XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually the JVM process will run out of memory. Otherwise if the OS does not bound the memory on that process memory will continue to be exhausted and will affect other processes on the system.


An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association an attacker can trigger a deauthentication against stations using 802.11w resulting in a denial of service.


There is a use after free vulnerability on certain driver component in Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.167(C00E85R2P20T8). An attacker tricks the user into installing a malicious application which make the software to reference memory after it has been freed. Successful exploit could cause a denial of service condition.


VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with vmtools in Windows guest machines. This issue is present in versions 10.2.x and 10.3.x prior to 10.3.10. A local attacker with non-administrative access to a Windows guest with VMware Tools installed may be able to leak kernel information or create a denial of service attack on the same Windows guest machine.


An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. A specially crafted unauthenticated HTTP request can cause a SQL injection possibly leading to denial of service exfiltration of the database and local file inclusion which could potentially further lead to code execution. An attacker can send an HTTP request to trigger this vulnerability.


The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000 respectively runs on a lighttpd web server and makes use of the FastCGI module which is intended to provide high performance for all Internet applications without the penalties of Web server APIs. However the default configuration of this module appears to limit the number of concurrent php-cgi processes to two which can be abused to cause a denial of service of the entire web server. This affects WAGO PFC200 Firmware version 03.00.39(12) and version 03.01.07(13) and WAGO PFC100 Firmware version 03.00.39(12) and version 03.02.02(14).


USG9500 with versions of V500R001C30;V500R001C60 have a denial of service vulnerability. Due to a flaw in the X.509 implementation in the affected products which can result in a large heap buffer overrun error an attacker may exploit the vulnerability by a malicious certificate resulting a denial of service on the affected products.


An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. They allowed Denial of Service (application crash) via image data because two bytes are written to the end of the allocated memory without judging whether this will cause corruption.


An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. When the \VideoTags\ plugin is enabled a specially crafted unauthenticated HTTP request can cause a SQL injection possibly leading to denial of service exfiltration of the database and local file inclusion which could potentially further lead to code execution. An attacker can send an HTTP request to trigger this vulnerability.


Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors.


In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6 a bug in the non-default RACK TCP stack can allow an attacker to cause several linked lists to grow unbounded and cause an expensive list traversal on every packet being processed leading to resource exhaustion and a denial of service.


An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can cause a negative value to be read to satisfy an assert resulting in Denial of Service. An attacker can create a malicious binary to trigger this vulnerability.


There is a double free vulnerability on certain drivers of Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.181(C00E87R2P20T8). An attacker tricks the user into installing a malicious application which makes multiple processes operate the same resource at the same time. Successful exploit could cause a denial of service condition.


An exploitable double free vulnerability exists in the iocheckd service \I/O-Check\ functionality of WAGO PFC 200. A specially crafted XML cache file written to a specific location on the device can cause a heap pointer to be freed twice resulting in a denial of service and potentially code execution. An attacker can send a specially crafted packet to trigger the parsing of this cache file.


An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52 as used on Tesla Model S/X vehicles manufactured before March 2018 via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.


A reachable assertion in the lookup1_values function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.


In the Linux kernel through 5.2.1 on the powerpc platform when hardware transactional memory is disabled a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c.


An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. ROS_ASSERT_MSG only works when ROS_ASSERT_ENABLED is defined. This leads to a problem in the remove() function in clients/roscpp/src/libros/spinner.cpp. When ROS_ASSERT_ENABLED is not defined the iterator loop will run out of the scope of the array and cause denial of service for other components (that depend on the communication-related functions of this package). NOTE: The reporter of this issue now believes it was a false alarm.


Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container leading to denial of service (resource consumption) aka a \better zip bomb\ issue.


** DISPUTED ** In libjpeg-turbo 2.0.2 a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect width and height values in the image header. NOTE: the vendor's expectation for use cases in which this memory usage would be a denial of service is that the application should interpret libjpeg warnings as fatal errors (aborting decompression) and/or set limits on resource consumption or image sizes.


In the Zoom Client before 4.4.2 on macOS remote attackers can cause a denial of service (continual focus grabs) via a sequence of invalid launch?action=join&confno= requests to localhost port 19421.


A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D PXC50-E.D PXC100-E.D PXC200-E.D with Desigo PX Web modules PXA40-W0 PXA40-W1 PXA40-W2 (All firmware versions < V6.00.320) Desigo PX automation controllers PXC00-U PXC64-U PXC128-U with Desigo PX Web modules PXA30-W0 PXA30-W1 PXA30-W2 (All firmware versions < V6.00.320) Desigo PX automation controllers PXC22.1-E.D PXC36-E.D PXC36.1-E.D with activated web server (All firmware versions < V6.00.320). The device contains a vulnerability that could allow an attacker to cause a denial of service condition on the device's web server by sending a specially crafted HTTP message to the web server port (tcp/80). The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device's web service. While the device itself stays operational the web server responds with HTTP status code 404 (Not found) to any further request. A reboot is required to recover the web interface. At the time of advisory publication no public exploitation of this security vulnerability was known.


Imgix through 2019-06-19 allows remote attackers to cause a denial of service (resource consumption) by manipulating a small JPEG file to specify dimensions of 64250x64250 pixels which is mishandled during an attempt to load the 'whole image' into memory.


kernel/sys/syscall.c in ToaruOS through 1.10.9 allows a denial of service upon a critical error in certain sys_sbrk allocation patterns (involving PAGE_SIZE and a value less than PAGE_SIZE).


Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network and GnuPG through 2.2.16 makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service because of a Certificate Spamming Attack.


Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file.


Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().


TRENDnet TEW-827DRU with firmware up to and including 2.04B03 allows an unauthenticated attacker to execute setup wizard functionality giving this attacker the ability to change configuration values potentially leading to a denial of service. The request can be made on the local intranet or remotely if remote administration is enabled.


Use of uninitialized stack variables in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose sensitive information by opening a crafted Ogg Vorbis file.


Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due to lack of memory for devices that include a vulnerable version of the stack. The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device.


A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_alloc exception) via a crafted PNG image file.


iTop

through

allows

remote

attackers

to

cause

a

denial

of

service

(application

outage)

via

many

requests

to

launch

a

compile

operation.

The

requests

use

the

pages/exec.php?exec_env=production&exec_module=itop-hub-connector&exec_page=ajax.php&operation=compile

URI.

This

only

affects

the

community

version.


Division by zero in the predict_point function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file.


coap_decode_option in coap.c in LibNyoci 0.07.00rc1 mishandles certain packets with \Uri-Path: (null)\ and consequently allows remote attackers to cause a denial of service (segmentation fault).


Missing Access Control in the \Free Time\ component of several Zyxel UAG USG and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service.


A vulnerability was found in the Sonic Robo Blast 2 (SRB2) plugin (EP_Versions 9 to 11 inclusive) distributed with Doomseeker 1.1 and 1.2. Affected plugin versions did not discard IP packets with an unnaturally long response length from a Sonic Robo Blast 2 master server allowing a remote attacker to cause a potential crash / denial of service in Doomseeker. The issue has been remediated in the Doomseeker 1.3 release with source code patches to the SRB2 plugin.


Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases a default limit of 50 message attachments is enforced. This is configurable via the message property \attachment-max-count\.


The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.


An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in drivers/net/phy/mdio_bus.c calls put_device() which will trigger a fixed_mdio_bus_init use-after-free. This will cause a denial of service.


A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated local attacker to overwrite arbitrary files. The openvpn_launcher binary is setuid root. This binary supports the --log option which accepts a path as an argument. This parameter is not sanitized which allows a local unprivileged user to overwrite arbitrary files owned by any user on the system including root. This creates a denial of service condition and possible data loss if leveraged by a malicious local user.


BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile AtomicReadFile and DeviceCommunicationControl services. An unauthenticated remote attacker could cause a denial of service (bacserv daemon crash) because there is an invalid read in bacdcode.c during parsing of alarm tag numbers.


The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or failure which allows attackers in radio range to cause a denial of service (crash) via a crafted message.


When FreeImage 3.18.0 reads a special JXR file the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due to improper processing of the file eventually causing stack exhaustion. An attacker can achieve a remote denial of service attack by sending a specially constructed file.


The client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite list count in beacon frames probe responses and association responses which allows attackers in radio range to cause a denial of service (crash) via a crafted message.


** DISPUTED ** An issue was discovered in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel through 5.1.5. It allows local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value aka a \double fetch\ vulnerability. NOTE: a third party reports that this is unexploitable because the doubly fetched value is not used.


In SweetScape 010 Editor 9.0.1 improper validation of arguments in the internal implementation of the WSubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application.


An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php and html/graph-realtime.php scripts. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks including disclosing directory structure and filenames disclosing file content denial of service or writing arbitrary files. NOTE: relative to CVE-2019-10665 this requires authentication and the pathnames differ.


Due to incorrect string termination Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections this can cause the CGI process to terminate unexpectedly resulting in a denial of service for all clients using it.


A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v0.9.8 beta (build 02099) for macOS could allow an authenticated local attacker to overwrite arbitrary files. When the client initiates a connection the XML /tmp/pia-watcher.plist file is created. If the file exists it will be truncated and the contents completely overwritten. This file is removed on disconnect. An unprivileged user can create a hard or soft link to arbitrary files owned by any user on the system including root. This creates a denial of service condition and possible data loss if leveraged by a malicious local user.


The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is null.


SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools.


XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources leading to disclosure of local file contents and/or denial of service conditions.


In radare2 through 3.5.1 the rcc_context function of libr/egg/egg_lang.c mishandles changing context. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (invalid memory access in r_egg_lang_parsechar; invalid free in rcc_pusharg).


In SweetScape 010 Editor 9.0.1 improper validation of arguments in the internal implementation of the SubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application.


On Ubiquiti airCam 3.1.4 devices a Denial of Service vulnerability exists in the RTSP Service provided by the ubnt-streamer binary. The issue can be triggered via malformed RTSP requests that lead to an invalid memory read. To exploit the vulnerability an attacker must craft an RTSP request with a large number of headers.


A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection resulting in a remote denial of service for Ceph RGW clients.


A flaw was found in http-proxy-agent prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.


Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.


The lzo1x_decompress function in liblzo2.so.2 in LZO 2.10 as used in Long Range Zip (aka lrzip) 0.631 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive a different vulnerability than CVE-2017-8845.


An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks including disclosing directory structure and filenames file content denial of service or writing arbitrary files.


ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.


A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2 6.0.3 7.2.4 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results it is unlikely that data could be obtained. However the attacker could pass malicious data and create a denial of service.


Improper

initialization

of

local

variables

which

are

parameters

to

sfs

api

may

cause

invalid

pointer

dereference

and

leads

to

denial

of

service

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in


It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files cause denial of service or cause libvirtd to execute arbitrary programs.


A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions ) DIGSI 5 engineering software (All versions < V7.90) SIPROTEC 5 device types 6MD85 6MD86 6MD89 7UM85 7SA87 7SD87 7SL87 7VK87 7SA82 7SA86 7SD82 7SD86 7SL82 7SL86 7SJ86 7SK82 7SK85 7SJ82 7SJ85 7UT82 7UT85 7UT86 7UT87 and 7VE85 with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.90) SIPROTEC 5 device types 7SS85 and 7KE85 (All versions < V8.01) SIPROTEC 5 device types with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.59) SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.59). Specially crafted packets sent to port 443/TCP could cause a Denial of Service condition.


String

error

while

processing

non

standard

SIP

messages

received

can

lead

to

buffer

overread

and

then

denial

of

service

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell


Open

Information

Security

Foundation

Suricata

prior

to

version

is

affected

by:

Denial

of

Service

DNS

detection

bypass.

The

impact

is:

An

attacker

can

evade

a

signature

detection

with

a

specialy

formed

network

packet.

The

component

is:

app-layer-detect-proto.c

decode.c

decode-teredo.c

and

The

attack

vector

is:

An

attacker

can

trigger

the

vulnerability

by

sending

a

specifically

crafted

network

request.

The

fixed

version

is:


Jsish

is

affected

by:

Uncontrolled

Resource

Consumption.

The

impact

is:

denial

of

service.

The

component

is:

function

jsiValueGetString

(jsiUtils.c).

The

attack

vector

is:

executing

crafted

javascript

code.

The

fixed

version

is:

after

commit


serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. The impact is: Denial of service by aborting. The component is: from_* functions (all deserialization functions). The attack vector is: Parsing a malicious YAML file. The fixed version is: 0.8.4 and later.


moinejf

is

affected

by:

Incorrect

Access

Control.

The

impact

is:

Allows

attackers

to

cause

a

denial

of

service

attack

via

a

crafted

file.

The

component

is:

front.c

function

The

fixed

version

is:

after

commit

commit


Jsish 2.4.70 2.047 is affected by: Use After Free. The impact is: denial of service and possibly arbitrary code execution. The component is: function Jsi_RegExpNew (jsi/jsiRegexp.c:39). The attack vector is: executing crafted javascript code. The fixed version is: after commit 48a66c798d.


Open

Information

Security

Foundation

Suricata

prior

to

version

is

affected

by:

Denial

of

Service

TCP/HTTP

detection

bypass.

The

impact

is:

An

attacker

can

evade

a

signature

detection

with

a

specialy

formed

sequence

of

network

packets.

The

component

is:

detect.c

The

attack

vector

is:

An

attacker

can

trigger

the

vulnerability

by

a

specifically

crafted

network

TCP

session.

The

fixed

version

is:


Jsish

is

affected

by:

Reachable

Assertion.

The

impact

is:

denial

of

service.

The

component

is:

function

The

attack

vector

is:

executing

crafted

javascript

code.

The

fixed

version

is:

after

commit


yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to catch abort. The component is: YamlLoader::load_from_str function. The attack vector is: Parsing of a malicious YAML document. The fixed version is: 0.4.1 and later.


The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.


lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings which the library attempts to match using a regular expression. The fixed version is: 4.17.11.


** DISPUTED ** D-Link DSL-2750U 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. The component is: login. NOTE: Third parties dispute this issues as not being a vulnerability because although the wizard is accessible without authentication it can't actually configure anything. Thus there is no denial of service or information leakage.


DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference so attack can cause denial of service. The component is: cJSON_GetObjectItemCaseSensitive() function. The attack vector is: crafted json file. The fixed version is: 1.7.9 and later.


In Mcrouter prior to v0.41.0 a large struct input provided to the Carbon protocol reader could result in stack exhaustion and denial of service.


The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration or for limited denial of service. Versions prior to 1.15.0 1.14.4 1.13.8 and 1.12.10 are affected. The issue is of medium severity but not exposed by the default configuration.


Unhandled exception in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.


Jonathan

Looney

discovered

that

the

TCP

retransmission

queue

implementation

in

in

the

Linux

kernel

could

be

fragmented

when

handling

certain

TCP

Selective

Acknowledgment

(SACK)

sequences.

A

remote

attacker

could

use

this

to

cause

a

denial

of

service.

This

has

been

fixed

in

stable

kernel

releases

and

is

fixed

in

commit


A security vulnerability in HPE IceWall SSO Agent Option and IceWall MFA (Agent module ) could be exploited remotely to cause a denial of service. The versions and platforms of Agent Option modules that are impacted are as follows: 10.0 for Apache 2.2 on RHEL 5 and 6 10.0 for Apache 2.4 on RHEL 7 10.0 for Apache 2.4 on HP-UX 11i v3 10.0 for IIS on Windows 11.0 for Apache 2.4 on RHEL 7 MFA Proxy 4.0 (Agent module only) for Apache 2.4 on RHEL 7.


coders/xwd.c in GraphicsMagick 1.3.31 allows attackers to cause a denial of service (floating-point exception and application crash) by crafting an XWD image file a different vulnerability than CVE-2019-11008 and CVE-2019-11009.


The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via denial of service vulnerability in issue search when ordering by \Epic Name\.


In Mcrouter prior to v0.41.0 the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced allowing for resource exhaustion or denial of service.


An issue was discovered in Artifex MuJS 1.0.5. jscompile.c can cause a denial of service (invalid stack-frame jump) because it lacks an ENDTRY opcode call.


The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.


WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a \Conditional jump or move depends on uninitialised value\ condition which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.


Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.


Jonathan

Looney

discovered

that

the

Linux

kernel

default

MSS

is

hard-coded

to

bytes.

This

allows

a

remote

peer

to

fragment

TCP

resend

queues

significantly

more

than

if

a

larger

MSS

were

enforced.

A

remote

attacker

could

use

this

to

cause

a

denial

of

service.

This

has

been

fixed

in

stable

kernel

releases

and

is

fixed

in

commits

and


Pivotal RabbitMQ versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1 and RabbitMQ for Pivotal Platform 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4 contain a web management plugin that is vulnerable to a denial of service attack. The \X-Reason\ HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap resulting in the server crashing.


An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. A malformed login request allows remote attackers to cause a denial of service (reboot) as demonstrated by JSON misparsing of the \\\\} string to v1/system/login.


Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result malicious clients could send short messages which would result in a large memory allocation potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.12.09.00.


The Chuango 433 MHz burglar-alarm product line is vulnerable to a Denial of Service attack. When the condition is triggered the OV2 base station is unable to process sensor states and effectively prevents the alarm from setting off as demonstrated by Chuango branded products and non-Chuango branded products such as the Eminent EM8617 OV2 Wifi Alarm System.


Sony Bravia Smart TV devices allow remote attackers to cause a denial of service (device hang or reboot) via a SYN flood attack over a wired or Wi-Fi LAN.


vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause a denial of service (application crash) by replacing an emoji file (under the /sdcard/tencent/MicroMsg directory) with a crafted .wxgf file. The content of the replacement must be derived from the phone's IMEI. The crash occurs upon receiving a message that contains the replaced emoji.


A memory leak in archive_read_format_zip_cleanup in archive_read_support_format_zip.c in libarchive 3.3.4-dev allows remote attackers to cause a denial of service via a crafted ZIP file because of a HAVE_LZMA_H typo. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected.


In GraphicsMagick 1.4 snapshot-20190322 Q8 there is a memory leak in the function ReadMPCImage of coders/mpc.c which allows attackers to cause a denial of service via a crafted image file.


The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs allowing MITM attackers to cause a denial of service.


Sony BRAVIA Smart TV devices allow remote attackers to cause a denial of service (device hang) via a crafted web page over HbbTV.


Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result malicious clients could send short messages which would result in a large memory allocation potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00.


In all Kubernetes versions prior to v1.11.8 v1.12.6 and v1.13.4 users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type \json-patch\ (e.g. `kubectl patch --type json` or `\Content-Type: application/json-patch+json\`) that consumes excessive resources while processing causing a Denial of Service on the API Server.


A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0 0.101.4 and prior could allow an unauthenticated remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely resulting in a denial of service condition.


An issue was discovered in Varnish Cache before 6.0.4 LTS and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache which makes it a Denial of Service attack.


An issue was discovered on Xiaomi DGNWG03LM ZNCZ03LM MCCGQ01LM WSDCGQ01LM RTCGQ01LM devices. Because of insecure key transport in ZigBee communication causing attackers to gain sensitive information and denial of service attack take over smart home devices and tamper with messages.


An issue was discovered on ASUS HG100 MW100 WS-101 TS-101 AS-101 MS-101 DL-101 devices using ZigBee PRO. Attackers can use the ZigBee trust center rejoin procedure to perform mutiple denial of service attacks.


A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper validation of user-supplied requests to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the device to stop responding requiring manual intervention for recovery.


An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/core/net-sysfs.c which will cause denial of service.


GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments.


An issue was discovered on ASUS HG100 MW100 WS-101 TS-101 AS-101 MS-101 DL-101 devices using ZigBee PRO. Attackers can utilize the \discover ZigBee network procedure\ to perform a denial of service attack.


vphysics.dll in Counter-Strike: Global Offensive before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server because a crafted map is mishandled during a memset call.


An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in __xfrm_policy_unlink which will cause denial of service because verify_newpolicy_info in net/xfrm/xfrm_user.c mishandles directory validation.


An issue was discovered on Xiaomi DGNWG03LM ZNCZ03LM MCCGQ01LM WSDCGQ01LM RTCGQ01LM devices. Attackers can use the ZigBee trust center rejoin procedure to perform mutiple denial of service attacks.


rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable.


An issue was discovered in Maarch RM before 2.5. A path traversal vulnerability allows an unauthenticated remote attacker to overwrite any files with a crafted POST request if the default installation procedure was followed. This results in a permanent Denial of Service.


coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.


SHAREit through 4.0.6.177 does not check the full message length from the received packet header (which is used to allocate memory for the next set of data). This could lead to a system denial of service due to uncontrolled memory allocation. This is different from CVE-2019-14941.


In Grafana 2.x through 6.x before 6.3.4 parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.


An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances CI pipelines could potentially be used in a denial of service attack.


An issue was discovered on ASUS HG100 MW100 WS-101 TS-101 AS-101 MS-101 DL-101 devices using ZigBee PRO. Because of insecure key transport in ZigBee communication attackers can obtain sensitive information cause the multiple denial of service attacks take over smart home devices and tamper with messages.


An issue was discovered on Xiaomi DGNWG03LM ZNCZ03LM MCCGQ01LM RTCGQ01LM devices. Attackers can utilize the \discover ZigBee network procedure\ to perform a denial of service attack.


The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.


In Envoy through 1.11.1 users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service (memory consumption). This is a related issue to CVE-2019-14993.


An

XML

external

entity

processing

vulnerability

exists

in

Jenkins

Job

Import

Plugin

and

earlier

in

that

allows

attackers

with

the

ability

to

control

the

HTTP

server

(Jenkins)

queried

in

preparation

of

job

import

to

read

arbitrary

files

perform

a

denial

of

service

attack

etc.


An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated denial of service leading to the reboot of the AP via the admin.cgi?action=%s URI.


Improper initialization in BIOS firmware for 8th 9th 10th Generation Intel(R) Core(TM) Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow a privileged user to potentially enable denial of service via local access.


dwarf_elf_load_headers.c in libdwarf before 2019-07-05 allows attackers to cause a denial of service (division by zero) via an ELF file with a zero-size section group (SHT_GROUP) as demonstrated by dwarfdump.


An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can trigger read operations on an arbitrary file via Path Traversal in the TZ parameter but cannot retrieve the data that is read. This causes a denial of service if the filename is for example /dev/random.


HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c.


VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header.


In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42 there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.


An out-of-bounds access issue was found in the Linux kernel all versions through 5.3 in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel resulting in a denial of service or potentially escalating privileges on the system.


eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process resulting in the ability to start a Denial of Service. Due to Improper Authorization an attacker can obtain a session ID from CVE-2019-9583 or a valid guest/user/admin account can start this attack too.


In the Linux kernel before 5.2.3 drivers/block/floppy.c allows a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default.


SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading Out Of Band File Exfiltration Server Side Request Forgery and/or Potential Denial of Service attacks. This vulnerability also affects the XMLV2 LIBNAME engine when the AUTOMAP option is used.


SHAREit through 4.0.6.177 does not check the body length from the received packet header (which is used to allocate memory for the next set of data). This could lead to a system denial of service due to uncontrolled memory allocation.


** DISPUTED ** An issue was discovered in Libav 12.3. An access violation allows remote attackers to cause a denial of service (application crash) as demonstrated by avconv. This is related to ff_mpa_synth_filter_float in avcodec/mpegaudiodsp_template.c. NOTE: This may be a duplicate of CVE-2018-19129.


Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.


In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41 there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.


An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding malformed DER signatures could raise unexpected exceptions (or no exceptions at all) which could lead to a denial of service.


A flaw was found in all dpdk version 17.x.x before 17.11.8 16.x.x before 16.11.10 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master or a container with access to vhost_user socket can send specially crafted VRING_SET_NUM messages resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.


An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp which leads to denial of service.


An issue was discovered in Libav 12.3. Division by zero in range_decode_culshift in libavcodec/apedec.c allows remote attackers to cause a denial of service (application crash) as demonstrated by avconv.


Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs leading to a denial of service during use of the JWT VirtualService HTTPAPISpecBinding or QuotaSpecBinding API.


An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a pre-authenticated denial of service attack against the access point via a long action parameter to admin.cgi.


A denial of service vulnerability was discovered in nbdkit 1.12.7 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit depending on the plugins configured on the server-side.


An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp which leads to denial of service.


An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to a JavaScript Denial of Service when deleting pages in a document that contains only one page by calling a \t.hidden = true\ function.


headerv2.go in mastercactapus proxyprotocol before 0.0.2 as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy allows remote attackers to cause a denial of service (webserver panic and daemon crash) via a crafted HAProxy PROXY v2 request with truncated source/destination address data.


In mpc8_read_header in libavformat/mpc8.c in Libav 12.3 an input file can result in an avio_seek infinite loop and hang with 100% CPU consumption. Attackers could leverage this vulnerability to cause a denial of service via a crafted file.


In Account of Account.java there is a possible boot loop due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: Android; Versions: Android-9 Android-8.0 Android-8.1; Android ID: A-129287265.


Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab file because an unlimited number of lines is accepted.


There is an invalid memory access vulnerability in the function TextPage::findGaps() located at TextOutputDev.c in Xpdf 4.01 which can (for example) be triggered by sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.


XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file related to xnview+0x385399.


Some HTTP/2 implementations are vulnerable to a settings flood potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued this can consume excess CPU memory or both.


Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued this can consume excess CPU memory or both.


In Bluetooth there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-111215315


In libskia there is a possible crash due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-132782448


Homematic

outdated

base

software

packages

allows

Denial

of

Service.

affected

versions:


ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.


In Bluetooth there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-115747410


XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file related to ntdll!RtlReAllocateHeap.


In Bluetooth there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-116357965


An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.


Hoteldruid

before

allows

remote

authenticated

users

to

cause

a

denial

of

service

(invoice-creation

outage)

via

the

parameter

to

with

invalid

arguments

(any

non-numeric

value)

as

demonstrated

by

the

anno=2019&id_transazione=1&numero_contratto=1&n_file=a

query

string

to


An issue was discovered in rovinbhandari FTP through 2012-03-28. receive_file in file_transfer_functions.c allows remote attackers to cause a denial of service (daemon crash) via a 0xffff datalen field value.


In Bluetooth there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-115372550


In Bluetooth there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-115747155


In the Linux kernel through 5.0.2 the function inotify_update_existing_watch() in fs/notify/inotify/inotify_user.c neglects to call fsnotify_put_mark() with IN_MASK_CREATE after fsnotify_find_mark() which will cause a memory leak (aka refcount leak). Finally this will cause a denial of service.


Some HTTP/2 implementations are vulnerable to a flood of empty frames potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA HEADERS CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.


XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file related to ntdll!RtlpNtMakeTemporaryKey.


The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via many simultaneous /?Key=PhoneRequestAuthorization requests.


In libstagefright there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-124253062


Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.


In

Hoteldruid

before

a

division

by

zero

was

discovered

in

in

(aka

the

parameter)

due

to

the

mishandling

of

non-numeric

values

as

demonstrated

by

the

/tab_tariffe.php?anno=YEAR&numtariffa1=1a

URI.

It

could

allow

an

administrator

to

conduct

remote

denial

of

service

(disrupting

certain

business

functions

of

the

product).


Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device crashed by constructing a malicious packet. Affected products include: IPC-HDW1X2X IPC-HFW1X2X IPC-HDW2X2X IPC-HFW2X2X IPC-HDW4X2X IPC-HFW4X2X IPC-HDBW4X2X IPC-HDW5X2X IPC-HFW5X2X for versions which Build time is before August 18 2019.


gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure that a parent GTask remains alive during the execution of a connection-attempting enumeration which allows remote attackers to cause a denial of service (g_socket_client_connected_callback mishandling and application crash) via a crafted web site as demonstrated by GNOME Web (aka Epiphany).


In Storage Performance Development Kit (SPDK) before 19.01 a malicious vhost client (i.e. virtual machine) could carefully construct a circular descriptor chain that would result in a partial denial of service in the SPDK vhost target because the vhost target did not properly detect such chains.


Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.


There is a stack consumption issue in md5Round1() located in Decrypt.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to Catalog::countPageTree.


XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file related to ntdll!RtlQueueWorkItem.


Some HTTP/2 implementations are vulnerable to a reset flood potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames this can consume excess memory CPU or both.


An issue was discovered in Poppler 0.74.0. A recursive function call in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.


Homematic

and

obtain

session

IDs

without

login.

This

allows

a

Denial

of

Service

and

is

a

starting

point

for

other

attacks.

Affected

versions

for

Affected

versions

for


In JobStore there is a mismatched serialization/deserialization for the \battery-not-low\ job attribute. This could lead to a local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-130173029


In Bluetooth there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-116351796


** DISPUTED ** An issue was discovered on AudioCodes Mediant 500L-MSBR 500-MBSR M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A at least to 7.20A.252.062. The (1) management SSH and (2) management TELNET features allow remote attackers to cause a denial of service (connection slot exhaustion) via 5 unauthenticated connection attempts because the maximum number of unauthenticated clients that can be configured is 5. NOTE: the vendor's position is that this is a \design choice.\


XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file related to VCRUNTIME140!memcpy.


In libstagefright there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-111450210


An issue was discovered in Exiv2 0.27. There is infinite recursion at BigTiffImage::printIFD in the file bigtiffimage.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.


Various Lexmark printers contain a denial of service vulnerability in the SNMP service that can be exploited to crash the device.


In Bluetooth there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-91544774


In libstagefright there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-128431761


XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file related to xnview+0x38536c.


In Bluetooth there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117551475


There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase() located in GfxState.cc in Xpdf 4.0.0 as used in pdfalto 0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.


In Bluetooth there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112923309


The Screen Stream application through 3.0.15 for Android allows remote attackers to cause a denial of service via many simultaneous /start-stop requests.


In libstagefright there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-124329638


An issue was discovered in Poppler 0.74.0. A recursive function call in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.


The Olive Tree FTP Server (aka com.theolivetree.ftpserver) application through 1.32 for Android allows remote attackers to cause a denial of service via a client that makes many connection attempts and drops certain packets.


Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.


Some HTTP/2 implementations are vulnerable to a header leak potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.


In Bluetooth there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-110846194


The AirDroid application through 4.2.1.6 for Android allows remote attackers to cause a denial of service (service crash) via many simultaneous sdctl/comm/lite_auth/ requests.


Some HTTP/2 implementations are vulnerable to ping floods potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued this can consume excess CPU memory or both.


In Bluetooth there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-115745406


In libvpx there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-132783254


The fulltext search component in phpBB before 3.2.6 allows Denial of Service.


An

issue

was

discovered

in

An

out

of

bounds

write

occurs

in

AP4_CttsTableEntry::AP4_CttsTableEntry()

located

in

It

can

be

triggered

by

sending

a

crafted

file

to

(for

example)

the

binary.

It

allows

an

attacker

to

cause

Denial

of

Service

(Segmentation

fault)

or

possibly

have

unspecified

other

impact.


The ApowerManager application through 3.1.7 for Android allows remote attackers to cause a denial of service via many simultaneous /?Key=PhoneRequestAuthorization requests.


In AAC Codec there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112663564


Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses this can consume excess memory CPU or both.


In IoTivity through 1.3.1 the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traffic amplification. The reflected traffic is 6 times bigger than spoofed requests. This occurs because the construction of a \4.01 Unauthorized\ response is mishandled. NOTE: the vendor states \While this is an interesting attack there is no plan for maintainer to fix as we are migrating to IoTivity Lite.\


Some HTTP/2 implementations are vulnerable to resource loops potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.


An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1 MB3280 and MB3480 devices before 3.1 MB3660 devices before 2.3 and MB3180 devices before 2.1. A high rate of transit traffic may cause a low-memory condition and a denial of service.


In Bluetooth there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-115375248


In Bluetooth there is possible controlled termination due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-116267405


XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file related to ntdll!RtlFreeHeap.


A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.


In libstagefright there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-124330204


An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.


XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file related to ntdll!RtlPrefixUnicodeString.


The AirDrop application through 2.0 for Android allows remote attackers to cause a denial of service via a client that makes many socket connections through a configured port.


There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.


An

issue

was

discovered

on

TENGCONTROL

PLC

devices.

It

allows

remote

attackers

to

cause

a

denial

of

service

(persistent

failure

mode)

by

sending

a

series

of

(aka

UID

requests

to

TCP

port


In Bluetooth there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117567058


admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route.


hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The attacker must send a crafted 802.11 frame from a location that is within the 802.11 communications range.


A memory error in the function SSL_accept in nostromo nhttpd through 1.9.6 allows an attacker to trigger a denial of service via a crafted HTTP request.


In Xpdf 4.01.01 a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc used by GfxAxialShading::getColor. It can for example be triggered by sending a crafted PDF document to the pdftoppm tool. It allows an attacker to use a crafted PDF file to cause Denial of Service or possibly unspecified other impact.


An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly which causes an i_size_read() infinite loop and denial of service on SMP systems.


The

use

of

in

PowAssent

is

susceptible

to

denial

of

service

attacks.

In

`PowAssent.Phoenix.AuthorizationController`

a

value

is

fetched

from

the

user

provided

params

and

is

used

to

convert

the

binary

value

to

an

atom

so

it

can

be

used

to

fetch

the

provider

configuration

value.

This

is

unsafe

as

it

is

user

provided

data

and

can

be

used

to

fill

up

the

whole

atom

table

of

which

will

cause

the

app

to

crash.


WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7 2.5.x through 2.5.6 and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.


The Bluetooth Low Energy implementation in Cypress PSoC 4 BLE component 3.61 and earlier processes data channel frames with a payload length larger than the configured link layer maximum RX payload size which allows attackers (in radio range) to cause a denial of service (crash) via a crafted BLE Link Layer frame.


Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because *.cache files in /var/run/beaker/container_file/ are created when providing a valid length payload of 249 characters or fewer to the beaker.session.id cookie in a GET header. The attacker can use a long series of unique session IDs.


In Puma before versions 3.12.2 and 4.3.1 a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available additional connections will wait permanently if the attacker sends requests frequently enough. This vulnerability is patched in Puma 4.3.1 and 3.12.2.


An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.


An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl or StoreExcl operation.


An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3 as used in Xen through 4.12.x allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory aka CID-6ef36ab967c7.


An issue was discovered on Belkin Wemo Switch 28B WW_2.00.11057.PVT-OWRT-SNS devices. They allow remote attackers to cause a denial of service (persistent rules-processing outage) via a crafted ruleDbBody element in a StoreRules request to the upnp/control/rules1 URI because database corruption occurs.


An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility between Process Context Identifiers (PCID) and shadow-pagetable switching.


Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content as demonstrated by file modifications on Windows in the context of NT AUTHORITY\\SYSTEM. This could lead to denial of service elevation of privilege or unspecified other impact.


An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a compare-and-exchange operation.


tinylcy Vino through 2017-12-15 allows remote attackers to cause a denial of service (\vn_get_string error: Resource temporarily unavailable\ error and daemon crash) via a long URL.


An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain privileges because grant-table transfer requests are mishandled.


An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running operation that exists to support restartability of PTE updates.


An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance.


PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.


** DISPUTED ** The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call which might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. NOTE: the vendor plans to continue this behavior for performance reasons unless a WebRTC design change occurs.


In Network Security Services before 3.44 a malformed Netscape Certificate Sequence can cause NSS to crash resulting in a denial of service.


idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments as demonstrated by the admincp.php?app=comment&perpage= substring followed by a large positive integer.


An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB flushes.


An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is stored XSS in the Service Name tab of the WAN configuration screen leading to a denial of service (inability to change the configuration).


An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains.


The Bluetooth Low Energy implementation on Texas Instruments SDK through 3.30.00.20 for CC2640R2 devices does not properly restrict the SM Public Key packet on reception allowing attackers in radio range to cause a denial of service (crash) via crafted packets.


An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incompatible with Linux (and possibly other guest kernels).


The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.


find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.32 allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.


FFMPEG

version

contains

a

Improper

Validation

of

Array

Index

vulnerability

in

that

can

result

in

Denial

of

service.

This

attack

appears

to

be

exploitable

via

specially

crafted

file

has

to

be

provided

as

input.

This

vulnerability

appears

to

have

been

fixed

in

after

commit


aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser rollback during error processing aioxmpp.xso.model.guard function that can result in Denial of Service Other. This attack appears to be exploitable via Remote. A crafted stanza can be sent to an application which uses the vulnerable components to either inject data in a different context or cause the application to reconnect (potentially losing data). This vulnerability appears to have been fixed in 0.10.3.


In Tor before 0.3.3.12 0.3.4.x before 0.3.4.11 0.3.5.x before 0.3.5.8 and 0.4.x before 0.4.0.2-alpha remote denial of service against Tor clients and relays can occur via memory exhaustion in the KIST cell scheduler.


OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.


A Denial of Service vulnerability related to command handling has been identified in FlexNet Publisher lmadmin.exe version 11.16.2. The message reading function used in lmadmin.exe can given a certain message call itself again and then wait for a further message. With a particular flag set in the original message but no second message received the function eventually return an unexpected value which leads to an exception being thrown. The end result can be process termination.


An input validation issue was addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.5 Security Update 2019-003 High Sierra Security Update 2019-003 Sierra iOS 12.3 watchOS 5.2.1. A remote attacker may be able to cause a system denial of service.


A denial of service issue was addressed with improved validation. This issue is fixed in watchOS 5.2 macOS Mojave 10.14.4 Security Update 2019-002 High Sierra Security Update 2019-002 Sierra iOS 12.2. Processing a maliciously crafted vcf file may lead to a denial of service.


An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.


do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact.


A Denial of Service vulnerability related to stack exhaustion has been identified in FlexNet Publisher lmadmin.exe 11.16.2. Because the message reading function calls itself recursively given a certain condition in the received message an unauthenticated remote attacker can repeatedly send messages of that type to cause a stack exhaustion condition.


A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with privileges to generate sitemaps can bypass configuration that restricts directory access. The bypass allows overwrite of a subset of configuration files which can lead to denial of service.


An issue was discovered in Tcpreplay 4.3.1. An invalid memory access occurs in do_checksum in checksum.c. It can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.


An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service (resource consumption) via crafted dimensions for the verification code image.


Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can allow a local attacker to replace a DLL file with a malicious one and cause Denial of Service to the client.


A denial of service issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.1 Security Update 2019-001 and Security Update 2019-006 macOS Catalina 10.15. An attacker in a privileged position may be able to perform a denial of service attack.


The OSPF implementation on Enterasys switches and routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet a related issue to CVE-2013-0149.


The gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check return values which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via invalid imagecrop arguments that lead to use of a NULL pointer as a return value a different vulnerability than CVE-2013-7226.


libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the use of valid code-block dimension values which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.


The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking as demonstrated via a file with many newline characters.


The Multimedia Messaging Centre (MMSC) in NowSMS Now SMS & MMS Gateway 2013.09.26 allows remote attackers to cause a denial of service via a malformed message to a MM4 connection.


The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 does not check for empty lines which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


ZOLL Defibrillator / Monitor X Series has a default (1) supervisor password and (2) service password which allows physically proximate attackers to modify device configuration and cause a denial of service (adverse human health effects).


The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a \ \ or \?\ character in an ICAP request as demonstrated by use of the OPTIONS method.


The OSPF implementation on Brocade routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet a related issue to CVE-2013-0149.


The decode_slice_header function in libavcodec/h264.c in FFmpeg before 2.1 incorrectly relies on a certain droppable field which allows remote attackers to cause a denial of service (deadlock) or possibly have unspecified other impact via crafted H.264 data.


The filter_frame function in libavfilter/vf_fps.c in FFmpeg before 2.1 does not properly ensure the availability of FIFO content which allows remote attackers to cause a denial of service (double free) or possibly have unspecified other impact via crafted data.


The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter to plugin_googlemap2_proxy.php.


Double free vulnerability in the ioctx_alloc function in fs/aio.c in the Linux kernel before 3.12.4 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via vectors involving an error condition in the aio_setup_ring function.


epan/dissectors/packet-bssgp.c in the BSSGP dissector in Wireshark 1.10.x before 1.10.4 incorrectly relies on a global variable which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier does not properly detect recursion during entity expansion which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references a similar issue to CVE-2003-1564.


The flashsv_decode_frame function in libavcodec/flashsv.c in FFmpeg before 2.1 does not properly validate a certain height value which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Flash Screen Video data.


The JBIG2Stream::readSegments method in JBIG2Stream.cc in Poppler before 0.24.5 does not use the correct specifier within a format string which allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted PDF file.


The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not consider the component number in certain calculations which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.


The OSPF implementation on the Brocade Vyatta vRouter with software before 6.6R1 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet a related issue to CVE-2013-0149.


The rpza_decode_stream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Apple RPZA data.


The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace constraints which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data.


The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not prevent changes to global parameters which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data.


The OSPF implementation in Juniper Junos through 13.x JunosE and ScreenOS through 6.3.x does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet a related issue to CVE-2013-0149.


VideoLAN VLC Media Player before 2.0.7 allows remote attackers to cause a denial of service (memory consumption) via a crafted playlist file.


The get_cox function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not properly validate the reduction factor which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.


GNOME Display Manager (gdm) 3.4.1 and earlier when disable-user-list is set to true allows local users to cause a denial of service (unable to login) by pressing the cancel button after entering a user name.


The Multimedia Messaging Centre (MMSC) in NowSMS Now SMS & MMS Gateway before 2013.11.15 allows remote attackers to cause a denial of service via a malformed MM1 message that is routed to a (1) MM4 or (2) MM7 connection.


libavcodec/jpeg2000.c in FFmpeg before 2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via crafted JPEG2000 data.


The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a denial of service (restart) via an IKEv2 I1 notification without a KE payload.


Multiple integer signedness errors in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 allow remote attackers to cause a denial of service (application crash) or obtain sensitive information via an imagecrop function call with a negative value for the (1) x or (2) y dimension a different vulnerability than CVE-2013-7226.


Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.


The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 does not properly allocate memory for tiles which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Go2Webinar data.


The g2m_init_buffers function in libavcodec/g2meet.c in FFmpeg before 2.1 uses an incorrect ordering of arithmetic operations which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Go2Webinar data.


The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet a related issue to CVE-2013-0149.


The OSPF implementation in Extreme Networks EXOS does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet a related issue to CVE-2013-0149.


Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read (2) ZipExtFile.read(n) (3) ZipExtFile.readlines (4) ZipFile.extract or (5) ZipFile.extractall function.


The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data as demonstrated by JavaScript code that creates many CANVAS elements for rendering by Chrome or Firefox.


The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory which allows context-dependent attackers to read arbitrary files cause a denial of service and conduct CSRF attacks via crafted XML with JAXB aka an XML External Entity (XXE) issue and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.


query_params.cpp in cxxtools before 2.2.1 allows remote attackers to cause a denial of service (infinite recursion and crash) via an HTTP query that contains %% (double percent) characters.


The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (root process termination) by (1) closing the connection during negotiation or (2) specifying a name for a non-existent export.


cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7 when CONFIG_NETLABEL is disabled allows attackers to cause a denial of service (infinite loop and crash) as demonstrated by icmpsic a different vulnerability than CVE-2013-0310.


The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet a related issue to CVE-2013-0149.


The OSPF implementation on the D-Link DES-3810-28 switch with firmware R2.20.B017 does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet a related issue to CVE-2013-0149.


The OSPF implementation on NEC IP38X IX1000 IX2000 and IX3000 routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet a related issue to CVE-2013-0149.


cgi-bin/reboot.cgi on Seowon Intech SWC-9100 routers allows remote attackers to (1) cause a denial of service (reboot) via a default_reboot action or (2) reset all configuration values via a factory_default action.


The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not ensure the expected sample separation which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.


The ff_combine_frame function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.


The SAP Software Deployment Manager (SDM) in certain unspecified conditions allows remote attackers to cause a denial of service via vectors related to failed authentications.


The get_siz function in libavcodec/jpeg2000dec.c in FFmpeg before 2.1 does not prevent attempts to use non-zero image offsets which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG2000 data.


memcached before 1.4.17 when running in verbose mode allows remote attackers to cause a denial of service (crash) via a request that triggers an \unbounded key print\ during logging related to an issue that was \quickly grepped out of the source tree \ a different vulnerability than CVE-2013-0179 and CVE-2013-7290.


Use-after-free vulnerability in the SVGImage::setContainerSize function in core/svg/graphics/SVGImage.cpp in the SVG implementation in Blink as used in Google Chrome before 33.0.1750.146 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the resizing of a view.


Memory leak in the connection-manager implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1(.3) and earlier allows remote attackers to cause a denial of service (multi-protocol management outage) by making multiple management session requests aka Bug ID CSCug33233.


The BGP implementation in Cisco NX-OS 6.2(2a) and earlier does not properly handle the interaction of UPDATE messages with IPv6 VPNv4 and VPNv6 labeled unicast-address families which allows remote attackers to cause a denial of service (peer reset) via a crafted message aka Bug ID CSCuj03174.


The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.


Cisco IOS XE 3.8S(.2) and earlier does not properly use a DHCP pool during assignment of an IP address which allows remote authenticated users to cause a denial of service (device reload) via an AAA packet that triggers an address requirement aka Bug ID CSCuh04949.


Unspecified vulnerability in the Service VM in Citrix NetScaler SDX 9.3 before 9.3-64.4 and 10.0 before 10.0-77.5 and Application Delivery Controller (ADC) 9.3.x before 9.3-64.4 10.0 before 10.0-77.5 and 10.1 before 10.1-118.7 allows attackers to cause a denial of service via unknown vectors related to the \Virtual Machine Daemon.\


The TLS/SSLv3 module on Cisco ONS 15454 controller cards allows remote attackers to cause a denial of service (card reset) via crafted (1) TLS or (2) SSLv3 packets aka Bug ID CSCuh34787.


Munin::Master::Node in Munin before 2.0.18 allows remote attackers to cause a denial of service (abort data collection for node) via a plugin that uses \multigraph\ as a multigraph service name.


The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.


The OLAP query engine in IBM DB2 and DB2 Connect 9.7 through FP9 9.8 through FP5 10.1 through FP3 and 10.5 through FP2 and the DB2 pureScale Feature 9.8 for Enterprise Server Edition allows remote authenticated users to cause a denial of service (database outage and deactivation) via unspecified vectors.


The phone-proxy implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0.3.6 and earlier does not properly validate X.509 certificates which allows remote attackers to cause a denial of service (connection-database corruption) via an invalid entry aka Bug ID CSCui33299.


Jansson possibly 2.4 and earlier does not restrict the ability to trigger hash collisions predictably which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.


Juniper Junos 10.0 before 10.0S28 10.4 before 10.4R7 11.1 before 11.1R5 11.2 before 11.2R2 and 11.4 before 11.4R1 when in a Next-Generation Multicast VPN (NGEN MVPN) environment allows remote attackers to cause a denial of service (RPD routing daemon crash) via a large number of crafted PIM (S G) join requests.