IBM Cognos Express 9.0 allows attackers to obtain unspecified access to the Tomcat Manager component and cause a denial of service by leveraging hardcoded credentials.


Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.0 before 7.0(8.10) 7.2 before 7.2(4.45) 8.0 before 8.0(4.44) 8.1 before 8.1(2.35) and 8.2 before 8.2(1.10) allows remote attackers to cause a denial of service (device reload) via a malformed TCP segment when certain NAT translation and Cisco AIP-SSM configurations are used aka Bug ID CSCtb37219.


The futex_lock_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly manage a certain reference count which allows local users to cause a denial of service (OOPS) via vectors involving an unmount of an ext3 filesystem.


The CTI Manager service in Cisco Unified Communications Manager (aka CUCM formerly CallManager) 4.x before 4.3(2)sr1a 6.x before 6.1(3) 7.0x before 7.0(2) 7.1x before 7.1(2) and 8.x before 8.0(1) allows remote attackers to cause a denial of service (service failure) via a malformed message aka Bug ID CSCsu31800.


lighttpd before 1.4.26 and 1.5.x allocates a buffer for each read operation that occurs for a request which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.


The Web Services Security component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.13 does not properly implement the Java API for XML Web Services (aka JAX-WS) which allows remote attackers to cause a denial of service (data corruption) via a crafted JAX-WS request that leads to incorrectly encoded data.


A certain ActiveX control in msgsc.14.0.8089.726.dll in Microsoft Windows Live Messenger 2009 build 14.0.8089.726 on Windows Vista and Windows 7 allows remote attackers to cause a denial of service (msnmsgr.exe crash) by calling the ViewProfile method with a crafted argument during an MSN Messenger session.


Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.0 before 7.0(8.10) 7.2 before 7.2(4.45) 8.0 before 8.0(5.1) 8.1 before 8.1(2.37) and 8.2 before 8.2(1.15); and Cisco PIX 500 Series Security Appliance; allows remote attackers to cause a denial of service (active IPsec tunnel loss and prevention of new tunnels) via a malformed IKE message through an existing tunnel to UDP port 4500 aka Bug ID CSCtc47782.


The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly handle certain unlock operations for a Priority Inheritance (PI) futex which allows local users to cause a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification of the futex value from user space.


lib/rfc1035.c in Squid 2.x 3.0 through 3.0.STABLE22 and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header.


The MMIO instruction decoder in the Xen hypervisor in the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows guest OS users to cause a denial of service (32-bit guest OS crash) via vectors that trigger an unspecified instruction emulation.


An unspecified API in Microsoft Windows 2000 Windows XP Windows Server 2003 Windows Vista Windows Server 2008 and Windows 7 does not validate arguments which allows local users to cause a denial of service (system crash) via a crafted application.


content_encoding.c in libcurl 7.10.5 through 7.19.7 when zlib is enabled does not properly restrict the amount of callback data sent to an application that requests automatic decompression which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.


Unbound before 1.4.3 does not properly align structures on 64-bit platforms which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.


Unspecified vulnerability in secldapclntd in IBM AIX 5.3 with SP 5300-11-02 allows attackers to cause a denial of service (LDAP login failure) via unknown vectors. NOTE: some of these details are obtained from third party information. NOTE: there may be no attacker role and the issue may be triggered entirely by an administrator's installation of an official service pack.


Cisco IOS 12.1 through 12.4 when Cisco Unified Communications Manager Express (CME) or Cisco Unified Survivable Remote Site Telephony (SRST) is enabled allows remote attackers to cause a denial of service (device reload) via a malformed Skinny Client Control Protocol (SCCP) message aka Bug ID CSCsz49741 the \SCCP Request Handling Denial of Service Vulnerability.\


The CMSIPUtility component in Cisco Unified Communications Manager (aka CUCM formerly CallManager) 7.x before 7.1(3a)su1 and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SIP Register message aka Bug ID CSCtc37188.


The kernel in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 and Vista Gold does not perform the expected validation before creating a symbolic link which allows local users to cause a denial of service (reboot) via a crafted application aka \Windows Kernel Symbolic Link Value Vulnerability.\


IBM WebSphere MQ 7.x before 7.0.1.4 allows remote attackers to cause a denial of service (disk consumption) via multiple connection attempts to a stopped queue manager.


Cisco Unified Communications Manager (aka CUCM formerly CallManager) 6.x before 6.1(5) 7.x before 7.1(3a)su1 and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SCCP (1) RegAvailableLines or (2) FwdStatReq message with an invalid Line number aka Bug ID CSCtc47823.


Integer

signedness

error

in

NetBSD

and

NetBSD-current

before

allows

local

users

to

cause

a

denial

of

service

(kernel

panic)

via

a

negative

mixer

index

number

being

passed

to

the

function

in

the

azalia

audio

driver

(src/sys/dev/pci/azalia.c)

or

the

function

in

the

hdaudio

audio

driver

(src/sys/dev/pci/hdaudio/hdaudio_afg.c).


The nsDocument::MaybePreLoadImage function in content/base/src/nsDocument.cpp in the image-preloading implementation in Mozilla Firefox 3.6 before 3.6.2 does not apply scheme restrictions and policy restrictions to the image's URL which might allow remote attackers to cause a denial of service (application crash or hang) or hijack the functionality of the browser's add-ons via a crafted SRC attribute of an IMG element as demonstrated by remote command execution through an ssh: URL in a configuration that supports gnome-vfs with a nonstandard network.gnomevfs.supported-protocols setting.


Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2 and SeaMonkey before 2.0.4 executes a mail application in situations where an IMG element has a SRC attribute that is a redirect to a mailto: URL which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many images.


FreeBit ServersMan 3.1.5 on Apple iPhone OS 3.1.2 and iPhone OS for iPod touch allows remote attackers to cause a denial of service (daemon crash) via a HEAD request for the / URI.


The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information which allows remote attackers to cause a denial of service (memory consumption) via spoofed (1) NTP or (2) cmdmon packets.


The Perforce service (p4s.exe) in Perforce Server 2008.1 allows remote attackers to cause a denial of service (infinite loop) via crafted data that includes a byte sequence of 0xdc 0xff 0xff and 0xff immediately before the client protocol version number.


libspice as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0 does not properly validate guest QXL driver pointers which allows guest OS users to cause a denial of service (invalid pointer dereference and guest OS crash) or possibly gain privileges via unspecified vectors.


The x86 emulator in KVM 83 when a guest is configured for Symmetric Multiprocessing (SMP) does not properly restrict writing of segment selectors to segment registers which might allow guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region and replacing an instruction in between emulator entry and instruction fetch.


The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.


The x86 emulator in KVM 83 when a guest is configured for Symmetric Multiprocessing (SMP) does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) to restrict instruction execution which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region and replacing an instruction in between emulator entry and instruction fetch a related issue to CVE-2010-0298.


Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41 6.1 before 6.1.0.31 and 7.0 before 7.0.0.11 allows remote attackers to cause a denial of service (memory consumption and daemon crash) via a crafted request related to the nodeagent and Deployment Manager components.


Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.2 before 7.2(4.45) 8.0 before 8.0(4.44) 8.1 before 8.1(2.35) and 8.2 before 8.2(1.10) allows remote attackers to cause a denial of service (page fault and device reload) via a malformed DTLS message aka Bug ID CSCtb64913 and \WebVPN DTLS Denial of Service Vulnerability.\


OpenTTD before 1.0.1 accepts a company password for authentication in response to a request for the server password which allows remote authenticated users to bypass intended access restrictions or cause a denial of service (daemon crash) by sending a company password packet.


Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large number of tr arguments in a magnet link.


The Cisco Firewall Services Module (FWSM) 4.0 before 4.0(8) as used in for the Cisco Catalyst 6500 switches Cisco 7600 routers and ASA 5500 Adaptive Security Appliances allows remote attackers to cause a denial of service (crash) via a malformed Skinny Client Control Protocol (SCCP) message.


Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.0 before 7.0(8.10) 7.2 before 7.2(4.45) 8.0 before 8.0(5.2) 8.1 before 8.1(2.37) and 8.2 before 8.2(1.16); and Cisco PIX 500 Series Security Appliance; allows remote attackers to cause a denial of service (device reload) via malformed SIP messages aka Bug ID CSCtc96018.


cfnetwork.dll 1.450.5.0 in CFNetwork as used by safari.exe 531.21.10 in Apple Safari 4.0.3 and 4.0.4 on Windows allows remote attackers to cause a denial of service (application crash) via a long string in the BACKGROUND attribute of a BODY element.


The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values which allows local users to read arbitrary kernel memory locations cause a denial of service (OOPS) and possibly have unspecified other impact by specifying a node that is not part of the kernel's node set.


Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.2 before 7.2(4.46) 8.0 before 8.0(4.38) 8.1 before 8.1(2.29) and 8.2 before 8.2(1.5); and Cisco PIX 500 Series Security Appliance; allows remote attackers to cause a denial of service (prevention of new connections) via crafted TCP segments during termination of the TCP connection that cause the connection to remain in CLOSEWAIT status aka \TCP Connection Exhaustion Denial of Service Vulnerability.\


The edit_cmd function in crontab.c in (1) cronie before 1.4.4 and (2) Vixie cron (vixie-cron) allows local users to change the modification times of arbitrary files and consequently cause a denial of service via a symlink attack on a temporary file in the /tmp directory.


The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2 and 1.8 alpha allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid (1) AS-REQ or (2) TGS-REQ request.


The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in the SPNEGO GSS-API functionality in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2 and 1.8 before 1.8.1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid packet that triggers incorrect preparation of an error token.


The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23 8.1.11 and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument as demonstrated by a SELECT statement that contains a call to the substring function for a bit string related to an \overflow.\


The MGCP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S11 allows remote attackers to cause a denial of service (device crash) via a malformed packet aka Bug ID CSCsl39126.


The kernel in Microsoft Windows Server 2008 R2 and Windows 7 does not properly validate relocation sections of image files which allows local users to cause a denial of service (reboot) via a crafted file aka \Windows Kernel Malformed Image Vulnerability.\


libpurple in Finch in Pidgin before 2.6.6 when an XMPP multi-user chat (MUC) room is used does not properly parse nicknames containing <br> sequences which allows remote attackers to cause a denial of service (application crash) via a crafted nickname.


The on-demand scanning in Symantec AntiVirus 10.0.x and 10.1.x before MR9 AntiVirus 10.2.x and Client Security 3.0.x and 3.1.x before MR9 when Tamper protection is disabled allows remote attackers to cause a denial of service (prevention of on-demand scanning) via \specific events\ that prevent the user from having read access to unspecified resources.


Unspecified vulnerability in eMBox in Novell eDirectory 8.8 SP5 Patch 2 and earlier allows remote attackers to cause a denial of service (crash) via unknown a crafted SOAP request a different issue than CVE-2008-0926.


Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.0 before 7.0(8.10) 7.2 before 7.2(4.45) 8.0 before 8.0(5.2) 8.1 before 8.1(2.37) and 8.2 before 8.2(1.16); and Cisco PIX 500 Series Security Appliance; allows remote attackers to cause a denial of service (device reload) via malformed SIP messages aka Bug ID CSCsy91157.


cfnetwork.dll 1.450.5.0 in CFNetwork as used by safari.exe 531.21.10 in Apple Safari 4.0.4 on Windows allows remote attackers to cause a denial of service (application crash) via a long string in the SRC attribute of a (1) IMG or (2) IFRAME element.


The (1) ncpmount (2) ncpumount and (3) ncplogin programs in ncpfs 2.2.6 do not properly create lock files which allows local users to cause a denial of service (application failure) via unspecified vectors that trigger the creation of a /etc/mtab~ file that persists after the program exits.


Unspecified vulnerability in the SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S10 allows remote attackers to cause a denial of service (device crash) via unknown SIP traffic as demonstrated by \SIP testing \ aka Bug ID CSCsk38165.


Chip Salzenberg Deliver allows local users to cause a denial of service obtain sensitive information and possibly change the ownership of arbitrary files via a symlink attack on an unspecified file.


kuddb2 in Tivoli Monitoring for DB2 as distributed in IBM DB2 9.7 FP1 on Linux allows remote attackers to cause a denial of service (daemon crash) via a certain byte sequence.


The nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp in Mozilla Firefox before 3.5.7 allows remote attackers to cause a denial of service (application crash) via a crafted web site that triggers memory consumption and an accompanying Low Memory alert dialog and also triggers attempted removal of an observer from an empty observers array.


The flood-protection feature in the base IPDS DLE Forms DLE Barcode DLE Prescribe DLE and Printcryption DLE components on certain Lexmark laser and inkjet printers and MarkNet devices allows remote attackers to cause a denial of service (TCP outage) by making many passive FTP connections and then aborting these connections.


Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number.


Cisco IOS 12.1 through 12.4 when Cisco Unified Communications Manager Express (CME) or Cisco Unified Survivable Remote Site Telephony (SRST) is enabled allows remote attackers to cause a denial of service (device reload) via a malformed Skinny Client Control Protocol (SCCP) message aka Bug ID CSCsz48614 the \SCCP Packet Processing Denial of Service Vulnerability.\


The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body which allows remote attackers to cause a denial of service (backend server outage) via a crafted request related to use of a 500 error code instead of the appropriate 400 error code.


Unspecified vulnerability in registry-key validation in the kernel in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 and Vista Gold allows local users to cause a denial of service (reboot) via a crafted application aka \Windows Kernel Registry Key Vulnerability.\


Array index error in the hb_ot_layout_build_glyph_classes function in pango/opentype/hb-ot-layout.cc in Pango before 1.27.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted font file related to building a synthetic Glyph Definition (aka GDEF) table by using this font's charmap and the Unicode property database.


Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 3.2 before 3.2.215.0; 4.1 and 4.2 before 4.2.205.0; 4.1M and 4.2M before 4.2.207.54M; 5.0 5.1 and 6.0 before 6.0.188.0; and 5.2 before 5.2.193.11 allows remote attackers to cause a denial of service (device reload) via a crafted IKE packet aka Bug ID CSCta56653.


drivers/connector/connector.c in the Linux kernel before 2.6.32.8 allows local users to cause a denial of service (memory consumption and system crash) by sending the kernel many NETLINK_CONNECTOR messages.


The TCP/IP implementation in Microsoft Windows Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 allows remote attackers to cause a denial of service (system hang) via crafted packets with malformed TCP selective acknowledgement (SACK) values aka \TCP/IP Selective Acknowledgement Vulnerability.\


The IKE implementation in Cisco IOS 12.2 through 12.4 on Cisco 7200 and 7301 routers with VAM2+ allows remote attackers to cause a denial of service (device reload) via a malformed IKE packet aka Bug ID CSCtb13491.


Format string vulnerability in the WebDAV implementation in webservd in Sun Java System Web Server 7.0 Update 6 allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in the encoding attribute of the XML declaration in a PROPFIND request.


The SMTP component in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 and Server 2008 Gold SP2 and R2 and Exchange Server 2003 SP2 does not properly parse MX records which allows remote DNS servers to cause a denial of service (service outage) via a crafted response to a DNS MX record query aka \SMTP Server MX Record Vulnerability.\


The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53 1.2.x before 1.2.43 and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation which allows remote attackers to cause a denial of service (memory and CPU consumption and application hang) via a crafted PNG file as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character related to a \decompression bomb\ attack.


Cisco Unified Communications Manager (aka CUCM formerly CallManager) 6.x before 6.1(5) 7.x before 7.1(3b)SU2 and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SIP REG message related to an overflow of the Telephone-URL field aka Bug ID CSCtc62362.


The kernel in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 does not properly validate a registry-key argument to an unspecified system call which allows local users to cause a denial of service (reboot) via a crafted application aka \Windows Kernel Null Pointer Vulnerability.\


The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier as used by ncpmount and mount.cifs does not properly handle newline characters in mountpoint names which allows local users to cause a denial of service (mtab corruption) or possibly modify mount options and gain privileges via a crafted mount request.


The virtio_net_bad_features function in hw/virtio-net.c in the virtio-net driver in the Linux kernel before 2.6.26 when used on a guest OS in conjunction with qemu-kvm 0.11.0 or KVM 83 allows remote attackers to cause a denial of service (guest OS crash and an associated qemu-kvm process exit) by sending a large amount of network traffic to a TCP port on the guest OS related to a virtio-net whitelist that includes an improper implementation of TCP Segment Offloading (TSO).


mystring.c in hybserv in IRCD-Hybrid (aka Hybrid2 IRC Services) 1.9.2 through 1.9.4 allows remote attackers to cause a denial of service (daemon crash) via a \:help \\t\ private message to the MemoServ service.


The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312 and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6 does not properly remove POSIX locks on files that are setgid without group-execute permission which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem and then changing this file's permissions.


The Perforce service (p4s.exe) in Perforce Server 2008.1 allows remote attackers to cause a denial of service (daemon crash) via crafted data possibly involving a large sndbuf value.


libspice as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0 does not properly restrict the addresses upon which memory-management actions are performed which allows guest OS users to cause a denial of service (guest OS crash) or possibly gain privileges via unspecified vectors.


The read_from_cmd_socket function in cmdmon.c in chronyd in Chrony before 1.23.1 and 1.24-pre1 allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a spoofed cmdmon packet that triggers a continuous exchange of NOHOSTACCESS messages between two daemons a related issue to CVE-2009-3563.


QEMU-KVM as used in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and KVM 83 does not properly validate guest QXL driver pointers which allows guest OS users to cause a denial of service (invalid pointer dereference and guest OS crash) or possibly gain privileges via unspecified vectors.


The Perforce service (p4s.exe) in Perforce Server 2008.1 allows remote attackers to cause a denial of service (daemon crash) via crafted data beginning with a byte sequence of 0x4c 0xb3 0xff 0xff and 0xff.


The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro which allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to execute a 64-bit application and then triggers a segmentation fault as demonstrated by amd64_killer related to the flush_old_exec function.


Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long headers in an e-mail message.


Unspecified vulnerability in Microsoft Windows SharePoint Services 3.0 SP1 and SP2 allows remote attackers to cause a denial of service (hang) via crafted requests to the Help page that cause repeated restarts of the application pool aka \Sharepoint Help Page Denial of Service Vulnerability.\


gfs2 in the Linux kernel 2.6.18 and possibly other versions does not properly handle when the gfs2_quota struct occupies two separate pages which allows local users to cause a denial of service (kernel panic) via certain manipulations that cause an out-of-bounds write as demonstrated by writing from an ext3 file system to a gfs2 file system.


DBus-GLib 0.73 disregards the access flag of exported GObject properties which allows local users to bypass intended access restrictions and possibly cause a denial of service by modifying properties as demonstrated by properties of the (1) DeviceKit-Power (2) NetworkManager and (3) ModemManager services.


Google Chrome 4.1 BETA before 4.1.249.1036 allows remote attackers to cause a denial of service (memory error) or possibly have unspecified other impact via an empty SVG element.


The azx_position_ok function in hda_intel.c in Linux kernel 2.6.33-rc4 and earlier when running on the AMD780V chip set allows context-dependent attackers to cause a denial of service (crash) via unknown manipulations that trigger a divide-by-zero error.


sandra.sys 15.18.1.1 and earlier in the Sandra Device Driver in SiSoftware Sandra 16.10.2010.1 and earlier allows local users to gain privileges or cause a denial of service (system crash) via unspecified vectors involving \Model-Specific Registers.\


bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (session reset) via a malformed AS_PATHLIMIT path attribute.


Mozilla Firefox 3.6.x 3.5.x 3.0.19 and earlier and SeaMonkey executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many IFRAME elements.


The proc_oom_score function in fs/proc/base.c in the Linux kernel before 2.6.34-rc4 uses inappropriate data structures during selection of a candidate for the OOM killer which might allow local users to cause a denial of service via unspecified patterns of task creation.


Dolphin Browser 2.5.0 on the HTC Hero allows remote attackers to cause a denial of service (application crash) via JavaScript that writes <marquee> sequences in an infinite loop.


Apache Axis2 before 1.5.2 as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12 IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32 IBM Feature Pack for Web 2.0 1.0.1.0 Apache Synapse Apache ODE Apache Tuscany Apache Geronimo and other products does not properly reject DTDs in SOAP messages which allows remote attackers to read arbitrary files send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption) via a crafted DTD as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.


The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000 XP and Server 2003 allows local users to cause a denial of service (system crash) via a 0x18d value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent window.


WebKit.dll in WebKit as used in Safari.exe 4.531.9.1 in Apple Safari allows remote attackers to cause a denial of service (application crash) via JavaScript that writes <marquee> sequences in an infinite loop.


Google Chrome on the HTC Hero allows remote attackers to cause a denial of service (application crash) via JavaScript that writes <marquee> sequences in an infinite loop.


The HTTP client functionality in Apple iPhone OS 3.1 on the iPhone 2G and 3.1.3 on the iPhone 3GS allows remote attackers to cause a denial of service (Safari Mail or Springboard crash) via a crafted innerHTML property of a DIV element related to a \malformed character\ issue.


memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excessive memory allocation. NOTE: some of these details are obtained from third party information.


The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 do not properly validate an unspecified system-call argument which allows local users to cause a denial of service (system hang) via a crafted application aka \Win32k Bounds Checking Vulnerability.\


Unspecified vulnerability in NEC WebSAM DeploymentManager 5.13 and earlier as used in SigmaSystemCenter 2.1 Update2 and earlier BladeSystemCenter ExpressSystemCenter and VirtualPCCenter 2.2 and earlier allows remote attackers to cause a denial of service (OS shutdown or restart) via unknown vectors related to Client Service for DPM and crafted packets to port 56010.


The SfnLOGONNOTIFY function in win32k.sys in the kernel in Microsoft Windows 2000 XP and Server 2003 allows local users to cause a denial of service (system crash) via a 0x4c value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent window.


fetchmail 4.6.3 through 6.3.16 when debug mode is enabled does not properly handle invalid characters in a multi-character locale which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted (1) message header or (2) POP3 UIDL list.


The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier when SCTP is enabled allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data.


The DOCSIS dissector in Wireshark 0.9.6 through 1.0.12 and 1.2.0 through 1.2.7 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed packet trace file.


The ANI parser in Microsoft Windows before 7 on the x86 platform as used in Internet Explorer and other applications allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted biClrUsed value in the BITMAPINFO header of a .ANI file.


Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10 as used in the mod_reqtimeout module in the Apache HTTP Server and other software allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.


Opera 9.52 executes a mail application in situations where an IMG element has a SRC attribute that is a redirect to a mailto: URL which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many images a related issue to CVE-2010-0181.


The IBM WebSphere DataPower XML Accelerator XA35 Low Latency Appliance XM70 Integration Appliance XI50 B2B Appliance XB60 and XML Security Gateway XS40 SOA Appliances before 3.8.0.0 when a QLOGIC Ethernet interface is used allow remote attackers to cause a denial of service (interface outage) via malformed ICMP packets to the 0.0.0.0 destination IP address.


Unspecified vulnerability in the network bridge functionality on the Apple Time Capsule AirPort Extreme Base Station and AirPort Express Base Station with firmware before 7.5.2 allows remote attackers to cause a denial of service (networking outage) via a crafted DHCP reply.


bos.rte.libc 5.3.9.4 on IBM AIX 5.3 does not properly support reading a certain address field after a successful getaddrinfo function call which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors as demonstrated by IBM DB2 crashes on \systems with databases cataloged with alternate servers using IP addresses.\


The IBM BladeCenter with Advanced Management Module (AMM) firmware before bpet50g does not properly perform interrupt sharing for USB and iSCSI which allows remote attackers to cause a denial of service (management module reboot) via TCP packets with malformed application data.


Microsoft Internet Explorer 6.0.2900.2180 7 and 8.0.7600.16385 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many IFRAME elements.


Google Chrome before 4.1.249.1036 allows remote attackers to cause a denial of service (memory error) or possibly have unspecified other impact via a malformed SVG document.


Use-after-free vulnerability in WebKit before r65958 as used in Google Chrome before 6.0.472.59 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger use of document APIs such as document.close during parsing as demonstrated by a Cascading Style Sheets (CSS) file referencing an invalid SVG font aka rdar problem 8442098.


The computer telephony integration (CTI) server component in Cisco Unified Contact Center Express (UCCX) 7.0 before 7.0(1)SR4 and 7.0(2) 6.0 before 6.0(1)SR1 and 5.0 before 5.0(2)SR3 allows remote attackers to cause a denial of service (CTI server and Node Manager failure) via a malformed CTI message.


Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20 when IPV6_RECVPKTINFO is set on a listening socket allows remote attackers to cause a denial of service (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state which is not properly handled and causes the skb structure to be freed.


Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1 6.0 7.0 and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request related to asp.dll aka \IIS Repeated Parameter Request Denial of Service Vulnerability.\


Unspecified vulnerability in the Transport Layer Security (TLS) implementation on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 before 7.2(5) 8.0 before 8.0(5.15) 8.1 before 8.1(2.44) 8.2 before 8.2(2.17) and 8.3 before 8.3(1.6) and Cisco PIX Security Appliances 500 series devices allows remote attackers to cause a denial of service (device reload) via a sequence of crafted TLS packets aka Bug ID CSCtd32627.


Unspecified vulnerability in HP System Management Homepage (SMH) 6.0 before 6.0.0-95 on Linux and 6.0 before 6.0.0.96 on Windows allows remote authenticated users to obtain sensitive information modify data and cause a denial of service via unknown vectors.


Unspecified vulnerability in NEC CapsSuite Small Edition PatchMeister 2.0 Update2 and earlier allows remote attackers to cause a denial of service (OS shutdown or restart) via vectors related to Client Service for PTM and crafted packets to port 56015.


The my_net_skip_rest function in sql/net_serv.cc in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a large number of packets that exceed the maximum length.


Printer Setup in Apple Mac OS X 10.6 before 10.6.4 does not properly interpret character encoding which allows remote attackers to cause a denial of service (printing failure) by deploying a printing device that has a Unicode character in its printing-service name.


Red Hat Network (RHN) Satellite 5.3 and 5.4 exposes a dangerous obsolete XML-RPC API which allows remote authenticated users to access arbitrary files and cause a denial of service (failed yum operations) via vectors related to configuration and package group (comps.xml) files for channels.


Unspecified vulnerability in the SunRPC inspection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 before 7.2(5) 8.0 before 8.0(5.19) 8.1 before 8.1(2.47) and 8.2 before 8.2(2) and Cisco PIX Security Appliances 500 series devices allows remote attackers to cause a denial of service (device reload) via crafted SunRPC UDP packets aka Bug ID CSCtc77567.


The ULE decapsulation functionality in drivers/media/dvb/dvb-core/dvb_net.c in dvb-core in Linux kernel 2.6.33 and earlier allows attackers to cause a denial of service (infinite loop) via a crafted MPEG2-TS frame related to an invalid Payload Pointer ULE.


The cli_pdf function in libclamav/pdf.c in ClamAV before 0.96.1 allows remote attackers to cause a denial of service (crash) via a malformed PDF file related to an inconsistency in the calculated stream length and the real stream length.


Chip Salzenberg Deliver does not properly associate a lockfile with the user who created the file which allows local users to cause a denial of service (blockage of incoming e-mail) by creating lockfiles for arbitrary mailboxes.


The kernel in Microsoft Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 does not properly validate ACLs on kernel objects which allows local users to cause a denial of service (reboot) via a crafted application aka \Windows Kernel Improper Validation Vulnerability.\


Unspecified vulnerability in the SunRPC inspection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 before 7.2(5) 8.0 before 8.0(5.19) 8.1 before 8.1(2.47) and 8.2 before 8.2(2) and Cisco PIX Security Appliances 500 series devices allows remote attackers to cause a denial of service (device reload) via crafted SunRPC UDP packets aka Bug ID CSCtc79922.


The nfs_wait_on_request function in fs/nfs/pagelist.c in Linux kernel 2.6.x through 2.6.33-rc5 allows attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an operation that is not interruptible.


Unspecified vulnerability in the SIP implementation on the Cisco PGW 2200 Softswitch with software 9.7(3)S before 9.7(3)S9 and 9.7(3)P before 9.7(3)P9 allows remote attackers to cause a denial of service (TCP socket exhaustion) via unknown vectors aka Bug ID CSCsk13561.


The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.


Google Chrome 1.0.154.48 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute which allows remote attackers to cause a denial of service (excessive application launches) via an HTML document with many IFRAME elements.


Cisco TFTP Server 1.1 allows remote attackers to cause a denial of service (daemon crash) via a crafted (1) read (aka RRQ) or (2) write (aka WRQ) request or other TFTP packet. NOTE: some of these details are obtained from third party information.


Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption and application crash) via JavaScript code that creates multiple arrays containing elements with long string values and then appends long strings to the content of a P element related to the gfxWindowsFontGroup::MakeTextRun function in xul.dll a different vulnerability than CVE-2009-1571.


Unspecified vulnerability in the SunRPC inspection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 before 7.2(5) 8.0 before 8.0(5.19) 8.1 before 8.1(2.47) and 8.2 before 8.2(2) and Cisco PIX Security Appliances 500 series devices allows remote attackers to cause a denial of service (device reload) via crafted SunRPC UDP packets aka Bug ID CSCtc85753.


micro_httpd on the RCA DCM425 cable modem allows remote attackers to cause a denial of service (device reboot) via a long string to TCP port 80.


Unspecified vulnerability in Image Capture in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to cause a denial of service (memory consumption and system crash) via a crafted image.


Web Application Finger Printer (WAFP) 0.01-26c3 uses fixed pathnames under /tmp for temporary files and directories which (1) allows local users to cause a denial of service (application outage) by creating a file with a pathname that the product expects is available for its own internal use (2) allows local users to overwrite arbitrary files via symlink attacks on certain files in /tmp (3) might allow local users to delete arbitrary files and directories via a symlink attack on a directory under /tmp and (4) might make it easier for local users to obtain sensitive information by reading files in a directory under /tmp related to (a) lib/wafp_pidify.rb (b) utils/generate_wafp_fingerprint.sh (c) utils/online_update.sh and (d) utils/extract_from_db.sh.


The webdav_mount function in webdav_vfsops.c in the WebDAV kernel extension (aka webdav_fs.kext) for Mac OS X 10.6 allows local users to cause a denial of service (panic) via a mount request with a large integer in the pa_socket_namelen field.


Memory leak in drivers/media/video/videobuf-core.c in the videobuf subsystem in the Linux kernel 2.6.x through 4.x allows local users to cause a denial of service (memory consumption) by leveraging /dev/video access for a series of mmap calls that require new allocations a different vulnerability than CVE-2007-6761. NOTE: as of 2016-06-18 this affects only 11 drivers that have not been updated to use videobuf2 instead of videobuf.


DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file.


The video_usercopy function in drivers/media/video/v4l2-ioctl.c in the Linux kernel before 2.6.39 relies on the count value of a v4l2_ext_controls data structure to determine a kmalloc size which might allow local users to cause a denial of service (memory consumption) via a large value.


The Remote Filtering component in Websense Web Security and Web Filter before 6.3.3 Hotfix 18 and 7.x before 7.1.1 allows remote attackers to cause a denial of service (daemon exit) via a large volume of traffic.


include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group ID of zero from reaching the swapper process which allows local users to cause a denial of service (system crash) by leveraging access to this process group.


wxBitcoin and bitcoind 0.3.x allow remote attackers to cause a denial of service (electricity consumption) via a Bitcoin transaction containing multiple OP_CHECKSIG script opcodes.


article.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to cause a denial of service (memory consumption) via a large integer in the ratearticleselect parameter.


server/sv_main.c in Quake3 Arena as used in ioquake3 before r1762 OpenArena Tremulous and other products allows remote attackers to cause a denial of service (network traffic amplification) via a spoofed (1) getstatus or (2) rcon request.


wxBitcoin and bitcoind before 0.3.13 do not properly handle bitcoins associated with Bitcoin transactions that have zero confirmations which allows remote attackers to cause a denial of service (invalid-transaction flood) by sending low-valued transactions without transaction fees.


The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.


Websense Web Security and Web Filter before 6.3.3 Hotfix 27 and 7.x before 7.1.1 allow remote attackers to cause a denial of service (Blue Coat appliance integration outage) via a long URL.


wxBitcoin and bitcoind before 0.3.5 allow remote attackers to cause a denial of service (daemon crash) via a Bitcoin transaction containing an OP_LSHIFT script opcode.


The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 136 and 7.x before 7.1.1 on Windows allows remote attackers to cause a denial of service (filtering outage) via a crafted sequence of characters in a URI.


Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.3(2) allows remote attackers to cause a denial of service (device crash) via a large number of LAN-to-LAN (aka L2L) IPsec sessions aka Bug ID CSCth36592.


The

ThemeInstalledInfoBarDelegate::Observe

function

in

in

Google

Chrome

before

and

Chrome

OS

before

does

not

properly

handle

incorrect

tab

interaction

by

an

extension

which

allows

user-assisted

remote

attackers

to

cause

a

denial

of

service

(application

crash)

via

a

crafted

extension.


The glob implementation in libc in FreeBSD 7.3 and 8.1 NetBSD 5.0.2 and OpenBSD 4.7 and Libsystem in Apple Mac OS X before 10.6.8 allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames as demonstrated by glob expressions in STAT commands to an FTP daemon a different vulnerability than CVE-2010-2632.


fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment which allows local users to cause a denial of service (memory consumption) via a crafted exec system call aka an \OOM dodging issue \ a related issue to CVE-2010-3858.


The in_mkv plugin in Winamp before 5.6 allows remote attackers to cause a denial of service (application crash) via a Matroska Video (MKV) file containing a string with a crafted length.


member.php in MyBB (aka MyBulletinBoard) before 1.4.12 makes a certain superfluous call to the SQL COUNT function which allows remote attackers to cause a denial of service (resource consumption) by making requests to member.php that trigger scans of the entire users table.


The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file which might allow local users to cause a denial of service (resource consumption) via a special file.


Multiple integer underflows in the x25_parse_facilities function in net/x25/x25_facilities.c in the Linux kernel before 2.6.36.2 allow remote attackers to cause a denial of service (system crash) via malformed X.25 (1) X25_FAC_CLASS_A (2) X25_FAC_CLASS_B (3) X25_FAC_CLASS_C or (4) X25_FAC_CLASS_D facility data a different vulnerability than CVE-2010-3873.


solid.exe in IBM solidDB 6.5.0.3 and earlier does not properly perform a recursive call to a certain function upon receiving packet data containing many integer fields with two different values which allows remote attackers to cause a denial of service (invalid memory access and daemon crash) via a TCP session on port 1315.


The do_block_io_op function in (1) drivers/xen/blkback/blkback.c and (2) drivers/xen/blktap/blktap.c in Xen before 3.4.0 for the Linux kernel 2.6.18 and possibly other versions allows guest OS users to cause a denial of service (infinite loop and CPU consumption) via a large production request index to the blkback or blktap back-end drivers. NOTE: some of these details are obtained from third party information.


The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM responder in SSSD 1.5.0 1.4.x and 1.3 allows local users to cause a denial of service (infinite loop crash and login prevention) via a crafted packet.


Memory leak on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) allows remote attackers to cause a denial of service (memory consumption) by making multiple incorrect LDAP authentication attempts aka Bug ID CSCtf29867.


libxml2 before 2.7.8 as used in Google Chrome before 7.0.517.44 Apple Safari 5.0.2 and earlier and other products reads from invalid memory locations during processing of malformed XPath expressions which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.


The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 when HTTP Access Services (HTTP-AS) is enabled does not properly process TCP connection requests which allows remote attackers to cause a denial of service (memory consumption and HTTP-AS hang) by making many connection requests that trigger \queue size delta errors \ related to a \timing hole\ issue.


Multiple use-after-free vulnerabilities in OpenTTD 1.0.x before 1.0.5 allow (1) remote attackers to cause a denial of service (invalid write and daemon crash) by abruptly disconnecting during transmission of the map from the server related to network/network_server.cpp; (2) remote attackers to cause a denial of service (invalid read and daemon crash) by abruptly disconnecting related to network/network_server.cpp; and (3) remote servers to cause a denial of service (invalid read and application crash) by forcing a disconnection during the join process related to network/network.cpp.


IBM Lotus Notes Traveler before 8.5.1.3 allows remote attackers to cause a denial of service (sync failure) via a malformed document.


CallManager Express (CME) on Cisco IOS before 15.0(1)XA1 does not properly handle SIP TRUNK traffic that contains rate bursts and a \peculiar\ request size which allows remote attackers to cause a denial of service (memory consumption) by sending this traffic over a long duration aka Bug ID CSCtb47950.


Google Chrome before 7.0.517.44 does not properly perform a cast of an unspecified variable during processing of an SVG use element which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SVG document.


IBM Lotus Notes Traveler before 8.5.1.2 allows remote authenticated users to cause a denial of service (daemon crash) by accepting a meeting invitation with an iNotes client and then accepting this meeting invitation with an iPhone client.


WebKit as used in Google Chrome before 7.0.517.44 webkitgtk before 1.2.6 and other products accesses a frame object after this object has been destroyed which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


emWEB on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) allows remote attackers to cause a denial of service (daemon crash) via a request for a document whose name contains space characters aka Bug ID CSCsy08416.


The cu_rrd_create_file function (src/utils_rrdcreate.c) in collectd 4.x before 4.9.4 and before 4.10.2 allow remote attackers to cause a denial of service (assertion failure) via a packet with a timestamp whose value is 10 or less as demonstrated by creating RRD files using the (1) RRDtool and (2) RRDCacheD plugins.


The Web Sockets implementation in Google Chrome before 7.0.517.41 does not properly handle a shutdown action which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.


The do_extendedOp function in ibmslapd in IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.62 (aka 6.0.0.8-TIV-ITDS-IF0004) on Linux Solaris and Windows allows remote authenticated users to cause a denial of service (ABEND) via a malformed LDAP extended operation that triggers certain comparisons involving the NULL operation OID.


The pipe_fcntl function in fs/pipe.c in the Linux kernel before 2.6.37 does not properly determine whether a file is a named pipe which allows local users to cause a denial of service via an F_SETPIPE_SZ fcntl call.


STCAPP (aka the SCCP telephony control application) on Cisco IOS before 15.0(1)XA1 does not properly handle multiple calls to a shared line which allows remote attackers to cause a denial of service (port hang) by simultaneously ending two calls that were controlled by CallManager Express (CME) aka Bug ID CSCtd42552.


The staprun runtime tool in SystemTap 1.3 does not verify that a module to unload was previously loaded by SystemTap which allows local users to cause a denial of service (unloading of arbitrary kernel modules).


Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 do not properly perform cursor handling which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to \stale pointers.\


Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) allows remote authenticated users to cause a denial of service (device crash) via a high volume of IPsec traffic aka Bug ID CSCsx52748.


Google Chrome before 7.0.517.44 does not properly handle the data types of event objects which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


The Pickle::Pickle function in base/pickle.cc in Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 on 64-bit Linux platforms does not properly perform pointer arithmetic which allows remote attackers to bypass message deserialization validation and cause a denial of service or possibly have unspecified other impact via invalid pickle data.


Unspecified vulnerability in LoadRunner Web Tours 9.10 in HP LoadRunner 9.1 and earlier allows remote attackers to cause a denial of service and possibly obtain sensitive information or modify data via unknown vectors.


The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier as used in FreeBSD 7.3 and 8.1 NetBSD 5.0.2 OpenBSD 4.7 and other products allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon a different vulnerability than CVE-2010-2632.


The vbd_create function in Xen 3.1.2 when the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 is used allows guest OS users to cause a denial of service (host OS panic) via an attempted access to a virtual CD-ROM device through the blkback driver. NOTE: some of these details are obtained from third party information.


IBM Lotus Notes Traveler before 8.5.1.2 allows remote authenticated users to cause a denial of service (resource consumption and sync outage) by syncing a large volume of data.


Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3 and 2.12.x through 2.12.2 allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators as demonstrated by a {10 }{10 }{10 }{10 } sequence in the proftpd.gnu.c exploit for ProFTPD.


MyBB (aka MyBulletinBoard) before 1.4.12 does not properly restrict uid values for group join requests which allows remote attackers to cause a denial of service (resource consumption) by using guest access to submit join request forms for moderated groups related to usercp.php and managegroup.php.


The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value leading to a divide-by-zero error or incorrect use of a signed integer.


Use-after-free vulnerability in the proxy-server implementation in IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.65 (aka 6.0.0.8-TIV-ITDS-IF0007) and 6.3 before 6.3.0.1 (aka 6.3.0.0-TIV-ITDS-IF0001) allows remote authenticated users to cause a denial of service (daemon crash) via a paged search that is interrupted by an LDAP Unbind operation.


The udp_queue_rcv_skb function in net/ipv4/udp.c in a certain Red Hat build of the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (deadlock and system hang) by sending UDP traffic to a socket that has a crafted socket filter a related issue to CVE-2010-4158.


The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier 5.0 Update 27 and earlier and 1.4.2_29 and earlier as used in OpenJDK Apache JBossweb and other products allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number as demonstrated using 2.2250738585072012e-308.


WebSEAL in IBM Tivoli Access Manager for e-business 6.1.1 before 6.1.1-TIV-AWS-FP0001 allows remote authenticated users to cause a denial of service (worker thread consumption) via shift-reload actions.


The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 2.6.37-rc7 allows local users to cause a denial of service (panic) via a zero-length I/O request in a device ioctl to a SCSI device related to an unaligned map. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4163.


The Neighbor Discovery (ND) protocol implementation in the IPv6 stack on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2(3) and earlier and Cisco PIX Security Appliances devices allows remote attackers to cause a denial of service (CPU consumption and device hang) by sending many Router Advertisement (RA) messages with different source addresses as demonstrated by the flood_router6 program in the thc-ipv6 package aka Bug ID CSCti24526.


The password reset functionality in django.contrib.auth in Django before 1.1.3 1.2.x before 1.2.4 and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.


The do_standalone function in the MIT krb5 KDC database propagation daemon (kpropd) in Kerberos 1.7 1.8 and 1.9 when running in standalone mode does not properly handle when a worker child process \exits abnormally \ which allows remote attackers to cause a denial of service (listening process termination no new connections and lack of updates in slave KVC) via unspecified vectors.


The

org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run

method

in

JBoss

Remoting

before

and

before

in

Red

Hat

JBoss

Enterprise

Application

Platform

(aka

JBoss

EAP

or

JBEAP)

through

allows

remote

attackers

to

cause

a

denial

of

service

(daemon

outage)

by

establishing

a

bisocket

control

connection

TCP

session

and

then

not

sending

any

application

data

related

to

a

missing

patch.

NOTE:

this

can

be

considered

a

duplicate

of

because

a

missing

patch

should

not

be

assigned

a

separate

CVE

identifier.


epan/dissectors/packet-zbee-zcl.c in the ZigBee ZCL dissector in Wireshark 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted ZCL packet related to Discover Attributes.


An unspecified Domino API in IBM Lotus Notes Traveler before 8.5.1.1 does not properly handle MIME types which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.


strtod.c as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5 and other products allows context-dependent attackers to cause a denial of service (infinite loop) via a certain floating-point value in scientific notation which is not properly handled in x87 FPU registers as demonstrated using 2.2250738585072011e-308.


Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2(4) and earlier allows remote attackers to cause a denial of service (block exhaustion) via multicast traffic aka Bug ID CSCtg63992.


The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 does not properly maintain a certain reference count which allows remote authenticated users to cause a denial of service (IP address exhaustion) by making invalid attempts to establish sessions with the same VPN ID from multiple devices.


Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.3(2) allows remote attackers to cause a denial of service (device crash) via multicast traffic aka Bug IDs CSCtg61810 and CSCtg69742.


libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg 0.6.1 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted .ogg file related to the vorbis_floor0_decode function. NOTE: this might overlap CVE-2011-0480.


Opera before 10.63 allows user-assisted remote web servers to cause a denial of service (application crash) by sending a redirect during the saving of a file.


The gs_type2_interpret function in Ghostscript allows remote attackers to cause a denial of service (incorrect pointer dereference and application crash) via crafted font data in a compressed data stream aka bug 691043.


Google Chrome before 8.0.552.215 does not properly restrict the generation of file dialogs which allows remote attackers to cause a denial of service (reduced usability and possible application crash) via a crafted web site.


The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 2.6.36.2 allows local users to cause a denial of service (panic) via a zero-length I/O request in a device ioctl to a SCSI device.


Use-after-free vulnerability in the proxy server in IBM Tivoli Directory Server (TDS) 6.0.0.x before 6.0.0.8-TIV-ITDS-IF0007 and 6.1.x before 6.1.0-TIV-ITDS-FP0005 allows remote attackers to cause a denial of service (daemon crash) via an unbind request that occurs during a certain search operation.


The in_mp4 plugin in Winamp before 5.6 allows remote attackers to cause a denial of service (application crash) via crafted (1) metadata or (2) albumart in an invalid MP4 file.


The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames as demonstrated by glob expressions in STAT commands to an FTP daemon a different vulnerability than CVE-2010-2632.


Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) do not properly handle Online Certificate Status Protocol (OCSP) connection failures which allows remote OCSP responders to cause a denial of service (TCP socket exhaustion) by rejecting connection attempts aka Bug ID CSCsz36816.


The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3 and 2.12.x through 2.12.2 allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation as demonstrated by a {10 }{10 }{10 }{10 }{10 } sequence in the proftpd.gnu.c exploit for ProFTPD related to a \RE_DUP_MAX overflow.\


Use-after-free vulnerability in WebKit as used in Google Chrome before 7.0.517.44 webkitgtk before 1.2.6 and other products allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving text editing.


IBM Rational ClearQuest 7.0.x before 7.0.1.11 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1 does not prevent modification of back-reference fields which allows remote authenticated users to interfere with intended record relationships and possibly cause a denial of service (loop) or have unspecified other impact by (1) adding or (2) removing a back reference.


Open Ticket Request System (OTRS) before 2.3.6 does not properly handle e-mail messages in which the From line contains UTF-8 characters associated with diacritical marks and an invalid charset which allows remote attackers to cause a denial of service (duplicate tickets and duplicate auto-responses) by sending a crafted message to a POP3 mailbox.


Unspecified vulnerability in the SIP inspection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.3(2) allows remote attackers to cause a denial of service (device crash) by making many SIP calls aka Bug ID CSCte20030.


Opera before 10.63 allows remote attackers to cause a denial of service (application crash) via a Flash movie with a transparent Window Mode (aka wmode) property which is not properly handled during navigation away from the containing HTML document.


Stack consumption vulnerability in solid.exe in IBM solidDB 6.5.0.3 and earlier allows remote attackers to cause a denial of service (memory consumption and daemon crash) by connecting to TCP port 1315 and sending a packet with many integer fields which trigger many recursive calls of a certain function.


Google Chrome before 8.0.552.215 does not properly handle HTML5 databases which allows attackers to cause a denial of service (application crash) via unspecified vectors.


drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.


IBM Tivoli Directory Server (TDS) 6.0.0.x before 6.0.0.8-TIV-ITDS-IF0007 does not properly handle invalid buffer references in LDAP BER requests which might allow remote attackers to cause a denial of service (daemon crash) via vectors involving a buffer that has a memory address near the maximum possible address.


The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets which allows remote attackers to cause a denial of service (memory consumption) by sending a large amount of network traffic as demonstrated by netperf UDP tests.


The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Microsoft Windows XP Windows Server 2003 Windows Vista Windows Server 2008 and Windows 7 allows remote attackers to cause a denial of service (CPU consumption and system hang) by sending many Router Advertisement (RA) messages with different source addresses as demonstrated by the flood_router6 program in the thc-ipv6 package.


Multiple memory leaks in the normalization functionality in 389 Directory Server before 1.2.7.5 allow remote attackers to cause a denial of service (memory consumption) via \badly behaved applications \ related to (1) Slapi_Attr mishandling in the DN normalization code and (2) pointer mishandling in the syntax normalization code a different issue than CVE-2011-0019.


The Perl_reg_numbered_buff_fetch function in Perl 5.10.0 5.12.0 5.14.0 and other versions when running with debugging enabled allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions as demonstrated by causing SpamAssassin and OCSInventory to crash.


Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via malformed video content that triggers an indexing error.


The socket implementation in net/core/sock.c in the Linux kernel before 2.6.35 does not properly manage a backlog of received packets which allows remote attackers to cause a denial of service by sending a large amount of network traffic related to the sk_add_backlog function and the sk_rmem_alloc socket field. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4251.


The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS before 15.0(1)XA5 allows remote attackers to cause a denial of service (CPU consumption and device hang) by sending many Router Advertisement (RA) messages with different source addresses as demonstrated by the flood_router6 program in the thc-ipv6 package aka Bug ID CSCti33534.


The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125 does not properly select times for garbage collection of inflight sockets which allows local users to cause a denial of service (system hang) via crafted use of the socketpair and sendmsg system calls for SOCK_SEQPACKET sockets.


IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.63 (aka 6.0.0.8-TIV-ITDS-IF0005) allows remote authenticated users to cause a denial of service (daemon crash or hang) via a paged search as demonstrated by a certain idsldapsearch command related to an improper ibm-slapdIdleTimeOut configuration setting.


Google Chrome before 8.0.552.215 does not properly handle HTTP proxy authentication which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.


Double free vulnerability in libxml2 2.7.8 and other versions as used in Google Chrome before 8.0.552.215 and other products allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.


Memory leak in IBM Lotus Notes Traveler before 8.5.1.1 allows remote attackers to cause a denial of service (memory consumption and daemon outage) by sending many embedded objects in e-mail messages for iPhone clients.


Cisco IOS before 15.0(1)XA1 when certain TFTP debugging is enabled allows remote attackers to cause a denial of service (device crash) via a TFTP copy over IPv6 aka Bug ID CSCtb28877.


The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms when paravirtualization is enabled does not verify that kernel mode is used to call the handle_gdt_ldt_mapping_fault function which allows guest OS users to cause a denial of service (host OS BUG_ON) via a crafted memory access.


The ProcRenderAddGlyphs function in the Render extension (render/render.c) in X.Org xserver 1.7.7 and earlier allows local users to read arbitrary memory and possibly cause a denial of service (server crash) via unspecified vectors related to an \input sanitization flaw.\


The Mobile Network Connections functionality in the Connection Manager in IBM Lotus Mobile Connect before 6.1.4 when HTTP Access Services (HTTP-AS) is enabled does not properly handle failed attempts at establishing HTTP-TCP sessions which allows remote attackers to cause a denial of service (memory consumption and daemon crash) by making many TCP connection attempts.


HP HP-UX B.11.11 B.11.23 and B.11.31 does not properly support threaded processes which allows remote authenticated users to cause a denial of service via unspecified vectors.


A vulnerability which was classified as problematic was found in Shemes GrabIt up to 1.7.2 Beta 4. This affects the component NZB Date Parser. The manipulation of the argument date with the input 1000000000000000 as part of a NZB File leads to a denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.


HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.


In GPAC 2.1-DEV-rev87-g053aae8-master function BS_ReadByte() in utils/bitstream.c has a failed assertion which causes a Denial of Service. This vulnerability was fixed in commit 9ea93a2.


Windows WLAN AutoConfig Service Denial of Service Vulnerability.


A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing.


The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true potentially leading to Denial of Service by breaking the site.


A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSH_PROMISE frame where the frame contains padding information without any other data. This logical error caused confusion about the size of the frame leading to a parsing error. This parsing error immediately crashes the entire process. Sending a HEADERS frame or PUSH_PROMISE frame with HTTP/2 padding information does not require any special permission so any HTTP/2 connection peer may send such a frame. For clients this means any server to which they connect may launch this attack. For servers anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send an appropriately crafted frame. The impact on availability is high: receiving the frame immediately crashes the server dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send appropriately crafted frames so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself: swift-nio-http2 is parsing the frame in memory-safe code so the crash is safe. However sudden process crashes can lead to violations of invariants in services so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.


Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or crafted capture file


Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.


Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file


Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.


An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5 all versions starting from 14.5.0 before 14.5.3 all versions starting from 14.6.0 before 14.6.2. GitLab was not correctly handling requests to delete existing packages which could result in a Denial of Service under specific conditions.


The Popup | Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages as such data can be sent by unauthenticated user and is not validated in length this could cause a denial of service on the blog


An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4 all versions starting from 14.6.0 before 14.6.4 all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries which could result in a Denial of Service under specific conditions.


Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources the fix is available with commit eecb0712.


Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file


Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file


An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user to delete arbitrary system files and impact the system integrity or cause a denial of service condition. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.4; Cortex XDR agent 7.3 versions earlier than Cortex XDR agent 7.3.2.


A flaw was found in the way HAProxy processed HTTP responses containing the \Set-Cookie2\ header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.


The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks placed in the plugin directory allowing unauthenticated user to remotely delete the plugin files leading to a potential Denial of Service situation.


Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources a fix is available with commit 561599c.


Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file


In the MZ Automation LibIEC61850 in versions prior to 1.5.1 an unauthenticated attacker can craft a goose message which may result in a denial of service.


Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leading to Denial of Service.


A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.


The OPENSSL_LH_flush() function which empties a hash table contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0 3.0.1 3.0.2).


A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory it calls free() on an uninitialized pointer leading to a segmentation fault and a denial of service.


heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.


A

denial

of

service

vulnerability

was

found

in

tildearrow

Furnace.

It

has

been

classified

as

problematic.

This

is

due

to

an

incomplete

fix

of

It

is

possible

to

initiate

the

attack

remotely

but

it

requires

user

interaction.

The

issue

got

fixed

with

the

patch


A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0) SCALANCE W1788-2 EEC M12 (All versions < V3.0.0) SCALANCE W1788-2 M12 (All versions < V3.0.0) SCALANCE W1788-2IA M12 (All versions < V3.0.0). Affected devices do not properly handle malformed TCP packets received over the RemoteCapture feature. This could allow an attacker to lead to a denial of service condition which only affects the port used by the RemoteCapture feature.


Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager the application may crash leading to denial of service but can be restarted automatically.


Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular this issue exists in HtmlUnit-Neko through 2.26 and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6) but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24939.


Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of service. The patch adds buffer size check logic.


A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0) SCALANCE W1788-2 EEC M12 (All versions < V3.0.0) SCALANCE W1788-2 M12 (All versions < V3.0.0) SCALANCE W1788-2IA M12 (All versions < V3.0.0). Affected devices do not properly handle malformed Multicast LLC frames. This could allow an attacker to trigger a denial of service condition.


By

overlong

input

values

an

attacker

may

force

overwrite

of

the

internal

program

stack

in

SAP

Web

Dispatcher

versions

or

Internet

Communication

Manager

versions

KERNEL

which

makes

these

programs

unavailable

leading

to

denial

of

service.


Improper buffer size check logic in wmfextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of service. The patch adds buffer size check logic.


NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the product receives input or data but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly which may lead to denial of service or data tampering.


NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko) where it may lead to a use-after-free which in turn may cause denial of service. This attack is complex to carry out because the attacker needs to have control over freeing some host side resources out of sequence which requires elevated privileges.


NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the product receives input or data but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly which may lead to denial of service.


NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko) where uncontrolled resource consumption can be triggered by an unprivileged regular user which may lead to denial of service.


A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADA server when receiving a malformed HTTP request. Affected Product: ClearSCADA (All Versions) EcoStruxure Geo SCADA Expert 2019 (All Versions) EcoStruxure Geo SCADA Expert 2020 (All Versions)


metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library.


grpc-swift is the Swift language implementation of gRPC a remote procedure call (RPC) framework. Prior to version 1.7.2 a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will crash dropping all in flight connections and requests. This issue is fixed in version 1.7.2. There are currently no known workarounds.


http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the \GET\ method as a workaround.


A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after frame parsing but before frame handling. ORIGIN and ALTSVC frames are not currently supported by swift-nio-http2 and should be ignored. However one code path that encounters them has a deliberate trap instead. This was left behind from the original development process and was never removed. Sending an ALTSVC or ORIGIN frame does not require any special permission so any HTTP/2 connection peer may send such a frame. For clients this means any server to which they connect may launch this attack. For servers anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send one of these frames. The impact on availability is high: receiving the frame immediately crashes the server dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send these frames so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself. This is a controlled intentional crash. However sudden process crashes can lead to violations of invariants in services so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.


Pomerium is an identity-aware access proxy. In distributed service mode Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy including Pomerium's own proxy service.


CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the `appsettings.json` file or alternatively setting the environment variables `ALLOWEDMETHODS__POST` and `ALLOWEDMETHODS__DELETE` to `false`.


Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0. Users are recommended to upgrade.


Nextcloud server is an open source self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud Server is upgraded to 21.0.8 22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the `'enable_previews'` config flag.


When reading a specially crafted JPEG file metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library.


A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS frame where the frame contains priority information without any other data. This logical error caused confusion about the size of the frame leading to a parsing error. This parsing error immediately crashes the entire process. Sending a HEADERS frame with HTTP/2 priority information does not require any special permission so any HTTP/2 connection peer may send such a frame. For clients this means any server to which they connect may launch this attack. For servers anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send an appropriately crafted frame. The impact on availability is high: receiving the frame immediately crashes the server dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send appropriately crafted frames so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself: swift-nio-http2 is parsing the frame in memory-safe code so the crash is safe. However sudden process crashes can lead to violations of invariants in services so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.


An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mongod denial of service or server crash. This issue affects: MongoDB Inc. MongoDB Server v5.0 versions prior to and including v5.0.6.


zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.


regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this it us not recommend to deny known problematic regexes.


Microsoft Defender Denial of Service Vulnerability.


An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application is affected by Denial of Service. An unauthenticated attacker who can send POST requests to the /download/set.cgi page by manipulating the failhtmfile variable is able to cause interruption of the service provided by the Web Application.


A vulnerability has been identified in SIMATIC CFU DIQ (All versions) SIMATIC CFU PA (All versions) SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.0.0) SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions) SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) (All versions < V6.0.10) SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions) SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants) (All versions) SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) (All versions) SIMATIC TDC CP51M1 (All versions) SIMATIC TDC CPU555 (All versions) SIMATIC WinAC RTX (All versions) SIMIT Simulation Platform (All versions). The PROFINET (PNIO) stack when integrated with the Interniche IP stack improperly handles internal resources for TCP segments where the minimum TCP-Header length is less than defined. This could allow an attacker to create a denial of service condition for TCP services on affected devices by sending specially crafted TCP segments.


ASUS RT-AC86U has improper user request handling which allows an unauthenticated LAN attacker to cause a denial of service by sending particular request a server-to-client reply attempt.


The PAM module for fscrypt doesn't adequately validate fscrypt metadata files allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above


SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service.


SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service (memory exhaustion) upon an attempt to parse a large or infinite file (such as a block or character device).


SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.


SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service.


In Apache Tika a regular expression in our StandardsText class used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler which is a non-standard handler. This is fixed in 1.28.2 and 2.4.0


.NET Framework Denial of Service Vulnerability.


There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinates. It can be triggered by (for example) sending a crafted pdf file to the pdftotext binary which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.


A denial of service vulnerability exists in the libxm_av.so DemuxCmdInBuffer functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network packets can lead to a device reboot. An attacker can send packets to trigger this vulnerability.


Windows Secure Channel Denial of Service Vulnerability.


Windows LDAP Denial of Service Vulnerability.


Windows User Account Profile Picture Denial of Service Vulnerability.


In spring framework versions prior to 5.3.20+ 5.2.22+ and old unsupported versions application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.


A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus) when sending a large number of TCP RST or FIN packets to any open TCP port of the PLC. Affected Product: Modicon M340 CPUs: BMXP34 (All Versions)


n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.


Dell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability. A Local High Privileged attacker could potentially exploit this vulnerability leading to arbitrary writes or denial of service.


An issue was discovered in SaltStack Salt in versions before 3002.8 3003.4 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.


IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5 2.0 2.1 3.0 and 3.1) may be vulnerable to denial of service due to excessive rate limiting.