RockLiffe MailSite HTTP Mail management agent (httpma) 7.0.3.1 allows remote attackers to cause a denial of service (CPU consumption and crash) via a malformed query string containing special characters such as \|\.


Linksys BEFVP41 VPN Router 2.0 with firmware 1.01.04 allows remote attackers on the local network to cause a denial of service via IP packets with a null IP option length.


PostgreSQL 7.3.x before 7.3.14 7.4.x before 7.4.12 8.0.x before 8.0.7 and 8.1.x before 8.1.3 when compiled with Asserts enabled allows local users to cause a denial of service (server crash) via a crafted SET SESSION AUTHORIZATION command a different vulnerability than CVE-2006-0553.


PostgreSQL 8.0.x before 8.0.6 and 8.1.x before 8.1.2 when running on Windows allows remote attackers to cause a denial of service (postmaster exit and no new connections) via a large number of simultaneous connection requests.


POPFile before 0.22.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors involving character sets within e-mail messages.


Oreka before 0.5 allows remote attackers to cause a denial of service (application crash) via a \certain RTP sequence.\


Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20 as used in multiple CA products allows remote attackers to cause a denial of service via a crafted message to TCP port 4105.


eStara SIP softphone allows remote attackers to cause a denial of service (crash) via an INVITE request with a Content-Length field that has more than 9 digits.


Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (application crash) via multiple vectors involving (1) a malformed message sent to an \Out Of Office\ agent (SPR LPEE6DMQWJ) (2) the compact command (RTIN5U2SAJ) (3) malformed bitmap images (MYAA6FH5HW) (4) the \Delete Attachment\ action (YPHG6844LD) (5) parsing certificates from a remote Certificate Table (AELE6DZFJW) and (6) creating a SSL key ring with the Domino Administration client (NSUA4FQPTN).


aMSN (aka Alvaro's Messenger) allows remote attackers to cause a denial of service (client hang and termination of client's instant-messaging session) by repeatedly sending crafted data to the default file-transfer port (TCP 6891).


EMC Dantz Retrospect 7 backup client 7.0.107 and other versions before 7.0.109 and 6.5 before 6.5.138 allows remote attackers to cause a denial of service (client termination and loss of backup service) via a malformed packet to TCP port 497 which triggers an assert error.


Selective Acknowledgement (SACK) in FreeBSD 5.3 and 5.4 does not properly handle an incoming selective acknowledgement when there is insufficient memory which might allow remote attackers to cause a denial of service (infinite loop).


uConfig agent in Compex NetPassage WPE54G router allows remote attackers to cause a denial of service (unresposiveness) via crafted datagrams to UDP port 7778.


GNOME Evolution 2.4.2.1 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a text e-mail with a large number of URLs possibly due to unknown problems in gtkhtml.


Early termination vulnerability in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allows remote attackers to cause a denial of service (infinite loop) by sending an APPEND command and disconnecting before the expected amount of data is sent.


The LDAP component in CommuniGate Pro Core Server 5.0.7 allows remote attackers to cause a denial of service (application crash) via LDAP messages that contain Distinguished Names (DN) fields with a large number of elements.


Integer underflow in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a font file with an odd number of blue values which causes the underflow when decrementing by 2 in a context that assumes an even number of values.


Unspecified vulnerability in MailEnable Enterprise Edition before 1.2 allows remote attackers to cause a denial of service (CPU utilization) by viewing \formatted quoted-printable emails\ via webmail.


Ari Pikivirta Home Ftp Server 1.0.7 allows remote attackers to cause an unspecified denial of service via a long USER command combined with a long PASS command.


Multiple memory leaks in the LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (memory consumption) via invalid BER packets that trigger an error which might prevent memory from being freed if it was allocated during the ber_scanf call as demonstrated using the ProtoVer LDAP test suite.


The die_if_kernel function in arch/ia64/kernel/unaligned.c in Linux kernel 2.6.x before 2.6.15.6 possibly when compiled with certain versions of gcc has the \noreturn\ attribute set which allows local users to cause a denial of service by causing user faults on Itanium systems.


Multiple format string vulnerabilities in eStara SIP softphone allow remote attackers to cause a denial of service (hang) via SIP INVITE requests with format string specifiers in the SDP session description as demonstrated using (1) the field name (2) the o field (owner/creator and session identifier) or (3) the m field (media name and transport address).


Multiple memory leaks in IBM Lotus Notes and Domino Server before 6.5.5 allow attackers to cause a denial of service (memory consumption and crash) via unknown vectors related to (1) unspecified vectors during the SSL handshake (SPR# MKIN67MQVW) (2) the stash file during the SSL handshake (SPR# MKIN693QUT) and possibly other vectors. NOTE: due to insufficient information in the original vendor advisory it is not clear whether there is an attacker role in other memory leaks that are specified in the advisory.


TippingPoint Intrusion Prevention System (IPS) TOS before 2.1.4.6324 and TOS 2.2.x before 2.2.1.6506 allow remote attackers to cause a denial of service (CPU consumption) via an unknown vector probably involving an HTTP request with a negative number in the Content-Length header.


Linux kernel before 2.6.15.3 down to 2.6.12 while constructing an ICMP response in icmp_send does not properly handle when the ip_options_echo function in icmp.c fails which allows remote attackers to cause a denial of service (crash) via vectors such as (1) record-route and (2) timestamp IP options with the needaddr bit set and a truncated value.


Computer Associates (CA) Message Queuing (CAM / CAFT) before 1.07 Build 220_16 and 1.11 Build 29_20 as used in multiple CA products allows remote attackers to cause a denial of service via spoofed CAM control messages.


Microsoft Windows Graphics Rendering Engine (GRE) allows remote attackers to corrupt memory and cause a denial of service (crash) via a WMF file containing (1) ExtCreateRegion or (2) ExtEscape function calls with arguments with inconsistent lengths.


unix_random.c in lshd for lsh 2.0.1 leaks file descriptors related to the randomness generator which allows local users to cause a denial of service by truncating the seed file which prevents the server from starting or obtain sensitive seed information that could be used to crack keys.


The default configuration of the DNS Server service on Windows Server 2003 and Windows 2000 and the Microsoft DNS Server service on Windows NT 4.0 allows recursive queries and provides additional delegation information to arbitrary IP addresses which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.


QNX Neutrino RTOS 6.3.0 allows local users to cause a denial of service (hang) by supplying a \break *0xb032d59f\ command to gdb.


Multiple unspecified vulnerabilities in Kerio WinRoute Firewall before 6.1.4 Patch 1 allow remote attackers to cause a denial of service via multiple unspecified vectors involving (1) long strings received from Active Directory and (2) the filtering of HTML.


zbattle.net Zbattle client 1.09 SR-1 beta allows remote attackers to cause an unspecified denial of service by rapidly creating and closing a game.


Grant Averett Cerberus FTP Server 2.32 and possibly earlier versions allows remote attackers to cause an unspecified denial of service via a long string that does not contain a valid FTP command.


ialmnt5.sys in the ialmrnt5 display driver in Intel Graphics Accelerator Driver 6.14.10.4308 allows attackers to cause a denial of service (crash or screen resolution change) via a long text field as demonstrated using a long window title.


IPSec when used with VPN networks in Mac OS X 10.4 through 10.4.5 allows remote attackers to cause a denial of service (application crash) via unspecified vectors involving the \incorrect handling of error conditions\.


CipherTrust IronMail 5.0.1 when \Denial of Service Protection\ is enabled allows remote attackers to cause a denial of service (possibly CPU consumption) via a SYN flood with malformed TCP packets from multiple connections.


Multiple unspecified vulnerabilities in Dovecot before 1.0beta3 allow remote attackers to cause a denial of service (application crash or hang) via unspecified vectors involving (1) \potential hangs\ in the APPEND command and \potential crashes\ in (2) dovecot-auth and (3) imap/pop3-login. NOTE: vector 2 might be related to a double free vulnerability.


PHP-Ping 1.3 does not properly validate ping counts which allows remote attackers to cause a denial of service (ping flood) via a negative count parameter.


The XClientMessageEvent struct used in certain components of X.Org 6.8.2 and earlier possibly including (1) the X server and (2) Xlib uses a \long\ specifier for elements of the l array which results in inconsistent sizes in the struct on 32-bit versus 64-bit platforms and might allow attackers to cause a denial of service (application crash) and possibly conduct other attacks.


The DCC ACCEPT command handler in irssi before 0.8.9+0.8.10rc5-0ubuntu4.1 in Ubuntu Linux and possibly other distributions allows remote attackers to cause a denial of service (application crash) via certain crafted arguments in a DCC command.


The SV_CheckForDuplicateNames function in Valve Software Half-Life CSTRIKE Dedicated Server 1.6 and earlier allows remote authenticated users to cause a denial of service (infinite loop and daemon hang) via a backslash character at the end of a connection string to UDP port 27015.


nuauth in NuFW before 1.0.21 does not properly handle blocking TLS sockets which allows remote authenticated users to cause a denial of service (service hang) by flooding packets at the authentication server.


packets.c in Freeciv 2.0 before 2.0.8 allows remote attackers to cause a denial of service (server crash) via crafted packets with negative compressed size values.


Qualcomm Eudora Internet Mail Server (EIMS) before 3.2.8 allows remote attackers to cause a denial of service (crash) via (1) malformed NTLM authentication requests or a malformed (2) Incoming Mail X or (3) Temporary Mail file.


The strnlen_user function in Linux kernel before 2.6.16 on IBM S/390 can return an incorrect value which allows local users to cause a denial of service via unknown vectors.


index.php in Invision Power Board (IPB) 2.0.1 with Code Confirmation disabled allows remote attackers to cause an unspecified denial of service by registering a large number of users.


telnetd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2 allows remote unauthenticated attackers to cause a denial of service (server crash) via unknown vectors that trigger a null dereference.


MPM SIP HP-180W Wireless IP Phone WE.00.17 allows remote attackers to obtain sensitive information and possibly cause a denial of service via a direct connection to UDP port 9090 which is undocumented and does not require authentication.


IMAP service in MailEnable Professional Edition before 1.72 allows remote attackers to cause a denial of service (service crash) via unspecified vectors involving the EXAMINE command.


Unspecified vulnerability in Pioneers (formerly gnocatan) before 0.9.49 allows remote attackers to cause a denial of service (application crash) via long chat messages.


Certain configurations of BEA WebLogic Server and WebLogic Express 9.0 8.1 through SP5 and 7.0 through SP6 when connection filters are enabled cause the server to run more slowly which makes it easier for remote attackers to cause a denial of service (server slowdown).


The DM Primer (dmprimer.exe) in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0 BrightStor ARCserve Backup for Laptops & Desktops r11.0 r11.1 r11.1 SP1 Unicenter Remote Control 6.0 6.0 SP1 CA Desktop Protection Suite r2 CA Server Protection Suite r2 and CA Business Protection Suite r2 allows remote attackers to cause a denial of service (CPU consumption or application hang) via a large network packet which causes a WSAEMESGSIZE error code that is not handled leading to a thread exit.


Mozilla Thunderbird 1.5 allows user-assisted attackers to cause an unspecified denial of service by tricking the user into importing an LDIF file with a long field into the address book as demonstrated by a long homePhone field.


Helmsman Research (aka CoolUtils) HomeFtp 1.1 allows remote attackers to cause an unspecified denial of service via a long USER command combined with a long PASS command and an NLST command.


D-Link DWL-G700AP with firmware 2.00 and 2.01 allows remote attackers to cause a denial of service (CAMEO HTTP service crash) via a request composed of \GET\ followed by a space and two newlines possibly triggering the crash due to missing arguments.


BEA WebLogic Server and WebLogic Express 9.0 8.1 through SP5 and 7.0 through SP6 allows anonymous binds to the embedded LDAP server which allows remote attackers to read user entries or cause a denial of service (unspecified) via a large number of connections.


dn2ancestor in the LDAP component in Fedora Directory Server 1.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via a ModDN operation with a DN that contains a large number of \ \ (comma) characters which results in a large amount of recursion as demonstrated using the ProtoVer LDAP test suite.


Unspecified vulnerability in EmuLinker Kaillera Server before 0.99.17 allows remote attackers to cause a denial of service (probably resource consumption) via a crafted packet that causes a \ghost game\ to be left on the server.


A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3 5.4 and 6.0 and OpenBSD when a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule is being used allows remote attackers to cause a denial of service (crash) via crafted packets that cause a packet fragment to be inserted twice.


Cisco CallManager 3.2 and earlier 3.3 before 3.3(5)SR1 4.0 before 4.0(2a)SR2c and 4.1 before 4.1(3)SR2 allow remote attackers to (1) cause a denial of service (CPU and memory consumption) via a large number of open TCP connections to port 2000 and (2) cause a denial of service (fill the Windows Service Manager communication queue) via a large number of TCP connections to port 2001 2002 or 7727.


Unspecified vulnerability in Sun Solaris 10 allows local users to cause a denial of service (null dereference) via unspecified vectors involving the use of the find command on the \/proc\ filesystem. NOTE: due to the vagueness of the vendor advisory it is not clear whether this is related to CVE-2005-3250.


IBM Lotus Domino Server 7.0 allows remote attackers to cause a denial of service (segmentation fault) via a crafted packet to the LDAP port (389/TCP).


The netlink_rcv_skb function in af_netlink.c in Linux kernel 2.6.14 and 2.6.15 allows local users to cause a denial of service (infinite loop) via a nlmsg_len field of 0.


Rockliffe MailSite 7.0 and earlier allows remote attackers to cause a denial of service by sending crafted LDAP packets to port 389/TCP as demonstrated by the ProtoVer LDAP testsuite.


perfmon (perfmon.c) in Linux kernel on IA64 architectures allows local users to cause a denial of service (crash) by interrupting a task while another process is accessing the mm_struct which triggers a BUG_ON action in the put_page_testzero function.


Linux kernel 2.6.15.1 and earlier when running on SPARC architectures allows local users to cause a denial of service (hang) via a \date -s\ command which causes invalid sign extended arguments to be provided to the get_compat_timespec function call.


BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding which allows remote attackers to cause a denial of service (slowdown) via unknown attack vectors that cause \looping stack overflow errors.\


Unspecified vulnerability in ESS/ Network Controller and MicroServer Web Server in Xerox WorkCentre Pro and Xerox WorkCentre running software 13.027.24.015 and 14.027.24.015 allows remote attackers to cause a denial of service via a crafted Postscript request.


NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service (CPU consumption) via crafted requests to Login.asp possibly involving the (1) \In\ and (2) \b;tnLogIn\ parameters or (3) malformed btnLogIn parameters possibly involving missing \\ (open bracket) or \\ (closing bracket) characters as demonstrated by \&btnLogIn=Log&In=&\ or \&b;tnLogIn=Log&In=&\ in the URL. NOTE: due to the lack of diagnosis by the original researcher the precise nature of the vulnerability is unclear.


NetSarang Xlpd 2.1 allows remote attackers to cause a denial of service (crash) via a large number of connections from the same IP address.


Unspecified vulnerability the edit comment formatting functionality in MediaWiki 1.5.x before 1.5.6 and 1.4.x before 1.4.14 allows attackers to cause a denial of service (infinite loop) via \certain malformed links.\


The Cisco IP Phone 7940 allows remote attackers to cause a denial of service (reboot) via a large amount of TCP SYN packets (syn flood) to arbitrary ports as demonstrated to port 80.


Unspecified vulnerability in Stack Group Bidding Protocol (SGBP) support in Cisco IOS 12.0 through 12.4 running on various Cisco products when SGBP is enabled allows remote attackers on the local network to cause a denial of service (device hang and network traffic loss) via a crafted UDP packet to port 9900.


The default configuration of ISC BIND before 9.4.1-P1 when configured as a caching name server allows recursive queries and provides additional delegation information to arbitrary IP addresses which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses.


elog before 2.5.7 r1558-4 allows remote attackers to cause a denial of service (infinite redirection) via a request with the fail parameter set to 1 which redirects to the same request.


Cisco VPN 3000 series concentrators running software 4.7.0 through 4.7.2.A allow remote attackers to cause a denial of service (device reload or user disconnect) via a crafted HTTP packet.


The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier when using Python's library email module 2.5 allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary.


eStara SIP softphone allows remote attackers to cause a denial of service (crash) via a SIP OPTIONS request with a negative Expires field.


jscript.dll in Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (application crash) via a Shockwave Flash object that contains ActionScript code that calls VBScript which in turn calls the Javascript document.write function which triggers a null dereference.


squid_redirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service (CPU consumption) via a URL with a large number of trailing / (forward slashes) which might produce inefficient regular expressions.


Format string vulnerability in the write_logfile function in ELOG before 2.6.1 allows remote attackers to cause a denial of service (server crash) via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


LDAP service in Sun Java System Directory Server 5.2 running on Linux and possibly other platforms allows remote attackers to cause a denial of service (memory allocation error) via an LDAP packet with a crafted subtree search request as demonstrated using the ProtoVer LDAP test suite.


Microsoft Word 2003 allows remote attackers to cause a denial of service (application crash) via a crafted file as demonstrated by 101_filefuzz.


Unspecified vulnerability in (1) apreq_parse_headers and (2) apreq_parse_urlencoded functions in Apache2::Request (Libapreq2) before 2.07 allows remote attackers to cause a denial of service (CPU consumption) via unknown attack vectors that result in quadratic computational complexity.


The Linux Kernel before 2.6.15.5 allows local users to cause a denial of service (NFS client panic) via unknown attack vectors related to the use of O_DIRECT (direct I/O).


The DM Primer in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0 BrightStor ARCserve Backup for Laptops & Desktops r11.0 r11.1 r11.1 SP1 Unicenter Remote Control 6.0 6.0 SP1 CA Desktop Protection Suite r2 CA Server Protection Suite r2 and CA Business Protection Suite r2 allows remote attackers to cause a denial of service (CPU consumption and log file consumption) via unspecified \unrecognized network messages\ that are not properly handled.


Kerio WinRoute Firewall before 6.1.4 Patch 2 allows attackers to cause a denial of service (CPU consumption and hang) via unknown vectors involving \browsing the web\.


Cisco IOS before 12.3-7-JA2 on Aironet Wireless Access Points (WAP) allows remote authenticated users to cause a denial of service (termination of packet passing or termination of client connections) by sending the management interface a large number of spoofed ARP packets which creates a large ARP table that exhausts memory aka Bug ID CSCsc16644.


The LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (crash) via a certain \bad BER sequence\ that results in a free of uninitialized memory as demonstrated using the ProtoVer LDAP test suite.


nfsd in FreeBSD 6.0 kernel allows remote attackers to cause a denial of service via a crafted NFS mount request as demonstrated by the ProtoVer NFS test suite.


The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in the Shoichi Sakane KAME Project racoon as used by NetBSD 1.6 2.x before 20060119 certain FreeBSD releases and possibly other distributions of BSD or Linux operating systems when running in aggressive mode allows remote attackers to cause a denial of service (daemon crash) via crafted IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.


The Bourne shell (sh) in Solaris 8 9 and 10 allows local users to cause a denial of service (sh crash) via an unspecified attack vector that causes sh processes to crash during creation of temporary files.


Unspecified vulnerability in Veritas Backup Exec for Windows Server Remote Agent 9.1 through 10.1 for Netware Servers and Remote Agent 9.1 and 9.2 and Remote Agent for Linux Servers 10.0 and 10.1 allow attackers to cause a denial of service (application crash or unavailability) due to \memory errors.\


Unspecified vulnerability in swagentd in HP-UX B.11.00 B.11.04 and B.11.11 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.


Cisco IOS XR when configured for Multi Protocol Label Switching (MPLS) and running on Cisco CRS-1 routers allows remote attackers to cause a denial of service (Modular Services Cards (MSC) crash or \MPLS packet handling problems\) via certain MPLS packets as identified by Cisco bug IDs (1) CSCsd15970 and (2) CSCsd55531.


Mozilla Camino 1.0 and earlier allow remote attackers to cause a denial of service (null dereference and application crash or hang) via HTML with certain improperly nested elements. NOTE: this might be the same issue as CVE-2006-1724.


Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components or are restricted documents located under the ASP.NET application path.


mshtml.dll 6.00.2900.2873 as used in Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via nested OBJECT tags which trigger invalid pointer dereferences including NULL dereferences. NOTE: the possibility of code execution was originally theorized but Microsoft has stated that this issue is non-exploitable.


Tamarack MMSd before 7.992 allows remote attackers to cause a denial of service (crash) via malformed RFC1006 (OSI over TCP/IP) packets.


Sauerbraten 2006_02_28 as derived from the Cube engine allows remote attackers to cause a denial of service (client exit) by forcing the server to change to a map (ogz) file whose name contains \..\ sequences and has a certain length that prevents the addition of the \.ogz\ extension.


Linux kernel 2.6.16-rc2 and earlier when running on x86_64 systems with preemption enabled allows local users to cause a denial of service (oops) via multiple ptrace tasks that perform single steps which can cause corruption of the DEBUG_STACK stack during the do_debug function call.


Apple

Safari

allows

remote

attackers

to

cause

a

denial

of

service

and

possibly

execute

code

via

a

large

CELLSPACING

attribute

in

a

TABLE

tag

which

triggers

an

error

in

KWQListIteratorImpl::KWQListIteratorImpl.


The sys_add_key function in the keyring code in Linux kernel 2.6.16.1 and 2.6.17-rc1 and possibly earlier versions allows local users to cause a denial of service (OOPS) via keyctl requests that add a key to a user key instead of a keyring key which causes an invalid dereference in the __keyring_search_one function.


The cli_bitset_set function in libclamav/others.c in Clam AntiVirus (ClamAV) before 0.88.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger an \invalid memory access.\


The enet_protocol_handle_send_fragment function in protocol.c for ENet library CVS version Jul 2005 and earlier as used in products including (1) Cube (2) Sauerbraten and (3) Duke3d_w32 allows remote attackers to cause a denial of service (application crash) via a packet fragment with a large total data size which triggers an application abort when memory allocation fails.


Multiple unspecified vulnerabilities in Xerox CopyCentre and Xerox WorkCentre Pro running software 1.001.02.073 or earlier or 1.001.02.074 before 1.001.02.715 allow remote attackers to cause an unspecified denial of service via a crafted PostScript file that will (1) \navigate through the directory\ or (2) a \file sent to expose TCP/IP ports\.


Memory leak in __setlease in fs/locks.c in Linux kernel before 2.6.16.16 allows attackers to cause a denial of service (memory consumption) via unspecified actions related to an \uninitialised return value \ aka \slab leak.\


Linksys WRT54G routers version 5 (running VXWorks) allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel which causes an IRC connection reset possibly related to the masquerading code for NAT environments and as demonstrated via (1) a DCC SEND with a single long argument or (2) a DCC SEND with IP port and filesize arguments with a 0 value.


Apple Safari 2.0.3 allows remote attackers to cause a denial of service and possibly execute code via an invalid FRAME tag possibly due to (1) multiple SCROLLING attributes with no values or (2) a SRC attribute with no value. NOTE: due to lack of diagnosis by the researcher it is unclear which vector is responsible.


Unspecified vulnerability in GlobalSCAPE Secure FTP Server before 3.1.4 Build 01.10.2006 allows attackers to cause a denial of service (application crash) via a \custom command\ with a long argument.


feedcreator.class.php (aka the syndication component) in Joomla! 1.0.7 allows remote attackers to cause a denial of service (stressed file cache) by creating many files via filenames in the feed parameter to index.php.


Unspecified vulnerability in the HTTP compression functionality in Cisco CSS 11500 Series Content Services switches allows remote attackers to cause a denial of service (device reload) via (1) \valid but obsolete\ or (2) \specially crafted\ HTTP requests.


Integer signedness error in the enet_protocol_handle_incoming_commands function in protocol.c for ENet library CVS version Jul 2005 and earlier as used in products including (1) Cube (2) Sauerbraten and (3) Duke3d_w32 allows remote attackers to cause a denial of service (application crash) via a packet with a large command length value which leads to an invalid memory access.


** DISPUTED ** Mozilla Firefox 1.0.7 and 1.5.0.1 allows remote attackers to cause a denial of service (crash) via an HTML tag with a large number of script action handlers such as onload and onmouseover which triggers the crash when the user views the page source. NOTE: Red Hat has disputed this issue suggesting that \It is likely the reporter was running the IE Tab extension \ and Mozilla also confirmed that this is not an issue in Firefox itself.


Multiple unspecified vulnerabilities in Ethereal 0.9.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via (1) an invalid display filter or the (2) GSM SMS (3) ASN.1-based (4) DCERPC NT (5) PER (6) RPC (7) DCERPC and (8) ASN.1 dissectors.


Unspecified vulnerability in the pagedata subsystem of the process file system (/proc) in Solaris 8 through 10 allows local users to cause a denial of service (system hang or panic) via unknown attack vectors that cause cause the kmem_oversize arena to allocate a large amount of system memory that does not get freed.


The SCTP-netfilter code in Linux kernel before 2.6.16.13 allows remote attackers to trigger a denial of service (infinite loop) via unknown vectors that cause an invalid SCTP chunk size to be processed by the for_each_sctp_chunk function.


An unspecified Fortinet product possibly Fortinet28 allows remote attackers to cause a denial of service via a \small synflood\ to the SMTP port (TCP port 25) as demonstrated by a 10-microsecond wait between sending packets. NOTE: this issue has been disputed in followup posts that suggest that a protection feature is triggering a RST.


server.cpp in Monopd 0.9.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a string containing a large number of characters that are escaped when Monopd produces XML output.


The elf_load_file function in NetBSD 2.0 through 3.0 allows local users to cause a denial of service (kernel crash) via an ELF interpreter that does not have a PT_LOAD section in its header which triggers a null dereference.


The com_rss option (rss.php) in (1) Mambo and (2) Joomla! allows remote attackers to cause a denial of service (disk consumption and possibly web-server outage) via multiple requests with different values of the feed parameter.


Kerio MailServer before 6.1.3 Patch 1 allows remote attackers to cause a denial of service (application crash) via a crafted IMAP LOGIN command.


An unspecified \logical programming mistake\ in SMART SynchronEyes Student and Teacher 6.0 and possibly earlier versions allows remote attackers to cause a denial of service via a large packet to the Teacher discovery port (UDP port 5496) which causes a thread to terminate and prevents communications on that port.


lease_init in fs/locks.c in Linux kernel before 2.6.16.16 allows attackers to cause a denial of service (fcntl_setlease lockup) via actions that cause lease_init to free a lock that might not have been allocated on the stack.


Microsoft Distributed Transaction Coordinator (MSDTC) for Windows NT 4.0 2000 SP4 XP SP1 and SP2 and Server 2003 allows remote attackers to cause a denial of service (crash) via a BuildContextW request with a large (1) UuidString or (2) GuidIn of a certain length which causes an out-of-range memory access aka the MSDTC Denial of Service Vulnerability. NOTE: this is a variant of CVE-2005-2119.


The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets which allows attackers to cause a denial of service (blocked connections) via a large amount of data.


choose_new_parent in Linux kernel before 2.6.11.12 includes certain debugging code which allows local users to cause a denial of service (panic) by causing certain circumstances involving termination of a parent process.


GGZ Gaming Zone 0.0.12 allows remote attackers to cause a denial of service (client disconnect) via inputs that produce malformed XML including (1) trailing ' (apostrophe) character on the ID attribute in a PLAYER XML tag (2) joining with a long ID attribute or non-trailing ' characters which causes a <none> name to be assigned and then disconnecting or (3) a long CDATA message attribute which prevents closing tags from being added to the string.


Cisco IOS XR when configured for Multi Protocol Label Switching (MPLS) and running on Cisco CRS-1 or Cisco 12000 series routers allows remote attackers to cause a denial of service (Line card crash) via certain MPLS packets as identified by Cisco bug ID CSCsc77475.


Webmail in MailEnable Professional Edition before 1.73 and Enterprise Edition before 1.21 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors involving \incorrectly encoded quoted-printable emails\.


Neon Responder 5.4 for LANsurveyor allows remote attackers to cause a denial of service (application outage) via a crafted Clock Synchronisation packet that triggers an access violation.


ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.


NetBSD 1.6 2.0 2.1 and 3.0 allows local users to cause a denial of service (memory exhaustion) by using the sysctl system call to lock a large buffer into physical memory.


The multiplayer menu in OpenTTD 0.4.7 allows remote attackers to cause a denial of service via a UDP packet with an incorrect size which causes the client to return to the main menu.


ip_route_input in Linux kernel 2.6 before 2.6.16.8 allows local users to cause a denial of service (panic) via a request for a route for a multicast IP address which triggers a null dereference.


register.php in PunBB 1.2.10 allows remote attackers to cause an unspecified denial of service via a flood of new user registrations.


Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service (crash from null dereference) via (1) multiple vectors in H.248 and the (2) X.509if (3) SRVLOC (4) H.245 (5) AIM and (6) general packet dissectors; and (7) the statistics counter.


Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files.


digestmd5.c in the CMU Cyrus Simple Authentication and Security Layer (SASL) library 2.1.18 and possibly other versions before 2.1.21 allows remote unauthenticated attackers to cause a denial of service (segmentation fault) via malformed inputs in DIGEST-MD5 negotiation.


The (1) ZD_MissingPlayer (2) ZD_UseItem and (3) ZD_LoadNewClientLevel functions in sv_main.cpp for (a) Zdaemon 1.08.01 and (b) X-Doom allows remote attackers to cause a denial of service (crash) via an invalid player slot or item number which causes an invalid memory access possibly due to an invalid array index.


QuickTime Streaming Server in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to cause a denial of service (crash and connection interruption) via a QuickTime movie with a missing track which triggers a null dereference.


The virtual memory implementation in Linux kernel 2.6.x allows local users to cause a denial of service (panic) by running lsof a large number of times in a way that produces a heavy system load.


Microsoft Outlook 2000 2002 and 2003 allows user-assisted remote attackers to cause a denial of service (memory exhaustion and interrupted mail recovery) via malformed e-mail header information possibly related to (1) long subject lines or (2) large numbers of recipients in To or CC headers.


Control cards for Cisco Optical Networking System (ONS) 15000 series nodes before 20060405 allow remote attackers to cause a denial of service (memory exhaustion and possibly card reset) by sending an invalid response when the final ACK is expected aka bug ID CSCei45910.


The substr_compare function in string.c in PHP 5.1.2 allows context-dependent attackers to cause a denial of service (memory access violation) via an out-of-bounds offset argument.


Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8 Mozilla Suite before 1.7.13 and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) by changing the (1) -moz-grid and (2) -moz-grid-group display styles.


Linux kernel before 2.6.13 allows local users to cause a denial of service (crash) via a dio transfer from the sg driver to memory mapped (mmap) IO space.


Jason Boettcher Liero Xtreme 0.62b and earlier allow remote attackers to cause a denial of service (application crash or hang) via a long argument to the connect command.


Matt Johnston Dropbear SSH server 0.47 and earlier as used in embedded Linux devices and on general-purpose operating systems allows remote attackers to cause a denial of service (connection slot exhaustion) via a large number of connection attempts that exceeds the MAX_UNAUTH_CLIENTS defined value of 30.


The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\c2s segfault\) by sending a \response stanza before an auth stanza\.


The WebTextRenderer(WebInternal) _CG_drawRun:style:geometry: function in Apple Safari 2.0.3 allows remote attackers to cause a denial of service (application crash) via an HTML LI tag with a large VALUE attribute (list item number) which triggers a null dereference in QPainter::drawText probably due to a failed memory allocation that uses the VALUE.


Control cards for Cisco Optical Networking System (ONS) 15000 series nodes before 20060405 allow remote attackers to cause a denial of service (card reset) via (1) a \crafted\ IP packet to a device with secure mode EMS-to-network-element access aka bug ID CSCsc51390; (2) a \crafted\ IP packet to a device with IP on the LAN interface aka bug ID CSCsd04168; and (3) a \malformed\ OSPF packet aka bug ID CSCsc54558.


The Com_sprintf function in q_shared.c in Alien Arena 2006 Gold Edition 5.00 does not properly NULL terminate certain long strings which allows remote attackers (possibly authenticated) to cause a denial of service (application crash) via a long skin weapon or model name.


Netgear 614 and 624 routers possibly running VXWorks allow remote attackers to cause a denial of service by sending a malformed DCC SEND string to an IRC channel which causes an IRC connection reset possibly related to the masquerading code for NAT environments and as demonstrated via (1) a DCC SEND with a single long argument or (2) a DCC SEND with IP port and filesize arguments with a 0 value.


/sbin/passwd in HP-UX B.11.00 B.11.11 and B.11.23 before 20060326 \does not recover gracefully from some error conditions \ which allows local users to cause a denial of service.


Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) via any scrollbar Cascading Style Sheets (CSS) property.


Unspecified vulnerability in the _cg_TIFFSetField function in Mac OS X 10.4.6 and earlier as used in applications that use ImageIO or AppKit allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a null dereference.


Unspecified vulnerability in Ethereal 0.10.4 up to 0.10.14 allows remote attackers to cause a denial of service (abort) via the SNDCP dissector.


TWiki 4.0 4.0.1 and 20010901 through 20040904 allows remote authenticated users with edit rights to cause a denial of service (infinite recursion leading to CPU and memory consumption) via INCLUDE by URL statements that form a loop such as a page that includes itself.


SMART SynchronEyes Student and Teacher 6.0 and possibly earlier versions allows remote attackers to cause a denial of service (memory consumption) via a certain packet to the Teacher discovery port that causes SynchronEyes to connect to the attacker's machine and read a value that is used as a parameter to malloc.


The installation of Debian GNU/Linux 3.1r1 from the network install CD creates /var/log/debian-installer/cdebconf with world writable permissions which allows local users to cause a denial of service (disk consumption).


Kaspersky Antivirus 5.0.5 and 5.5.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via unknown attack vectors.


Polycom SoundPoint IP 301 VoIP Desktop Phone firmware version 1.4.1.0040 allows remote attackers to cause a denial of service (reboot) via (1) a long URL sent to the HTTP daemon and (2) unspecified manipulations as demonstrated by the Nessus http_fingerprinting_hmap.nasl script.


The libarchive library in FreeBSD 6-STABLE after 2006-09-05 and before 2006-11-08 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive that causes libarchive to skip a region past the actual end of the archive which triggers an infinite loop that attempts to read more data.


The NCP Engine in Novell eDirectory before 8.7.3.8 FTF1 allows remote attackers to cause an unspecified denial of service via a certain \NCP Fragment.\


Unspecified vulnerability in Windows 2000 Advanced Server SP4 running Active Directory allows remote attackers to cause a denial of service via unknown vectors as demonstrated by a certain VulnDisco Pack module. NOTE: the provenance of this information is unknown; the details are obtained from third party information. As of 20061116 this disclosure has no actionable information. However since the VulnDisco Pack author is a reliable researcher the disclosure is being assigned a CVE identifier for tracking purposes.


Unspecified vulnerability in ClamAV before 0.88.5 allows remote attackers to cause a denial of service (scanning service crash) via a crafted Compressed HTML Help (CHM) file that causes ClamAV to \read an invalid memory location.\


radexecd.exe in HP OpenView Client Configuraton Manager (CCM) does not require authentication before executing commands in the installation directory which allows remote attackers to cause a denial of service (reboot) by calling radbootw.exe or create arbitrary files by calling radcrecv.


The owserver module in owfs and owhttpd 2.5p5 and earlier does not properly check the path type which allows attackers to cause a denial of service (application crash) related to use of the path in owshell.


The altivec_unavailable_exception function in arch/powerpc/kernel/traps.c in the Linux kernel before 2.6.19 on 64-bit systems mishandles the case where CONFIG_ALTIVEC is defined and the CPU actually supports Altivec but the Altivec support was not detected by the kernel which allows local users to cause a denial of service (panic) by triggering execution of an Altivec instruction.


Unspecified vulnerability in Yahoo! Messenger (Service 18) before 8.1.0.195 allows remote attackers to cause a denial of service (NULL dereference and application crash) via a crafted room name in a Conference Invite. NOTE: the provenance of this information is unknown; the details are obtained from third party information.


Unspecified vulnerability in StoresAndCalendarsList.cgi in Paul Smith Computer Services vCAP 1.9.0 Beta and earlier allows remote attackers to cause a denial of service via the session parameter possibly related to format string specifiers or malformed URL encoding.


The enigmail extension before 0.94.2 does not properly handle large encrypted file e-mail attachments which allows remote attackers to cause a denial of service (crash) as demonstrated with Mozilla Thunderbird.


Ubuntu Linux 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (resource consumption) by using the (1) sys_get_robust_list and (2) sys_set_robust_list functions to create processes that cannot be killed.


Unspecified vulnerability in the Network Security Services (NSS) in Sun Java System Web Server 6.0 before SP 10 and ONE Application Server 7 before Update 3 when SSLv2 is enabled allows remote authenticated users to cause a denial of service (application crash) via unspecified vectors. NOTE: due to lack of details from the vendor it is unclear whether this is related to vector 1 in CVE-2006-5201 or CVE-2006-3127.


The (1) fwdrv.sys and (2) khips.sys drivers in Sunbelt Kerio Personal Firewall 4.3.268 and earlier do not validate arguments passed through to SSDT functions including NtCreateFile NtDeleteFile NtLoadDriver NtMapViewOfSection NtOpenFile and NtSetInformationFile which allows local users to cause a denial of service (crash) and possibly other impacts via unspecified vectors.


XM Easy Personal FTP Server 5.2.1 and earlier allows remote authenticated users to cause a denial of service via a long argument to the NLST command possibly involving the -al flags.


backend/tcop/postgres.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) related to duration logging of V3-protocol Execute messages for (1) COMMIT and (2) ROLLBACK SQL statements.


McAfee Network Agent (mcnasvc.exe) 1.0.178.0 as used by multiple McAfee products possibly including Internet Security Suite Personal Firewall Plus and VirusScan allows remote attackers to cause a denial of service (agent crash) via a long packet possibly because of an invalid string position field value. NOTE: some of these details are obtained from third party information.


The soup_headers_parse function in soup-headers.c for libsoup HTTP library before 2.2.99 allows remote attackers to cause a denial of service (crash) via malformed HTTP headers probably involving missing fields or values.


Firefox 1.5.0.7 and 2.0 and Seamonkey 1.1b allows remote attackers to cause a denial of service (crash) by creating a range object using createRange calling selectNode on a DocType node (DOCUMENT_TYPE_NODE) then calling createContextualFragment on the range which triggers a null dereference. NOTE: the original Bugtraq post mentioned that code execution was possible but followup analysis has shown that it is only a null dereference.


The HTTP interface in the Motorola SURFboard SB4200 Cable Modem allows remote attackers to cause a denial of service (device crash) via a request with MfcISAPICommand set to SecretProc and a long string in the Secret parameter.


Mercury SiteScope 8.2 (8.1.2.0) allows remote authenticated users to cause a denial of service (loss of connectivity to the classic interface) via attempted HTML injection into the \new monitor description\ field.


Unspecified vulnerability in the SIP channel driver (channels/chan_sip.c) in Asterisk 1.2.x before 1.2.13 and 1.4.x before 1.4.0-beta3 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors that result in the creation of \a real pvt structure\ that uses more resources than necessary.


Research in Motion (RIM) BlackBerry Enterprise Server 4.1 SP2 before Hotfix 1 for IBM Lotus Domino might allow attackers with meeting organizer privileges to cause a denial of service (application hang) via a deleted recurrent meeting instance when changing the attendee's calendar meeting time.


Sun Solaris 10 before patch 118855-16 (20060925) when run on x64 systems using IPv6 allows remote attackers to cause a denial of service (kernel panic) via crafted IPv6 packets.


lib/exec/fetch.php in DokuWiki before 2006-03-09e allows remote attackers to cause a denial of service (CPU consumption) via large w and h parameters when resizing an image.


The tcp_fuse_rcv_drain function in the Sun Solaris 10 kernel before 20061017 when TCP Fusion is enabled allows local users to cause a denial of service (system crash) via a TCP loopback connection with both endpoints on the same system.


Sophos Anti-Virus and Endpoint Security before 6.0.5 Anti-Virus for Linux before 5.0.10 and other platforms before 4.11 when \Enabled scanning of archives\ is set allows remote attackers to cause a denial of service (infinite loop) via a malformed RAR archive with an Archive Header section with the head_size and pack_size fields set to zero.


The \\Device\\SandBox driver in Outpost Firewall PRO 4.0 (964.582.059) allows local users to cause a denial of service (system crash) via an invalid argument to the DeviceIoControl function that triggers an invalid memory operation.


** DISPUTED ** Firefox 1.5.0.7 on Kubuntu Linux allows remote attackers to cause a denial of service (crash) via a long URL in an A tag. NOTE: this issue has been disputed by several vendors who could not reproduce the report. In addition the scope of the impact - system freeze - suggests an issue that is not related to Firefox. Due to this impact CVE concurs with the dispute.


Linux kernel does not properly save or restore EFLAGS during a context switch or reset the flags when creating new threads which allows local users to cause a denial of service (process crash) as demonstrated using a process that sets the Alignment Check flag (EFLAGS 0x40000) which triggers a SIGBUS in other processes that have an unaligned access.


choShilA.bpl in PentaZip 8.5.1.190 and PentaSuite-PRO 8.5.1.221 allows local users and user-assisted remote attackers to cause a denial of service (system crash) by right clicking on a file with a long filename.


Cisco Security Agent (CSA) for Linux 4.5 before 4.5.1.657 and 5.0 before 5.0.0.193 as used by Unified CallManager (CUCM) and Unified Presence Server (CUPS) allows remote attackers to cause a denial of service (resource consumption) via a port scan with certain options.


The libksba library 0.9.12 and possibly other versions as used by gpgsm in the newpg package on SUSE LINUX allows attackers to cause a denial of service (application crash) via a malformed X.509 certificate in a signature.


The Kernel SSL Proxy service (svc:/network/ssl/proxy) in Sun Solaris 10 before 20060926 allows remote attackers to cause a denial of service (system crash) via unspecified vectors related to an SSL client.


Linux kernel before 2.6.18 when running on x86_64 systems does not properly save or restore EFLAGS during a context switch which allows local users to cause a denial of service (crash) by causing SYSENTER to set an NT flag which can trigger a crash on the IRET of the next task.


Grisoft AVG Anti-Virus before 7.1.407 allows remote attackers to cause a denial of service (crash) via a crafted DOC file that triggers a divide-by-zero error. NOTE: some of these details are obtained from third party information.


p1003_1b.c in FreeBSD 6.1 allows local users to cause an unspecified denial of service by setting a scheduler policy which should only be settable by root.


Unspecified vulnerability in IKE.NLM in Novell BorderManager 3.8 allows attackers to cause a denial of service (crash) via unknown attack vectors related to \VPN issues\ for certain \IKE and IPsec settings.\


FtpXQ Server 3.0.1 allows remote attackers to cause a denial of service (CPU exhaustion) via a long MKD command.


XORP (eXtensible Open Router Platform) 1.2 and 1.3 allows remote attackers to cause a denial of service (application crash) via an Open Shortest Path First (OSPF) Link State Advertisement (LSA) with an invalid LSA length field.


backend/parser/parse_coerce.c in PostgreSQL 7.4.1 through 7.4.14 8.0.x before 8.0.9 and 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) via a coercion of an unknown element to ANYARRAY.


War FTP Daemon (WarFTPd) 1.82.00-RC11 allows remote authenticated users to cause a denial of service via a large number of \%s\ format strings in (1) CWD (2) CDUP (3) DELE (4) NLST (5) LIST (6) SIZE and possibly other commands. NOTE: it is possible that vector 1 is an off-by-one variant or incomplete fix of CVE-2005-0312.


Intoto iGateway VPN and iGateway SSL-VPN allow context-dependent attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) \public exponent\ or (2) \public modulus\ values in X.509 certificates that require extra time to process when using RSA signature verification a related issue to CVE-2006-2940.


PowerPoint in Microsoft Office 2003 does not properly handle a container object whose position value exceeds the record length which allows user-assisted attackers to cause a denial of service (NULL dereference and application crash) via a crafted PowerPoint (.PPT) file as demonstrated by Nanika.ppt and a different vulnerability than CVE-2006-3435 CVE-2006-3876 CVE-2006-3877 and CVE-2006-4694. NOTE: the impact of this issue was originally claimed to be arbitrary code execution but later analysis demonstrated that this was erroneous.


The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS exports via unspecified vectors that trigger a kernel oops (null dereference) and a deadlock.


Hawking Technology wireless router WR254-CA uses a hardcoded IP address among the set of DNS server IP addresses which could allow remote attackers to cause a denial of service or hijack the router by attacking or spoofing the server at the hardcoded address. NOTE: it could be argued that this issue reflects an inherent limitation of DNS itself so perhaps it should not be included in CVE.


Grandstream GXP-2000 VoIP Desktop Phone firmware version 1.1.0.5 allows remote attackers to cause a denial of service (hang or reboot) via a large amount of ASCII data sent to port (1) 5060/UDP (2) 5062/UDP (3) 5064/UDP (4) 5066/UDP (5) 9876/UDP or (6) 26789/UDP.


The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier as demonstrated using a specifier that begins with a \-\ instead of \--\ and contains an inconsistent ID.


The Independent Management Architecture (IMA) service (ImaSrv.exe) in Citrix MetaFrame XP 1.0 and 2.0 and Presentation Server 3.0 and 4.0 allows remote attackers to cause a denial of service (service exit) via a crafted packet that causes the service to access an unmapped memory address and triggers an unhandled exception.


The kernel in FreeBSD 6.1 and OpenBSD 4.0 allows local users to cause a denial of service via unspecified vectors involving certain ioctl requests to /dev/crypto.


The seqfile handling (ip6fl_get_n function in ip6_flowlabel.c) in Linux kernel 2.6 up to 2.6.18-stable allows local users to cause a denial of service (hang or oops) via unspecified manipulations that trigger an infinite loop while searching for flowlabels.


The aio_setup_ring function in Linux kernel does not properly initialize a variable which allows local users to cause a denial of service (crash) via an unspecified error path that causes an incorrect free operation.


Kerio WinRoute Firewall 6.2.2 and earlier allows remote attackers to cause a denial of service (crash) via malformed DNS responses.


ufs_vnops.c in FreeBSD 6.1 allows local users to cause an unspecified denial of service by calling the ftruncate function on a file type that is not VREG VLNK or VDIR which is not defined in POSIX.


OpenLDAP before 2.3.29 allows remote attackers to cause a denial of service (daemon crash) via LDAP BIND requests with long authcid names which triggers an assertion failure.


Memory leak in the push_align function in src/util.c in Vilistextum before 2.6.9 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the tmp_align variable. NOTE: it is not clear whether this is a vulnerability due to the functionality of the product.


backend/parser/analyze.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) via certain aggregate functions in an UPDATE statement which are not properly handled during a \MIN/MAX index optimization.\


The Unidirectional Lightweight Encapsulation (ULE) decapsulation component in dvb-core/dvb_net.c in the dvb driver in the Linux kernel 2.6.17.8 allows remote attackers to cause a denial of service (crash) via an SNDU length of 0 in a ULE packet.


Unspecified vulnerability in gzip 1.3.5 allows context-dependent attackers to cause a denial of service (crash) via a crafted GZIP (gz) archive which results in a NULL dereference.


Sign extension vulnerability in the createBrushIndirect function in the GDI library (gdi32.dll) in Microsoft Windows XP Server 2003 and possibly other versions allows user-assisted attackers to cause a denial of service (application crash) via a crafted WMF file.


The Linux kernel 2.6.17.10 and 2.6.17.11 and 2.6.18-rc5 allows local users to cause a denial of service (crash) via an SCTP socket with a certain SO_LINGER value possibly related to the patch for CVE-2006-3745. NOTE: older kernel versions for specific Linux distributions are also affected due to backporting of the CVE-2006-3745 patch.


System Information ActiveX control (msinfo.dll) when accessed via Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via a SaveFile function with a long (1) computer and possibly (2) filename and (3) category argument.


Qbik WinGate 6.1.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a DNS request with a self-referencing compressed name pointer which triggers an infinite loop.


SMTP service in MailEnable Standard Professional and Enterprise before ME-10014 (20060904) allows remote attackers to cause a denial of service via an SPF lookup for a domain with a large number of records which triggers a null pointer exception.


Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (crash) via a long Color attribute in multiple DirectX Media Image DirectX Transforms ActiveX COM Objects from (a) dxtmsft.dll and (b) dxtmsft3.dll including (1) DXImageTransform.Microsoft.MaskFilter.1 (2) DXImageTransform.Microsoft.Chroma.1 and (3) DX3DTransform.Microsoft.Shapes.1.


** DISPUTED ** Unspecified vulnerability in Xchat 2.6.7 and earlier allows remote attackers to cause a denial of service (crash) via unspecified vectors involving the PRIVMSG command. NOTE: the vendor has disputed this vulnerability stating that it does not affect 2.6.7 \or any recent version\.


Unspecified vulnerability related to a \design flaw\ in SAP Internet Graphics Service (IGS) 6.40 and earlier and 7.00 and earlier allows remote attackers to cause a denial of service (service shutdown) via certain HTTP requests. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.


Unspecified vulnerability in the driver for the Client Service for NetWare (CSNW) in Microsoft Windows 2000 SP4 XP SP2 and Server 2003 up to SP1 allows remote attackers to cause a denial of service (hang and reboot) via has unknown attack vectors aka \NetWare Driver Denial of Service Vulnerability.\


Unspecified vulnerability in (1) Tor 0.1.0.x before 0.1.0.18 and 0.1.1.x before 0.1.1.23 and (2) ScatterChat before 1.0.2 allows remote attackers operating a Tor entry node to route arbitrary Tor traffic through clients or cause a denial of service (flood) via unspecified vectors.


Sophos Anti-Virus 5.1 allows remote attackers to cause a denial of service (memory consumption) via a file that is compressed with Petite and contains a large number of sections.


The BerDecodeLoginDataRequest function in the libnmasldap.so NMAS module in Novell eDirectory 8.8 and 8.8.1 before the Security Services 2.0.3 patch does not properly increment a pointer when handling certain input which allows remote attackers to cause a denial of service (invalid memory access) via a crafted login request.


The kernel in Red Hat Enterprise Linux 3 when running on SMP systems allows local users to cause a denial of service (deadlock) by running the shmat function on an shm at the same time that shmctl is removing that shm (IPC_RMID) which prevents a spinlock from being unlocked.


The manager server in Symantec Enterprise Security Manager (ESM) 6 and 6.5.x allows remote attackers to cause a denial of service (hang) via a malformed ESM agent request.


Linux kernel 2.6.17 and earlier when running on IA64 or SPARC platforms allows local users to cause a denial of service (crash) via a malformed ELF file that triggers memory maps that cross region boundaries.


Unspecified vulnerability in X.25 on HP-UX B.11.00 B.11.11 and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors.


Mozilla Firefox 1.5.0.6 allows remote attackers to cause a denial of service (crash) via a crafted FTP response when attempting to connect with a username and password via the FTP URI.


BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via certain SIG queries which cause an assertion failure when multiple RRsets are returned.


ncp in Novell eDirectory before 8.7.3 SP9 and 8.8.x before 8.8.1 FTF2 does not properly handle NCP fragments with a negative length which allows remote attackers to cause a denial of service (daemon crash) when the heap is written to a log file.


Messenger Agents (nmma.exe) in Novell GroupWise 2.0.2 and 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted HTTP POST request to TCP port 8300 with a modified val parameter which triggers a null dereference related to \zero-size strings in blowfish routines.\


epan/dissectors/packet-xot.c in the XOT dissector (dissect_xot_pdu) in Wireshark (formerly Ethereal) 0.9.8 through 0.99.3 allows remote attackers to cause a denial of service (memory consumption and crash) via an encoded XOT packet that produces a zero length value when it is decoded.


Multiple unspecified vulnerabilities in SnapGear before 3.1.4u1 allow remote attackers to cause a denial of service via unspecified vectors involving (1) IPSec replay windows and (2) the use of vulnerable versions of ClamAV before 0.88.4. NOTE: it is possible that vector 2 is related to CVE-2006-4018.


Sun StorEdge 6130 Array Controllers with firmware 06.12.10.11 and earlier allow remote attackers to cause a denial of service (controller reboot) via a flood of traffic on the LAN.


Netgear FVG318 running firmware 1.0.40 allows remote attackers to cause a denial of service (router reset) via TCP packets with bad checksums.


NETGEAR DG834GT Wireless ADSL router running firmware 1.01.28 allows attackers to cause a denial of service (device hang) via a long string in the username field in the login window.


** DISPUTED ** Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service (resource consumption) via a large number of requests to register.php. NOTE: the vendor has disputed this vulnerability stating \If you have the CAPTCHA enabled then the registrations wont even go through. ... if you are talking about the flood being allowed in the first place then surely this is something that should be handled at the server level.\


Linux kernel 2.x.6 before 2.6.17.9 and 2.4.x before 2.4.33.1 on PowerPC PPC970 systems allows local users to cause a denial of service (crash) related to the \HID0 attention enable on PPC970 at boot time.\


The Graphical Device Interface Plus library (gdiplus.dll) in Microsoft Windows XP SP2 allows context-dependent attackers to cause a denial of service (application crash) via certain images that trigger a divide-by-zero error as demonstrated by a (1) .ico file (2) .png file that crashes MSN Messenger and (3) .jpg file that crashes Internet Explorer. NOTE: another researcher has not been able to reproduce this issue.


Integer signedness error in the i386_set_ldt call in FreeBSD 5.5 and possibly earlier versions down to 5.2 allows local users to cause a denial of service (crash) via unspecified arguments that use negative signed integers to cause the bzero function to be called with a large length parameter a different vulnerability than CVE-2006-4172.


sshd in OpenSSH before 4.4 when using the version 1 SSH protocol allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks which is not properly handled by the CRC compensation attack detector.


The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) and CatOS allows remote attackers to cause a denial of service by sending a VTP update with a revision value of 0x7FFFFFFF which is incremented to 0x80000000 and is interpreted as a negative number in a signed context.


loader_tga.c in imlib2 before 1.2.1 and possibly other versions allows user-assisted remote attackers to cause a denial of service (crash) via a crafted TGA image that triggers an out-of-bounds memory read a different issue than CVE-2006-4808.


IrfanView 3.98 (with plugins) allows remote attackers to cause a denial of service (application crash) via a crafted CUR image file.


The Universal Disk Format (UDF) filesystem driver in Linux kernel 2.6.17 and earlier allows local users to cause a denial of service (hang and crash) via certain operations involving truncated files as demonstrated via the dd command.


Unspecified vulnerability in the \dependency resolution mechanism\ in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code which leads to a denial of service (application hang) or \data loss \ a different vulnerability than CVE-2006-4111.


IBM DB2 Universal Database (UDB) before 8.1 FixPak 13 allows remote authenticated users to cause a denial of service (crash) by (1) sending the first ACCSEC command without an RDBNAM parameter during the CONNECT process or (2) sending crafted SQLJRA packet which results in a null dereference.


The SSCOP dissector in Wireshark (formerly Ethereal) before 0.99.3 allows remote attackers to cause a denial of service (resource consumption) via malformed packets that cause the Q.2391 dissector to use excessive memory.


Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (crash) via a long \header line\ which causes a previously freed variable to be referenced. NOTE: the original developer has disputed the severity of this issue saying \The only denial of service that is possible here is to fill up the disk with core dumps if the OS actually generates different core dumps (which is unlikely)... the bug is in the shutdown code (finis()) which leads directly to exit(3) i.e. the process would terminate anyway no mail delivery or receiption is affected.\


Symantec Brightmail AntiSpam (SBAS) before 6.0.4 when the Control Center is allowed to connect from any computer allows remote attackers to cause a denial of service (application freeze) \by sending invalid posts\.


The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) allows remote attackers to cause a denial of service by sending a VTP version 1 summary frame with a VTP version field value of 2.


The squeue_drain function in Sun Solaris 10 possibly only when run on CMT processors allows remote attackers to cause a denial of service (\bad trap\ and system panic) by opening and closing a large number of TCP connections (\heavy TCP/IP loads\). NOTE: the original report specifies the function name as \drain_squeue \ but this is likely incorrect.


PowerDNS Recursor 3.1.3 and earlier allows remote attackers to cause a denial of service (resource exhaustion and application crash) via a CNAME record with a zero TTL which triggers an infinite loop.


Unspecified vulnerability in Niels Provos Honeyd before 1.5b allows remote attackers to cause a denial of service (application crash) via certain Address Resolution Protocol (ARP) packets.


The LDAP server (ns-slapd) in Sun Java System Directory Server 5.2 Patch4 and earlier and ONE Directory Server 5.1 and 5.2 allows remote attackers to cause a denial of service (crash) via malformed queries probably malformed BER queries which trigger a free of uninitialized memory locations.


The \\Device\\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.0.33 and other versions of Norton Personal Firewall Internet Security AntiVirus SystemWorks Symantec Client Security SCS 1.x 2.x 3.0 and 3.1 Symantec AntiVirus Corporate Edition SAVCE 8.x 9.x 10.0 and 10.1 Symantec pcAnywhere 11.5 only and Symantec Host allows local users to cause a denial of service (system crash) via invalid data as demonstrated by calling DeviceIoControl to send the data.


Verso NetPerformer FRAD ACT SDM-95xx 7.xx (R1) and earlier SDM-93xx 10.x.x (R2) and earlier and SDM-92xx 9.x.x (R1) and earlier allow remote attackers to cause a denial of service (hang or reboot) via an ICMP packet with the same destination and source address and port aka the \Land\ vulnerability.


Hewlett-Packard (HP) ProCurve 3500yl 6200yl and 5400zl switches with software before K.11.33 allow remote attackers to cause a denial of service (possibly memory leak or system crash) via unknown vectors.


The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (freed pointer dereference).


The Security Framework in Apple Mac OS X 10.4 through 10.4.8 allows remote attackers to cause a denial of service (resource consumption) via certain public key values in an X.509 certificate that requires extra resources during signature verification. NOTE: this issue may be similar to CVE-2006-2940.


MySQL before 4.1.13 allows local users to cause a denial of service (persistent replication slave crash) via a query with multiupdate and subselects.


RapDrv.sys in BlackICE PC Protection 3.6.cpn cpj cpiE and possibly 3.6 and earlier allows local users to cause a denial of service (crash) via a NULL third argument to the NtOpenSection API function. NOTE: it was later reported that 3.6.cqn is also affected.


ArcSoft MMS Composer 1.5.5.6 and possibly earlier and 2.0.0.13 and possibly earlier allow remote attackers to cause a denial of service (resource exhaustion and application crash) via WAPPush messages to UDP port UDP 2948.


The web-based management interface in 2Wire Inc. HomePortal and OfficePortal Series modems and routers allows remote attackers to cause a denial of service (crash) via a CRLF sequence in a GET request.


BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via a flood of recursive queries which cause an INSIST failure when the response is received after the recursion queue is empty.


BomberClone 0.11.6 and earlier allows remote attackers to cause a denial of service (daemon crash) via (1) a certain malformed PKGF_ackreq packet which triggers a crash in the rscache_add() function in pkgcache.c; and (2) an error packet which is intended to be received by clients and force client shutdown but also triggers server shutdown.


packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service (crash) by sending an invalid protocol sequence with USERAUTH_SUCCESS before NEWKEYS which causes newkeysmode to be NULL.


INNOVATION Data Processing FDR/UPSTREAM 3.3.0 (GA Oct 2003) allows remote attackers to cause a denial of service (service outage) via a sequence of TCP SYN packets to many ports as demonstrated using nmap. NOTE: the vendor's testing reportedly found that no denial of service occurred.


The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content which allows remote attackers to cause a denial of service (infinite loop) via crafted HTTP requests a different issue than CVE-2006-5467.


The Workstation service in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to cause a denial of service (memory consumption) via a large maxlen value in an NetrWkstaUserEnum RPC request.


The RpcGetPrinterData function in the Print Spooler (spoolsv.exe) service in Microsoft Windows 2000 SP4 and earlier and possibly Windows XP SP1 and earlier allows remote attackers to cause a denial of service (memory consumption) via an RPC request that specifies a large 'offered' value (output buffer size) a variant of CVE-2005-3644.


Use-after-free vulnerability in the LiveConnect bridge code for Mozilla Firefox 2.x before 2.0.0.1 1.5.x before 1.5.0.9 Thunderbird before 1.5.0.9 and SeaMonkey before 1.0.7 allows remote attackers to cause a denial of service (crash) via unknown vectors.


srvloc.sys in Novell Client for Windows before 4.91 SP3 allows remote attackers to cause an unspecified denial of service via a crafted packet to port 427 that triggers an access of pageable or invalid addresses using a higher interrupt request level (IRQL) than necessary.


Microsoft Windows Live Messenger 8.0 and earlier when gestual emoticons are enabled allows remote attackers to cause a denial of service (CPU consumption) via a long string composed of \:D\ sequences which are interpreted as emoticons.


Fightersoft Multimedia Star FTP server 1.10 allows remote attackers to cause a denial of service (crash) via multiple RETR commands with long arguments.


Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.exe crash) via a certain UDP packet to port 64999 aka \two bytes UDP crash \ a different vulnerability than CVE-2006-5785.


Apple Airport Extreme firmware 0.1.27 in Mac OS X 10.4.8 on Mac mini MacBook and MacBook Pro with Core Duo hardware allows remote attackers to cause a denial of service (out-of-bounds memory access and kernel panic) and have possibly other security-related impact via certain beacon frames.


Algorithmic complexity vulnerability in Snort before 2.6.1 during predicate evaluation in rule matching for certain rules allows remote attackers to cause a denial of service (CPU consumption and detection outage) via crafted network traffic aka a \backtracking attack.\


AIDeX Mini-WebServer 1.1 early release 3 allows remote attackers to cause a denial of service (daemon crash) via a flood of HTTP GET requests possibly related to display of HTTP log data by the GUI. NOTE: some of these details are obtained from third party information.


The \mechglue\ abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1 as used in Kerberos administration daemon (kadmind) and other products that use this library allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.


Format string vulnerability in XM Easy Personal FTP Server 5.2.1 allows remote attackers to cause a denial of service (application crash) via format string specifiers in the USER command or certain other available or nonexistent commands. NOTE: It was later reported that 5.3.0 is also vulnerable.


The consume_labels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) via a crafted compressed DNS response with a label that points to itself.


FRAgent.exe in Mandiant First Response (MFR) before 1.1.1 when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces) opens sockets in non-exclusive mode which allows local users to hijack the socket and capture data or cause a denial of service (loss of daemon operation).


keystone.exe in nVIDIA nView allows attackers to cause a denial of service via a long command line argument. NOTE: it is not clear whether this issue crosses security boundaries. If not then this is not a vulnerability.


Flash8b.ocx in Macromedia Flash 8 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long string in the Flash8b.AllowScriptAccess method.


The accept function in NetBSD-current before 20061023 NetBSD 3.0 and 3.0.1 before 20061024 and NetBSD 2.x before 20061029 allows local users to cause a denial of service (socket consumption) via an invalid (1) name or (2) namelen parameter which may result in the socket never being closed (aka \a dangling socket\).


formbankcgi.exe in Fersch Formbankserver 1.9 when the PATH_INFO begins with Abfrage allows remote attackers to cause a denial of service (daemon crash) via multiple requests containing many /../ sequences in the Name parameter.


SQL injection vulnerability in forum/modules/gallery/post.php in Invision Gallery 2.0.7 allows remote attackers to cause a denial of service and possibly have other impacts as demonstrated using a \SELECT BENCHMARK\ statement in the img parameter in a doaddcomment operation in index.php.


Crob FTP Server 3.6.1 b.263 allows remote attackers to cause a denial of service via a long series of \?A\ sequences in the (1) LIST and possibly (2) NLST command.


Windows Media Player 10.00.00.4036 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service via a .MID (MIDI) file with a malformed header chunk without any track chunks possibly involving (1) number of tracks of (2) time division fields that are set to 0.


The ext3fs_dirhash function in Linux kernel 2.6.x allows local users to cause a denial of service (crash) via an ext3 stream with malformed data structures.


PhoneCtrl.exe in Linksys WIP 330 Wireless-G IP Phone 1.00.06A allows remote attackers to cause a denial of service (crash) via a TCP SYN scan as demonstrated using TCP ports 1-65535 with nmap.


The server component in Marathon Aleph One before 0.17.1 and 2006-12-17 allows remote attackers to cause a denial of service (application crash) via unspecified vectors related to \gathering net games.\


F-Secure Anti-Virus for Linux Gateways 4.65 allows remote attackers to cause a denial of service (possibly fatal scan error) and possibly bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file as demonstrated with the EICAR test file.


The FTP Server in Sambar Server 6.4 allows remote authenticated users to cause a denial of service (application crash) via a long series of \./\ sequences in the SIZE command.


Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via a web page that contains a large number of nested marquee tags a related issue to CVE-2006-2723.


The (1) VetMONNT.sys and (2) VetFDDNT.sys drivers in CA Anti-Virus 2007 8.1 Anti-Virus for Vista Beta 8.2 and CA Internet Security Suite 2007 v3.0 do not properly handle NULL buffers which allows local users with administrative access to cause a denial of service (system crash) via certain IOCTLs.


fail2ban 0.7.4 and earlier does not properly parse sshd log files which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file as demonstrated by logging in via ssh with a login name containing certain strings with an IP address.


QUALCOMM Eudora WorldMail 4.0 allows remote attackers to cause a denial of service as demonstrated by a certain module in VulnDisco Pack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. As of 20061118 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


ESET NOD32 Antivirus before 1.1743 allows remote attackers to cause a denial of service (crash) via a crafted .CHM file that triggers a divide-by-zero error.


Stack consumption vulnerability in the KFILE JPEG (kfile_jpeg) plugin in kdegraphics 3 as used by konqueror digikam and other KDE image browsers allows remote attackers to cause a denial of service (stack consumption) via a crafted EXIF section in a JPEG file which results in an infinite recursion.


Nexuiz before 2.2.1 allows remote attackers to cause a denial of service (resource exhaustion or crash) via unspecified vectors related to \fake players.\ NOTE: some of these details are obtained from third party information.


WinFtp Server 2.0.2 allows remote attackers to cause a denial of service (crash) via long (1) PASV (2) LIST (3) USER (4) PORT and possibly other commands.


The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause a denial of service (application crash) via a malicious FTP server with a large number of blank 220 responses to the SYST command.


D-LINK DWL-2000AP+ firmware 2.11 allows remote attackers to cause (1) a denial of service (device reset) via a flood of ARP replies on the wired or wireless (radio) link and (2) a denial of service (device crash) via a flood of ARP requests on the wireless link.


Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (crash) via an invalid src attribute value (\?\) in an HTML frame tag that is in a frameset tag with a large rows attribute. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


The sendmsg function in NetBSD-current before 20061023 NetBSD 3.0 and 3.0.1 before 20061024 and NetBSD 2.x before 20061029 when run on a 64-bit architecture allows attackers to cause a denial of service (kernel panic) via an invalid msg_controllen parameter to the sendit function.


FRAgent.exe in Mandiant First Response (MFR) before 1.1.1 when run in daemon mode with SSL enabled allows remote attackers to cause a denial of service (refused connections) via malformed requests which results in a mishandled exception.


oftpd before 0.3.7 allows remote attackers to cause a denial of service (daemon abort) via a (1) LPRT or (2) LPASV command with an unsupported address family which triggers an assertion failure.


Sorin Chitu Telnet-FTP Server 1.0 allows remote authenticated users to cause a denial of service (crash) via consecutive RETR commands. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


The Trend Micro scan engine before 8.320 for Windows and before 8.150 on HP-UX and AIX as used in Trend Micro PC Cillin - Internet Security 2006 Office Scan 7.3 and Server Protect 5.58 allows remote attackers to cause a denial of service (CPU consumption and system hang) via a malformed RAR archive with an Archive Header section with the head_size and pack_size fields set to zero which triggers an infinite loop.


The NTFS filesystem code in Linux kernel 2.6.x up to 2.6.18 and possibly other versions allows local users to cause a denial of service (CPU consumption) via a malformed NTFS file stream that triggers an infinite loop in the __find_get_block_slow function.


The magnatune.com album browser in Amarok allows attackers to cause a denial of service (application crash) via unspecified vectors.


Flock beta 1 0.7 allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags a related issue to CVE-2006-2723.


Multiple unspecified vulnerabilities in BOMArchiveHelper in Mac OS X allow user-assisted remote attackers to cause a denial of service (application crash) via unspecified vectors related to (1) certain KERN_PROTECTION_FAILURE thread crashes and (2) certain KERN_INVALID_ADDRESS thread crashes as discovered with the \iSec Partners FileP fuzzer\.


Stack overflow in the IMAP module (MEIMAPS.EXE) in MailEnable Professional 1.6 through 1.83 and 2.0 through 2.33 and MailEnable Enterprise 1.1 through 1.40 and 2.0 through 2.33 allows remote authenticated users to cause a denial of service (crash) via a long argument containing * (asterisk) and ? (question mark) characters to the DELETE command as addressed by the ME-10020 hotfix.


BolinTech Dream FTP Server 1.02 allows remote authenticated users including anonymous users to cause a denial of service (application crash) via a certain invalid PORT command.


The GConf daemon (gconfd) in GConf 2.14.0 creates temporary files under directories with names based on the username even when GCONF_GLOBAL_LOCKS is not set which allows local users to cause a denial of service by creating the directories ahead of time which prevents other users from using Gnome.


MyODBC Japanese conversion edition 3.51.06 2.50.29 and 2.50.25 allows remote attackers to cause a denial of service via a certain string in a response which has unspecified impact on the MySQL database.


DenyHosts 2.5 does not properly parse sshd log files which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file as demonstrated by logging in via ssh with a login name containing certain strings with an IP address which is not properly handled by a regular expression.


ops3-dmn in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000 13.x before 13.050.03.000 and 14.x before 14.050.03.000 allows attackers to cause a denial of service (application crash and core dump) via a certain PS file.


WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object which allows remote authenticated users to cause a denial of service (application crash) via a string that represents a (1) malformed or (2) large serialized object because the object triggers automatic unserialization for display.


FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to cause a denial of service (infinite loop) via a crafted ACE file. NOTE: this issue has at least a partial overlap with CVE-2006-6294.


The Microsoft Office Outlook Recipient ActiveX control (ole32.dll) in Windows XP SP2 allows remote attackers to cause a denial of service (Internet Explorer 7 hang) via crafted HTML.


The SISCO OSI stack as used in SISCO MMS-EASE ICCP Toolkit for MMS-EASE AX-S4 MMS and AX-S4 ICCP and possibly other control system applications allows remote attackers to cause a denial of service (application termination and restart) via malformed packets.


The ext2 file system code in Linux kernel 2.6.x allows local users to cause a denial of service (crash) via an ext2 stream with malformed data structures that triggers an error in the ext2_check_page due to a length that is smaller than the minimum.


The IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to cause a denial of service via an APPEND command with a single \(\ (parenthesis) in the argument.


Microsoft Internet Explorer 6.0.2900.2180 allows remote attackers to cause a denial of service via a style attribute in an HTML table tag with a width value that is dynamically calculated using JavaScript.


Getahead Direct Web Remoting (DWR) before 1.1.3 allows attackers to cause a denial of service (infinite loop) via unknown vectors related to \crafted input.\


Multiple array index errors in IBM Tivoli Storage Manager (TSM) before 5.2.9 and 5.3.x before 5.3.4 allow remote attackers to read arbitrary memory locations and cause a denial of service (crash) via a large index value in unspecified messages a different issue than CVE-2006-5855.


Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document a different vulnerability than CVE-2006-5874 and CVE-2006-6406.


explorer.exe in Windows Explorer 6.00.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service via a crafted WMV file.


Unspecified vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 15 and earlier and 7.00 Patchlevel 3 and earlier allows remote attackers to cause a denial of service (service shutdown) obtain sensitive information (configuration files) and conduct certain other unauthorized activities related to \Undocumented Features.\ NOTE: it is possible that there are multiple issues. This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended. This is likely a different issue than CVE-2006-4134.


The js_dtoa function in Mozilla Firefox 2.x before 2.0.0.1 1.5.x before 1.5.0.9 Thunderbird before 1.5.0.9 and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced which allows remote attackers to cause a denial of service via any plugins that reduce the precision.


3proxy 0.5 to 0.5.2 when NT-encoded passwords are being used allows remote attackers to cause a denial of service (blocked account) via unspecified vectors related to NTLM authentication which causes a password hash to be overwritten.


The Client Server Run-Time Subsystem (CSRSS) in Microsoft Windows allows local users to cause a denial of service (crash) or read arbitrary memory from csrss.exe via crafted arguments to the NtRaiseHardError function with status 0x50000018 a different vulnerability than CVE-2006-6696.


The nodeType function in KDE libkhtml 4.2.0 and earlier as used by Konquerer KMail and other programs allows remote attackers to cause a denial of service (crash) via malformed HTML tags possibly involving a COL SPAN tag embedded in a RANGE tag.


Memory leak in pngwutil.c in libpng 1.2.13beta1 and other versions before 1.2.15beta3 allows context-dependent attackers to cause a denial of service (memory leak or segmentation fault) via a JPEG image containing an iCCP chunk with a negative embedded profile length.


The DNS module in Arkoon FAST360 UTM appliances 3.0 up to 3.0/29 3.1 through 3.3 and 4.0 allows remote attackers to cause a denial of service (reboot) via a malformed DNS message as demonstrated by the PROTOS DNS testing suite.


Perl-Compatible Regular Expression (PCRE) library before 6.7 does not properly calculate the compiled memory allocation for regular expressions that involve a quantified \subpattern containing a named recursion or subroutine reference \ which allows context-dependent attackers to cause a denial of service (error or crash).


Unspecified vulnerability in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service (crash) via a TOP command to the POP3 service.


sql_select.cc in MySQL 5.0.x before 5.0.32 and 5.1.x before 5.1.14 allows remote authenticated users to cause a denial of service (crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table as originally demonstrated using ORDER BY.


MadWifi when Ad-Hoc mode is used allows remote attackers to cause a denial of service (system crash) via unspecified vectors that lead to a kernel panic in the ieee80211_input function related to \packets coming from a 'malicious' WinXP system.\


The nscd daemon in the GNU C Library (glibc) before version 2.5 does not close incoming client sockets if they cannot be handled by the daemon allowing local users to carry out a denial of service attack on the daemon.


The SMTP service in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service (infinite loop) via a message in which neither the originator nor recipient address is known.


Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating a ADODB.Recordset object and making a series of calls to the NextRecordset method with a long string argument which causes an \invalid memory access\ in the SysFreeString function a different issue than CVE-2006-3510 and CVE-2006-3899.


Kmail 1.9.1 on KDE 3.5.2 with \Prefer HTML to Plain Text\ enabled allows remote attackers to cause a denial of service (crash) via an HTML e-mail with certain table and frameset tags that trigger a segmentation fault possibly involving invalid free or delete operations.


The sys_timer_create function in posix-timers.c for Linux kernel 2.6.x allows local users to cause a denial of service (memory consumption) and possibly bypass memory limits or cause other processes to be killed by creating a large number of posix timers which are allocated in kernel memory but are not treated as part of the process' memory.


Monkey's Audio before 4.01b2 allows remote attackers to cause a denial of service (application crash) via an APX file that lacks NULL termination.


The skge driver 1.5 in Linux kernel 2.6.15 on Ubuntu does not properly use the spin_lock and spin_unlock functions which allows remote attackers to cause a denial of service (machine crash) via a flood of network traffic.


The IMAP4 service in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service (crash) via a message with a long subject field.


Teamtek Universal FTP Server 1.0.50 allows remote attackers to cause a denial of service (daemon crash or hang) via (1) multiple STOR (aka PUT) commands or an MKD command followed by (2) a '*' argument (3) a '|' argument (4) spaces or (5) a long string. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Microsoft Internet Explorer 6 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a frameset with only one frame that calls resizeTo with certain arguments. NOTE: this issue might be related to CVE-2006-3637.


Novell BorderManager 3.8 SP4 generates the same ISAKMP cookies for the same source IP and port number during the same day which allows remote attackers to conduct denial of service and replay attacks. NOTE: this issue might be related to CVE-2006-5286.


Microsoft Internet Explorer 6.0.2900 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a table element with a CSS attribute that sets the position which triggers an \unhandled exception\ in mshtml.dll.


MadWifi before 0.9.3 does not properly handle reception of an AUTH frame by an IBSS node which allows remote attackers to cause a denial of service (system crash) via a certain AUTH frame.


Multiple unspecified vulnerabilities in Firebird 1.5 allow remote attackers to (1) cause a denial of service (application crash) by sending many remote protocol versions; and (2) cause a denial of service (connection drop) via certain network traffic as demonstrated by Nessus vulnerability scanning.


Perl-Compatible Regular Expression (PCRE) library before 6.7 allows context-dependent attackers to cause a denial of service (error or crash) via a regular expression that involves a \malformed POSIX character class\ as demonstrated via an invalid character after a sequence.


The Sandbox.sys driver in Outpost Firewall PRO 4.0 and possibly earlier versions does not validate arguments to hooked SSDT functions which allows local users to cause a denial of service (crash) via invalid arguments to the (1) NtAssignProcessToJobObject (2) NtCreateKey (3) NtCreateThread (4) NtDeleteFile (5) NtLoadDriver (6) NtOpenProcess (7) NtProtectVirtualMemory (8) NtReplaceKey (9) NtTerminateProcess (10) NtTerminateThread (11) NtUnloadDriver and (12) NtWriteVirtualMemory functions.


Single CPU Sun systems running Solaris 7 8 or 9 such as Netra allows remote attackers to cause a denial of service (console hang) via a flood of small TCP/IP packets. NOTE: this issue has not been replicated by third parties. In addition the cause is unknown although it might be related to \jabber\ and generation of a large amount of interrupts within the console or a hardware error.


Unspecified vulnerability in SAP SAPLPD and SAPSPRINT allows remote attackers to cause a denial of service (application crash) via a certain print job request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


fb_lock_mgr in Firebird 1.5 uses weak permissions (0666) for the semaphore array which allows local users to cause a denial of service (blocked query processing) by locking semaphores.


ieee80211_input.c in MadWifi before 0.9.3 does not properly process Channel Switch Announcement Information Elements (CSA IEs) which allows remote attackers to cause a denial of service (loss of communication) via a Channel Switch Count less than or equal to one triggering a channel change.


Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate the amount of memory needed for a compiled regular expression pattern when the (1) -x or (2) -i UTF-8 options change within the pattern which allows context-dependent attackers to cause a denial of service (PCRE or glibc crash) via crafted regular expressions.


ieee80211_output.c in MadWifi before 0.9.3 sends unencrypted packets before WPA authentication succeeds which allows remote attackers to obtain sensitive information (related to network structure) and possibly cause a denial of service (disrupted authentication) and conduct spoofing attacks.


The array_fill function in ext/standard/array.c in PHP 4.4.2 and 5.1.2 allows context-dependent attackers to cause a denial of service (memory consumption) via a large num value.


Win32k.sys (aka Graphics Device Interface (GDI)) in Windows 2000 and XP allows local users to cause a denial of service (system crash) by calling the ShowWindow function after receiving a WM_NCCREATE message.


Windows NT 4.0 SP 6a allows a local user with write access to winnt/system32 to cause a denial of service (crash in lsass.exe) by running the NT4ALL exploit program in 'SPECIAL' mode.


inetd in Compaq Tru64 UNIX 5.1 allows attackers to cause a denial of service (network connection loss) by causing one of the services handled by inetd to core dump during startup which causes inetd to stop accepting connections to all of its services.