Chrome before 50.0.2661.75 does not initialize an unspecified data structure which allows remote attackers to cause a denial of service (invalid read operation) via unknown vectors.


ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.


The Autofill implementation in Google Chrome before 51.0.2704.79 mishandles the interaction between field updates and JavaScript code that triggers a frame deletion which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site a different vulnerability than CVE-2016-1690.


customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service via unspecified vectors a different vulnerability than CVE-2015-8489.


The Autofill implementation in Google Chrome before 51.0.2704.63 mishandles the interaction between field updates and JavaScript code that triggers a frame deletion which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site a different vulnerability than CVE-2016-1701.


The

function

in

in

the

bindings

in

Google

Chrome

before

does

not

properly

restrict

use

of

getters

and

setters

which

allows

remote

attackers

to

cause

a

denial

of

service

(use-after-free)

or

possibly

have

unspecified

other

impact

via

crafted

JavaScript

code.


Integer signedness error in the genkbd_commonioctl function in sys/dev/kbd/kbd.c in FreeBSD 9.3 before p42 10.1 before p34 10.2 before p17 and 10.3 before p3 allows local users to obtain sensitive information from kernel memory cause a denial of service (memory overwrite and kernel crash) or gain privileges via a negative value in the flen structure member in the arg argument in a SETFKEY ioctl call which triggers a \two way heap and stack overflow.\


Use-after-free

vulnerability

in

the

GetLoadTimes

function

in

renderer/loadtimes_extension_bindings.cc

in

the

Extensions

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

crafted

JavaScript

code.


The

rpd

daemon

in

Juniper

Junos

OS

before

before

before

before

before

before

before

before

before

and

before

when

configured

with

BGP-based

or

VPLS

allows

remote

attackers

to

cause

a

denial

of

service

(daemon

restart)

via

a

crafted

family

BGP

update.


The web-management GUI implementation on Cisco Small Business SG300 devices 1.4.1.x allows remote attackers to cause a denial of service (HTTPS outage) via crafted HTTPS requests aka Bug ID CSCuw87174.


The HTTP framework on Cisco SPA300 SPA500 and SPA51x devices allows remote attackers to cause a denial of service (device outage) via a series of malformed HTTP requests aka Bug ID CSCut67385.


The Apache HTTP Server 2.4.17 and 2.4.18 when mod_http2 is enabled does not limit the number of simultaneous stream workers for a single HTTP/2 connection which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows.


The proxy process on Cisco Web Security Appliance (WSA) devices through 9.1.0-070 allows remote attackers to cause a denial of service (CPU consumption) by establishing an FTP session and then improperly terminating the control connection after a file transfer aka Bug ID CSCuy43468.


The setAttr function in Graphite 2 before 1.3.6 as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font.


The administrative web services interface in Juniper ScreenOS before 6.3.0r21 allows remote attackers to cause a denial of service (reboot) via a crafted SSL packet.


The Wide Area Application Services (WAAS) Express implementation in Cisco IOS 15.1 through 15.5 allows remote attackers to cause a denial of service (device reload) via a crafted TCP segment aka Bug ID CSCuq59708.


The

PageCaptureSaveAsMHTMLFunction::ReturnFailure

function

in

in

Google

Chrome

before

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

by

triggering

an

error

in

creating

an

MHTML

document.


The General Packet Radio Switching Tunneling Protocol 1 (aka GTPv1) implementation on Cisco ASR 5000 Packet Data Network Gateway devices before 19.4 allows remote attackers to cause a denial of service (Session Manager process restart) via a crafted GTPv1 packet aka Bug ID CSCuz46198.


Cisco IOS XR through 5.3.2 mishandles Local Packet Transport Services (LPTS) flow-base entries which allows remote attackers to cause a denial of service (session drop) by making many connection attempts to open TCP ports aka Bug ID CSCux95576.


The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.


The TCP implementation in Cisco Videoscape Distribution Suite for Internet Streaming (VDS-IS) 3.3(0) 3.3(1) 4.0(0) and 4.1(0) does not properly initiate new TCP sessions when a previous session is in a FIN wait state which allows remote attackers to cause a denial of service (TCP outage) via vectors involving FIN packets aka Bug ID CSCuy45136.


in

Blink

as

used

in

Google

Chrome

before

does

not

properly

restrict

relayout

scheduling

which

allows

remote

attackers

to

cause

a

denial

of

service

(use-after-free)

or

possibly

have

unspecified

other

impact

via

a

crafted

HTML

document.


Cisco Nexus 1000v Application Virtual Switch (AVS) devices before 5.2(1)SV3(1.5i) allow remote attackers to cause a denial of service (ESXi hypervisor crash and purple screen) via a crafted Cisco Discovery Protocol packet that triggers an out-of-bounds memory access aka Bug ID CSCuw57985.


Cisco NX-OS 4.0 through 7.3 and 11.0 through 11.2 on 1000v 2000 3000 3500 5000 5500 5600 6000 7000 7700 and 9000 devices allows remote attackers to cause a denial of service (device reload) by leveraging a peer relationship to send a crafted BGP UPDATE message aka Bug IDs CSCuq77105 and CSCux11417.


Cisco AireOS 4.1 through 7.4.120.0 7.5.x and 7.6.100.0 on Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device reload) via a crafted HTTP request aka Bug ID CSCun86747.


Multiple use-after-free vulnerabilities in the formfiller implementation in PDFium as used in Google Chrome before 48.0.2564.82 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document related to improper tracking of the destruction of (1) IPWL_FocusHandler and (2) IPWL_Provider objects.


Juniper Junos OS before 13.2X51-D36 14.1X53 before 14.1X53-D25 and 15.2 before 15.2R1 on EX4300 series switches allow remote attackers to cause a denial of service (network loop and bandwidth consumption) via unspecified vectors related to Spanning Tree Protocol (STP) traffic.


The SCP and SFTP modules in Cisco IOS XR 5.0.0 through 5.2.5 on Network Convergence System 6000 devices use weak permissions for system files which allows remote authenticated users to cause a denial of service (overwrite) via unspecified vectors aka Bug ID CSCuw75848.


Use-after-free

vulnerability

in

the

function

in

Mozilla

Network

Security

Services

(NSS)

before

as

used

in

Mozilla

Firefox

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

crafted

key

data

with

DER

encoding.


Cisco IOS 15.2(1)T1.11 and 15.2(2)TST allows remote attackers to cause a denial of service (device crash) via a crafted LLDP packet aka Bug ID CSCun63132.


The HTTPS inspection engine in the Content Security and Control Security Services Module (CSC-SSM) 6.6 before 6.6.1164.0 for Cisco ASA 5500 devices allows remote attackers to cause a denial of service (memory consumption or device reload) via a flood of HTTPS packets aka Bug ID CSCue76147.


Juniper Junos OS before 12.1X46-D50 12.1X47 before 12.1X47-D23 12.3X48 before 12.3X48-D25 and 15.1X49 before 15.1X49-D40 on a High-End SRX-Series chassis system with one or more Application Layer Gateways (ALGs) enabled allow remote attackers to cause a denial of service (CPU consumption fab link failure or flip-flop failovers) via vectors related to in-transit traffic matching ALG rules.


Cisco FirePOWER System Software 5.3.x through 5.3.0.6 and 5.4.x through 5.4.0.3 on FirePOWER 7000 and 8000 appliances and on the Advanced Malware Protection (AMP) for Networks component on these appliances allows remote attackers to cause a denial of service (packet-processing outage) via crafted packets aka Bug ID CSCuu86214.


Use-after-free

vulnerability

in

the

StyleResolver::appendCSSStyleSheet

function

in

in

Blink

as

used

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

web

site

that

triggers

Cascading

Style

Sheets

(CSS)

style

invalidation

during

a

certain

subtree-removal

action.


The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x when using shadow mode paging or nested virtualization is enabled allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction which triggers a hypervisor bug check.


Cisco WebEx Meetings Player T29.10 when WRF file support is enabled allows remote attackers to cause a denial of service (application crash) via a crafted file aka Bug ID CSCuz80455.


The packet-processing microcode in Cisco IOS 15.2(2)EA 15.2(2)EA1 15.2(2)EA2 and 15.2(4)EA on Industrial Ethernet 4000 devices and 15.2(2)EB and 15.2(2)EB1 on Industrial Ethernet 5000 devices allows remote attackers to cause a denial of service (packet data corruption) via crafted IPv4 ICMP packets aka Bug ID CSCuy13431.


Cisco Prime Network Analysis Module (NAM) before 6.2(1-b) miscalculates IPv6 payload lengths which allows remote attackers to cause a denial of service (mond process crash and monitoring outage) via crafted IPv6 packets aka Bug ID CSCuy37324.


The XML parser in Cisco Adaptive Security Appliance (ASA) Software through 9.5.2 allows remote authenticated users to cause a denial of service (instability memory consumption or device reload) by leveraging (1) administrative access or (2) Clientless SSL VPN access to provide a crafted XML document aka Bug ID CSCut14209.


nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).


The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS XE 2.1 through 3.17S IOS XR 2.0.0 through 5.3.2 and NX-OS allows remote attackers to cause a denial of service (packet-processing outage) via crafted ND messages aka Bug ID CSCuz66542 as exploited in the wild in May 2016.


The

SerializedScriptValue::transferArrayBuffers

function

in

in

the

bindings

in

Blink

as

used

in

Google

Chrome

before

mishandles

certain

array-buffer

data

structures

which

allows

remote

attackers

to

cause

a

denial

of

service

(use-after-free)

or

possibly

have

unspecified

other

impact

via

a

crafted

web

site.


The remove_chunked_transfer_coding function in filters.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash) via crafted chunk-encoded content.


The Smart Install client implementation in Cisco IOS 12.2 15.0 and 15.2 and IOS XE 3.2 through 3.7 allows remote attackers to cause a denial of service (device reload) via crafted image list parameters in a Smart Install packet aka Bug ID CSCuv45410.


The Downloads feature in Apple Safari before 9.1 mishandles file expansion which allows remote attackers to cause a denial of service via a crafted web site.


The graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230 GRA-CL00 before GRA-CL00C92B230 GRA-CL10 before GRA-CL10C92B230 GRA-UL00 before GRA-UL00C00B230 and GRA-UL10 before GRA-UL10C00B230 allows attackers to cause a denial of service (system crash) via a crafted application aka a \semaphore deadlock issue.\


libclamav in ClamAV (aka Clam AntiVirus) as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web Security Appliance (WSA) devices before 9.0.1-135 and 9.1.x before 9.1.1-041 allows remote attackers to cause a denial of service (AMP process restart) via a crafted document aka Bug IDs CSCuv78533 and CSCuw60503.


The

Routing

Engine

in

Juniper

Junos

OS

through

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before

when

LDP

is

enabled

allows

remote

attackers

to

cause

a

denial

of

service

(RPD

routing

process

crash)

via

a

crafted

LDP

packet.


Cisco IOS 15.5(3)M and 15.6(1)T0a on Cisco 1000 Connected Grid routers allows remote authenticated users to cause a denial of service (device reload) via an SNMP request for unspecified BRIDGE MIB OIDs aka Bug ID CSCux89878.


Cisco Videoscape Session Resource Manager (VSRM) allows remote attackers to cause a denial of service (device restart) by sending a traffic flood to upstream devices aka Bug ID CSCva01813.


The Locator/ID Separation Protocol (LISP) implementation in Cisco IOS 15.1 and 15.2 and NX-OS 4.1 through 6.2 allows remote attackers to cause a denial of service (device reload) via a crafted header in a packet aka Bug ID CSCuu64279.


Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4 as used in Apple iOS before 9.3.2 OS X before 10.11.5 tvOS before 9.2.1 and watchOS before 2.2.1 allows remote attackers to cause a denial of service via a crafted XML document.


Juniper Junos OS before 12.1X46-D45 12.1X47 before 12.1X47-D30 12.1X48 before 12.3X48-D20 and 15.1X49 before 15.1X49-D30 on SRX series devices when the Real Time Streaming Protocol Application Layer Gateway (RTSP ALG) is enabled allow remote attackers to cause a denial of service (flowd crash) via a crafted RTSP packet.


Cisco Access Point devices with software 8.2(102.43) allow remote attackers to cause a denial of service (device reload) via crafted ARP packets aka Bug ID CSCuy55803.


The History implementation in WebKit in Apple iOS before 9.3 Safari before 9.1 and tvOS before 9.2 allows remote attackers to cause a denial of service (resource consumption and application crash) via a crafted web site.


Cisco IOS 15.0 through 15.5 and IOS XE 3.3 through 3.16 allow remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 Relay message aka Bug ID CSCus55821.


The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a crafted HTTP request aka Bug ID CSCul65330.


Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array.


Juniper

Junos

OS

before

before

before

before

before

before

before

before

before

before

or

before

before

before

and

before

allow

remote

attackers

to

cause

a

denial

of

service

via

a

malformed

packet

aka

a

\multicast

denial

of

service.\


Cisco Adaptive Security Appliance (ASA) Software 9.0 through 9.5.1 mishandles IPsec error processing which allows remote authenticated users to cause a denial of service (memory consumption) via crafted (1) LAN-to-LAN or (2) Remote Access VPN tunnel packets aka Bug ID CSCuv70576.


Cisco Unified Communications Manager IM and Presence Service 9.1(1) SU6 9.1(1) SU6a 9.1(1) SU7 10.5(2) SU2 10.5(2) SU2a 11.0(1) SU1 and 11.5(1) allows remote attackers to cause a denial of service (sipd process restart) via crafted headers in a SIP packet aka Bug ID CSCva39072.


Cisco IOS 15.3 and 15.4 Cisco IOS XE 3.8 through 3.11 and Cisco Unified Communications Manager allow remote attackers to cause a denial of service (device reload) via malformed SIP messages aka Bug ID CSCuj23293.


Use-after-free

vulnerability

in

the

RenderWidgetHostImpl::Destroy

function

in

in

the

Navigation

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

unknown

vectors.


Cisco IOS XR through 4.3.2 on Gigabit Switch Router (GSR) 12000 devices does not properly check for a Bidirectional Forwarding Detection (BFD) header in a UDP packet which allows remote attackers to cause a denial of service (line-card restart) via a crafted packet aka Bug ID CSCuw56900.


Cisco TelePresence Video Communications Server (VCS) X8.x before X8.7.2 allows remote attackers to cause a denial of service (service disruption) via a crafted URI in a SIP header aka Bug ID CSCuy43258.


numbers.c in libxslt before 1.1.29 as used in Google Chrome before 51.0.2704.63 mishandles namespace nodes which allows remote attackers to cause a denial of service (out-of-bounds heap memory access) or possibly have unspecified other impact via a crafted document.


Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4 as used in Apple iOS before 9.3.2 OS X before 10.11.5 tvOS before 9.2.1 and watchOS before 2.2.1 allow remote attackers to cause a denial of service via a crafted XML document.


NetApp Data ONTAP before 8.2.5 and 8.3.x before 8.3.2P12 allow remote authenticated users to cause a denial of service via vectors related to unsafe user input string handling.


goform/Docsis_system on Cisco EPC3928 devices allows remote attackers to cause a denial of service (device crash) via a long LanguageSelect parameter related to a \Gateway HTTP Corruption Denial of Service\ issue aka Bug ID CSCuy28100.


Juniper

Junos

OS

before

before

before

before

before

before

before

before

before

before

and

before

allow

remote

attackers

to

cause

a

denial

of

service

(kernel

crash)

via

a

crafted

UDP

packet

destined

to

the

interface

IP

address

of

a

OS

device.


The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files and consequently cause a denial of service (disk consumption and process crash) via a crafted HTTP request related to an unspecified debug function aka SAP Security Note 2241978.


Use-after-free

vulnerability

in

in

the

WebRTC

Audio

Private

API

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

by

leveraging

incorrect

reliance

on

the

resource

context

pointer.


The

ImageInputType::ensurePrimaryContent

function

in

in

Blink

as

used

in

Google

Chrome

before

does

not

properly

maintain

the

user

agent

shadow

DOM

which

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

that

leverage

\type

confusion.\


Cisco IOS 15.0(2)SG5 15.1(2)SG3 15.2(1)E 15.3(3)S and 15.4(1.13)S allows remote attackers to cause a denial of service (device crash) via a crafted LLDP packet aka Bug ID CSCun66735.


Juniper Junos OS before 12.1X46-D50 12.1X47 before 12.1X47-D40 12.3X48 before 12.3X48-D30 13.3 before 13.3R9 14.1 before 14.1R8 14.1X53 before 14.1X53-D40 14.2 before 14.2R6 15.1 before 15.1F6 or 15.1R3 and 15.1X49 before 15.1X49-D40 when configured with a GRE or IPIP tunnel allow remote attackers to cause a denial of service (kernel panic) via a crafted ICMP packet.


Cisco Prime Infrastructure 2.2 3.0 and 3.1(0.0) allows remote authenticated users to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue aka Bug ID CSCuw81497.


in

Google

Chrome

before

does

not

properly

consider

object

lifetimes

and

re-entrancy

issues

during

OnDocumentElementCreated

handling

which

allows

remote

attackers

to

cause

a

denial

of

service

(use-after-free)

or

possibly

have

unspecified

other

impact

via

unknown

vectors.


The kernel in FreeBSD 9.3 10.1 and 10.2 allows local users to cause a denial of service (crash) or potentially gain privilege via a crafted Linux compatibility layer setgroups system call.


The Adaptive Security Appliance (ASA) 5585-X FirePOWER Security Services Processor (SSP) module for Cisco ASA with FirePOWER Services 5.3.1 through 6.0.0 misconfigures kernel logging which allows remote attackers to cause a denial of service (resource consumption and inspection outage or module outage) via a flood of crafted IP traffic aka Bug ID CSCux19922.


Cisco AsyncOS 8.0 before 8.0.6-119 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (proxy-process hang) via a crafted HTTP POST request aka Bug ID CSCuo12171.


The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0 3.4.1 and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information cause a denial of service gain privileges or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.


HPE IPFilter A.11.31.18.21 on HP-UX when a certain keep-state configuration is enabled allows remote attackers to cause a denial of service via unspecified UDP packets.


ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.


The administration interface on Cisco DPQ3925 devices with firmware r1 allows remote attackers to cause a denial of service (device restart) via a crafted HTTP request aka Bug ID CSCup48105.


Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service.


extensions/renderer/gc_callback.cc in Google Chrome before 50.0.2661.94 does not prevent fallback execution once the Garbage Collection callback has started which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.


The IKEv2 implementation in Cisco IOS 15.0 through 15.6 and IOS XE 3.3 through 3.17 allows remote attackers to cause a denial of service (device reload) via fragmented packets aka Bug ID CSCux38417.


The client_host function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash) via an empty HTTP Host header.


The LoadBuffer implementation in Google V8 as used in Google Chrome before 50.0.2661.75 mishandles data types which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds write operation related to compiler/pipeline.cc and compiler/simplified-lowering.cc.


The web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to cause a denial of service (interface outage) via a crafted HTTP request aka Bug ID CSCuz76238.


IBM DB2 9.7 10.1 before FP6 and 10.5 before FP8 on AIX Linux HP Solaris and Windows allow remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a subquery containing the AVG OLAP function on an Oracle compatible database.