The shm_get_stat function in ipc/shm.c in the shm subsystem in the Linux kernel before 2.6.28.5 when CONFIG_SHMEM is disabled misinterprets the data type of an inode which allows local users to cause a denial of service (system hang) via an SHM_INFO shmctl call as demonstrated by running the ipcs program.


OpenSSL before 0.9.8k on WIN64 and certain other platforms does not properly handle a malformed ASN.1 structure which allows remote attackers to cause a denial of service (invalid memory access and application crash) by placing this structure in the public key of a certificate as demonstrated by an RSA public key.


Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of headers.


Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4 when an Easy VPN (aka EZVPN) server is enabled allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets.


drivers/firmware/dell_rbu.c in the Linux kernel before 2.6.27.13 and 2.6.28.x before 2.6.28.2 allows local users to cause a denial of service (system crash) via a read system call that specifies zero bytes from the (1) image_type or (2) packet_size file in /sys/devices/platform/dell_rbu/.


The ext4_group_add function in fs/ext4/resize.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not properly initialize the group descriptor during a resize (aka resize2fs) operation which might allow local users to cause a denial of service (OOPS) by arranging for crafted values to be present in available memory.


msnmsgr.exe in Windows Live Messenger (WLM) 2009 build 14.0.8064.206 and other 14.0.8064.x builds allows remote attackers to cause a denial of service (application crash) via a modified header in a packet as possibly demonstrated by a UTF-8.0 value of the charset field in the Content-Type header line. NOTE: this has been reported as a format string vulnerability by some sources but the provenance of that information is unknown.


The inotify_read function in the Linux kernel 2.6.27 to 2.6.27.13 2.6.28 to 2.6.28.2 and 2.6.29-rc3 allows local users to cause a denial of service (OOPS) via a read with an invalid address to an inotify instance which causes the device's event list mutex to be unlocked twice and prevents proper synchronization of a data structure for the inotify instance.


The sys_remap_file_pages function in mm/fremap.c in the Linux kernel before 2.6.24.1 allows local users to cause a denial of service or gain privileges via unspecified vectors related to the vm_file structure member and the mmap_region and do_munmap functions.


Unspecified vulnerability in the IBM Asynchronous I/O (aka AIO or libibmaio) library in the Java Message Service (JMS) component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.17 on AIX 5.3 allows attackers to cause a denial of service (daemon crash) via vectors related to the aio_getioev2 and getEvent methods.


dkim-milter 2.6.0 through 2.8.0 allows remote attackers to cause a denial of service (crash) by signing a message with a key that has been revoked in DNS which triggers an assertion error.


libike in Sun Solaris 9 and 10 and OpenSolaris before snv_100 does not properly check packets which allows remote attackers to cause a denial of service (in.iked daemon crash) via an unspecified IKE packet a different vulnerability than CVE-2007-2989.


Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8.0) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv3 packet.


The firewall engine in Microsoft Forefront Threat Management Gateway Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3 2006 2006 Supportability Update and 2006 SP1; does not properly manage the session state of web listeners which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets aka \Web Proxy TCP State Limited Denial of Service Vulnerability.\


The read_game_map function in src/terrain_translation.cpp in Wesnoth before r32987 allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a map with a large (1) width or (2) height.


The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted MPEG-4 video file that triggers an \input validation issue.\


The IP-in-IP packet processing implementation in the IPsec and IP stacks in the kernel in Sun Solaris 9 and 10 and OpenSolaris snv_01 though snv_85 allows local users to cause a denial of service (panic) via a self-encapsulated packet that lacks IPsec protection.


Unspecified vulnerability in lpadmin in Sun Solaris 10 and OpenSolaris snv_61 through snv_106 allows local users to cause a denial of service via unspecified vectors related to enumeration of \wrong printers \ aka a \Temporary file vulnerability.\


The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3 when PK-INIT is used allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers an erroneous malloc call related to incorrect calculations with pointer arithmetic.


Unspecified vulnerability in Kerberos Incremental Propagation in Solaris 10 and OpenSolaris snv_01 through snv_110 allows remote attackers to cause a denial of service (loss of incremental propagation requests to slave KDC servers) via unknown vectors related to the master Key Distribution Center (KDC) server.


Multiple unspecified vulnerabilities in the (1) Mobile IP NAT Traversal feature and (2) Mobile IPv6 subsystem in Cisco IOS 12.3 through 12.4 allow remote attackers to cause a denial of service (input queue wedge and interface outage) via MIPv6 packets aka Bug ID CSCsm97220.


Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier when a configuration file contains non-ASCII usernames might allow remote attackers to cause a denial of service and might allow remote authenticated users to obtain login access with a different user's non-ASCII username via a login attempt.


Unspecified vulnerability in the Wireless LAN Controller (WLC) TSEC driver in the Cisco 4400 WLC Cisco Catalyst 6500 and 7600 Wireless Services Module (WiSM) and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.x before 4.2.176.0 and 5.x before 5.1 allows remote attackers to cause a denial of service (device crash or hang) via unknown IP packets.


The web browser in Symbian OS on the Nokia N95 cell phone allows remote attackers to cause a denial of service (crash) via JavaScript code that calls the setAttributeNode method.


Mozilla Firefox 2.0.0.20 and earlier allows remote attackers to cause a denial of service (application crash) via nested calls to the window.print function as demonstrated by a window.print(window.print()) in the onclick attribute of an INPUT element.


Unspecified vulnerability in the dpwinsup module (dpwinsup.dll) for dpwingad (dpwingad.exe) in HP Data Protector Express and Express SSE 3.x before build 47065 and Express and Express SSE 4.x before build 46537 allows remote attackers to cause a denial of service (application crash) or read portions of memory via one or more crafted packets.


Unspecified vulnerability in the nfs4rename_persistent_fh function in the NFS 4 (aka NFSv4) client in the kernel in Sun Solaris 10 and OpenSolaris before snv_102 allows local users to cause a denial of service (recursive mutex_enter and panic) via unspecified vectors.


The Cisco Wireless LAN Controller (WLC) Cisco Catalyst 6500 Wireless Services Module (WiSM) and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.x before 4.2.176.0 and 5.x before 5.2 allow remote attackers to cause a denial of service (web authentication outage or device reload) via unspecified network traffic as demonstrated by a vulnerability scanner.


vmwarebase.dll as used in the vmware-authd service (aka vmware-authd.exe) in VMware Workstation 6.5.1 build 126130 6.5.1 and earlier; VMware Player 2.5.1 build 126130 2.5.1 and earlier; VMware ACE 2.5.1 and earlier; VMware Server 2.0.x before 2.0.1 build 156745; and VMware Fusion before 2.0.2 build 147997 allows remote attackers to cause a denial of service (daemon crash) via a long (1) USER or (2) PASS command.


The Sony Ericsson W910i W660i K618i K610i Z610i K810i K660i W880i and K530i phones allow remote attackers to cause a denial of service (device reboot or hang-up) via a malformed WAP Push packet to (1) SMS or (2) UDP port 2948.


The ext4_isize function in fs/ext4/ext4.h in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 uses the i_size_high structure member during operations on arbitrary types of files which allows local users to cause a denial of service (CPU consumption and error-message flood) by attempting to mount a crafted ext4 filesystem.


Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisco ACE 4710 Application Control Engine Appliance before A3(2.1) allows remote attackers to cause a denial of service (device reload) via a crafted SSH packet.


Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1.x before 5.1.1.19 6.0.x before 6.0.2.29 and 6.1.x before 6.1.0.19 when Web Server plug-in content buffering is enabled allows attackers to cause a denial of service (daemon crash) via unknown vectors related to a mishandling of client read failures in which clients receive many 500 HTTP error responses and backend servers are incorrectly labeled as down.


Squid 2.7 to 2.7.STABLE5 3.0 to 3.0.STABLE12 and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c.


Unspecified vulnerability in Tor before 0.2.0.34 allows directory mirrors to cause a denial of service via unknown vectors.


Unspecified vulnerability in the autofs module in the kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_108 allows local users to cause a denial of service (autofs mount outage) or possibly gain privileges via vectors related to \xdr processing problems.\


Cisco Application Networking Manager (ANM) before 2.0 uses default usernames and passwords which makes it easier for remote attackers to access the application or cause a denial of service via configuration changes related to \default user credentials during installation.\


Unspecified vulnerability in Cisco NX-OS before 4.0(1a)N2(1) when running on Nexus 5000 platforms allows remote attackers to cause a denial of service (crash) via an unspecified \sequence of TCP packets\ related to \TCP State manipulation \ possibly related to separate attacks against CVE-2008-4609.


The uncompress_buffer function in src/server/simple_wml.cpp in Wesnoth before r33069 allows remote attackers to cause a denial of service via a large compressed WML document.


The CICS listener in IBM TXSeries for Multiplatforms 6.2 GA waits for a forcepurge acknowledgement from the CICS Application Server (CICSAS) after an eci response timeout which might allow remote authenticated users to cause a denial of service (forcepurge handling delay) or have unspecified other impact via vectors involving slow or nonexistent acknowledgement.


The Cisco Wireless LAN Controller (WLC) Cisco Catalyst 6500 Wireless Services Module (WiSM) and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.x before 4.2.176.0 and 5.2.x before 5.2.157.0 allow remote attackers to cause a denial of service (device reload) via a web authentication (aka WebAuth) session that includes a malformed POST request to login.html.


Integer signedness error in Apple Safari allows remote attackers to read the contents of arbitrary memory locations cause a denial of service (application crash) and probably have unspecified other impact via the array index of the arguments array in a JavaScript function possibly a related issue to CVE-2008-2307.


The make_indexed_dir function in fs/ext4/namei.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate a certain rec_len field which allows local users to cause a denial of service (OOPS) by attempting to mount a crafted ext4 filesystem.


The Electronic Messaging System Microsoft Data Base (EMSMDB32) provider in Microsoft Exchange 2000 Server SP3 and Exchange Server 2003 SP2 as used in Exchange System Attendant allows remote attackers to cause a denial of service (application outage) via a malformed MAPI command aka \Literal Processing Vulnerability.\


The kernel in Sun Solaris 10 and 11 snv_101b and OpenSolaris before snv_108 allows remote attackers to cause a denial of service (system crash) via a crafted IPv6 packet related to an \insufficient validation security vulnerability \ as demonstrated by SunOSipv6.c.


k23productions TFTPUtil GUI 1.2.0 and 1.3.0 allows remote attackers to cause a denial of service (service crash) via a long filename in a crafted request.


Unspecified vulnerability in Tor before 0.2.0.34 allows attackers to cause a denial of service (infinite loop) via \corrupt votes.\


sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via \an XPath expression employing a scalar expression as a FilterExpr with ExtractValue() or UpdateXML() \ which triggers an assertion failure.


Apple iTunes before 8.1 on Windows allows remote attackers to cause a denial of service (infinite loop) via a Digital Audio Access Protocol (DAAP) message with a crafted Content-Length header.


filter.d/wuftpd.conf in Fail2ban 0.8.3 uses an incorrect regular expression that allows remote attackers to cause a denial of service (forced authentication failures) via a crafted reverse-resolved DNS name (rhost) entry that contains a substring that is interpreted as an IP address a different vulnerability than CVE-2007-4321.


The SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (device reload or hang) via a crafted HTTPS packet.


Unspecified vulnerability in the keysock kernel module in Solaris 10 and OpenSolaris builds snv_01 through snv_108 allows local users to cause a denial of service (system panic) via unknown vectors related to PF_KEY socket probably related to setting socket options.


Apache Tomcat 4.1.0 through 4.1.39 5.5.0 through 5.5.27 and 6.0.0 through 6.0.18 when the Java AJP connector and mod_jk load balancing are used allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers related to temporary blocking of connectors that have encountered errors as demonstrated by an error involving a malformed HTTP Host header.


PostgreSQL before 8.3.7 8.2.13 8.1.17 8.0.21 and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding as demonstrated using mismatched encoding conversion requests.


The JBIG2 decoder in Xpdf 3.02pl2 and earlier CUPS 1.3.9 and earlier and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of uninitialized memory.


The JBIG2Stream::readSymbolDictSeg function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file that triggers a parsing error which is not properly handled by JBIG2SymbolDict::~JBIG2SymbolDict and triggers an invalid memory dereference.


Elaborate Bytes ElbyCDIO.sys 6.0.2.0 and earlier as distributed in SlySoft AnyDVD before 6.5.2.6 Virtual CloneDrive 5.4.2.3 and earlier CloneDVD 2.9.2.0 and earlier and CloneCD 5.3.1.3 and earlier uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object which allows local users to cause a denial of service (system crash) via a crafted IOCTL call.


The IP implementation in Sun Solaris 8 through 10 and OpenSolaris before snv_82 uses an improper arena when allocating minor numbers for sockets which allows local users to cause a denial of service (32-bit application failure and login outage) by opening a large number of sockets.


Unspecified vulnerability in the UFS filesystem functionality in Sun OpenSolaris snv_86 through snv_91 when running in 32-bit mode on x86 systems allows local users to cause a denial of service (panic) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines aka CR 6679732.


The crypto pseudo device driver in Sun Solaris 10 and OpenSolaris snv_88 through snv_102 does not properly free memory which allows local users to cause a denial of service (panic) via unspecified vectors related to the vmem_hash_delete function.


The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier and 2.25.92 and earlier 2.25.x versions does not validate whether a certain length value is consistent with the amount of data in a challenge packet which allows remote mail servers to read information from the process memory of a client or cause a denial of service (client crash) via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.


The UFS implementation in the kernel in Sun OpenSolaris snv_29 through snv_90 allows local users to cause a denial of service (panic) via the single posix_fallocate test in the SUSv3 POSIX test suite related to an F_ALLOCSP fcntl call.


Apple Safari 3.2.1 (aka AppVer 3.525.27.1) on Windows allows remote attackers to cause a denial of service (infinite loop or access violation) via a link to an http URI in which the authority (aka hostname) portion is either a (1) . (dot) or (2) .. (dot dot) sequence.


Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations and cause a denial of service (application crash) or possibly have unspecified other impact via format string specifiers in the pathname of a remote control file (aka .CHF file).


Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to cause a denial of service (device reload) via unknown network traffic as demonstrated by a \connection stress test \ aka Bug ID CSCsq68451.


The Common Code Infrastructure component in IBM DB2 9.5 before FP5 and 9.7 before FP1 does not properly validate the size of a memory pool during a creation attempt which allows attackers to cause a denial of service (memory consumption) via unspecified vectors.


A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table and trigger a routing \emergency\ in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31 when the kernel routing cache is disabled involving an uninitialized pointer and a panic.


Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly implement the max-client-connections configuration setting which allows remote attackers to cause a denial of service (connection slot exhaustion) by making multiple connections and performing no operations on these connections aka Bug Id 6648665.


Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to cause a denial of service (device crash) via vectors involving SSL VPN and PPPoE transactions aka Bug ID CSCsm77958.


FCKeditor.Java 2.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed request parameter that contains \ctrl\ characters.


The do_insn_fetch function in arch/x86/kvm/emulate.c in the x86 emulator in the KVM subsystem in the Linux kernel before 2.6.32-rc8-next-20091125 tries to interpret instructions that contain too many bytes to be valid which allows guest OS users to cause a denial of service (increased scheduling latency) on the host OS via unspecified manipulations related to SMP support.


The (1) Conn_GetCipherInfo and (2) Conn_UsesSSL functions in src/ngircd/conn.c in ngIRCd 13 and 14 when SSL/TLS support is present and standalone mode is disabled allow remote attackers to cause a denial of service (application crash) by sending the MOTD command from another server in the same IRC network possibly related to an array index error.


Unspecified vulnerability in CTM on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software 8.1(2) allows remote attackers to cause a denial of service (watchdog traceback) via a large amount of small-packet data aka Bug ID CSCsu11412.


The IPMI dissector in Wireshark 1.2.0 through 1.2.4 on Windows allows remote attackers to cause a denial of service (crash) via a crafted packet related to \formatting a date/time using strftime.\


acpid 1.0.4 sets an unrestrictive umask which might allow local users to leverage weak permissions on /var/log/acpid and obtain sensitive information by reading this file or cause a denial of service by overwriting this file a different vulnerability than CVE-2009-4033.


Unspecified vulnerability in the EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel 2.6.32-git6 and earlier allows local users to cause a denial of service (filesystem corruption) via unknown vectors a different vulnerability than CVE-2009-4131.


Unbound before 1.4.4 does not send responses for signed zones after mishandling an unspecified query which allows remote attackers to cause a denial of service (DNSSEC outage) via a crafted query.


The fuse_direct_io function in fs/fuse/file.c in the fuse subsystem in the Linux kernel before 2.6.32-rc7 might allow attackers to cause a denial of service (invalid pointer dereference and OOPS) via vectors possibly related to a memory-consumption attack.


Intellicom NetBiter WebSCADA devices use default passwords for the HICP network configuration service which makes it easier for remote attackers to modify network settings and cause a denial of service. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: this issue was originally reported to be hard-coded passwords not default passwords.


Internet Initiative Japan SEIL/X1 SEIL/X2 and SEIL/B1 firmware 2.30 through 2.51 when NAT is enabled allows remote attackers to cause a denial of service (system restart) via crafted GRE packets.


Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server a related issue to CVE-2008-1678.


Unspecified vulnerability in t-prot (TOFU Protection) before 2.8 allows remote attackers to cause a denial of service via unspecified vectors related to the \--maxlines\ option and a crafted email message. NOTE: some of these details are obtained from third party information.


DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php which reveals the installation path in an error message. NOTE: this issue might be resultant from improperly controlled computation in tools.php that leads to a denial of service (CPU or memory consumption).


article.php in oBlog does not properly restrict comments which allows remote attackers to cause a denial of service (blog spam) via a comment=new action.


Stack consumption vulnerability in u_bound.c in Xfig 3.2.5b and earlier allows remote attackers to cause a denial of service (application crash) via a long string in a malformed .fig file that uses the 1.3 file format possibly related to the readfp_fig function in f_read.c.


The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).


Unspecified vulnerability in Sun Solaris 10 and OpenSolaris snv_49 through snv_117 when 64bit mode is used on the Intel x86 platform and a Linux (lx) branded zone is configured allows local users to cause a denial of service (panic) via unspecified vectors a different vulnerability than CVE-2007-6225.


The av_rescale_rnd function in the AVI demuxer in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) via a crafted AVI file that triggers a divide-by-zero error.


NetworkManager (NM) 0.7.2 does not ensure that the configured Certification Authority (CA) certificate file for a (1) WPA Enterprise or (2) 802.1x network remains present upon a connection attempt which might allow remote attackers to obtain sensitive information or cause a denial of service (connectivity disruption) by spoofing the identity of a wireless network.


drivers/net/r8169.c in the r8169 driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU which allows remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size in conjunction with certain packets containing '\\0' characters related to the value of the status register and erroneous behavior associated with the RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389.


The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of service (resource consumption) via a deeply nested serialized variable as demonstrated by a string beginning with a:1: followed by many {a:1: sequences.


Unspecified vulnerability in the kernel in Sun OpenSolaris 2009.06 allows remote attackers to cause a denial of service (panic) via unknown vectors as demonstrated by the vd_solaris2 module in VulnDisco Pack Professional 8.12. NOTE: as of 20091203 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Memory leak on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to cause a denial of service (memory consumption) via Subject Alternative Name fields in an X.509 certificate aka Bug ID CSCsq17879.


The fuse_ioctl_copy_user function in the ioctl handler in fs/fuse/file.c in the Linux kernel 2.6.29-rc1 through 2.6.30.y uses the wrong variable in an argument to the kunmap function which allows local users to cause a denial of service (panic) via unknown vectors.


mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement.


Unspecified vulnerability in LDAP3A.exe in MailSite 8.0.4 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors as demonstrated by a certain module in VulnDisco Pack Professional 7.13 through 8.11. NOTE: as of 20091229 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Unspecified vulnerability in the psearch (aka persistent search) functionality in Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 allows remote attackers to cause a denial of service (psearch outage) by using a crafted psearch client to send requests that trigger a psearch thread loop aka Bug Id 6855978.


Multiple unspecified vulnerabilities in HP Web Jetadmin 10.2 when a remote SQL server is used allow remote attackers to obtain access to data or cause a denial of service possibly by leveraging authentication and encryption weaknesses on the SQL server.


Unspecified vulnerability in the timeout mechanism in sshd in Sun Solaris 10 and OpenSolaris snv_99 through snv_123 allows remote attackers to cause a denial of service (daemon outage) via unknown vectors that trigger a \dangling sshd authentication thread.\


PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request which allows remote attackers to cause a denial of service (resource exhaustion) and makes it easier for remote attackers to exploit local file inclusion vulnerabilities via multiple requests related to lack of support for the max_file_uploads directive.


The mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (panic) via a crafted Delete Block ACK (aka DELBA) packet related to an erroneous \code shuffling patch.\


The bftpdutmp_log function in bftpdutmp.c in Bftpd before 2.4 does not place a '\\0' character at the end of the string value of the ut.bu_host structure member which might allow remote attackers to cause a denial of service (daemon crash) via unspecified vectors. NOTE: some of these details are obtained from third party information.


The Self Tuning Memory Manager (STMM) component in IBM DB2 9.1 before FP8 9.5 before FP5 and 9.7 before FP1 uses 0666 permissions for the STMM log file which allows local users to cause a denial of service or have unspecified other impact by writing to this file.


The

and

functions

in

libsndfile

allow

context-dependent

attackers

to

cause

a

denial

of

service

(divide-by-zero

error

and

application

crash)

via

a

crafted

audio

file.


Unspecified vulnerability in MP3-Cutter Ease Audio Cutter 1.20 allows user-assisted remote attackers to cause a denial of service (application crash) via a long string in a WAV file.


Multiple unspecified vulnerabilities in ldap_cachemgr (aka the LDAP client configuration cache daemon) in Sun Solaris 9 and 10 and OpenSolaris before snv_78 allow local users to cause a denial of service (daemon crash) via vectors involving multiple serviceSearchDescriptor attributes and a call to the getldap_lookup function and unspecified other vectors.


Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote authenticated users to cause a denial of service (console hang) via a login action during failover replication aka Bug ID CSCsq80095.


TYPSoft FTP Server 1.10 allows remote authenticated users to cause a denial of service (crash) by sending an APPE (append) command immediately followed by a DELE (delete) command without sending file data in between these two commands.


The Linux kernel 2.6.9 through 2.6.17 on the x86_64 and amd64 platforms allows local users to cause a denial of service (panic) via a 32-bit application that calls mprotect on its Virtual Dynamic Shared Object (VDSO) page and then triggers a segmentation fault.


Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not enable the SO_KEEPALIVE socket option which makes it easier for remote attackers to cause a denial of service (connection slot exhaustion) via multiple connections aka Bug Id 6782659.


Deliantra Server before 2.82 allows remote authenticated users to cause a denial of service (daemon crash) via vectors involving an empty treasure list.


Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote authenticated users to cause a denial of service (daemon outage) via an APPE command to one socket in conjunction with a DELE command to a second socket.


VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459 VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build 246459 VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459 and VMware Server 2.x allows remote attackers to cause a denial of service (process crash) via a \\x25\\x90 sequence in the USER and PASS commands a related issue to CVE-2009-3707. NOTE: some of these details are obtained from third party information.


rtp.c in Asterisk Open Source 1.2.x before 1.2.37 1.4.x before 1.4.27.1 1.6.0.x before 1.6.0.19 and 1.6.1.x before 1.6.1.11; Business Edition B.x.x before B.2.5.13 C.2.x.x before C.2.4.6 and C.3.x.x before C.3.2.3; and s800i 1.3.x before 1.3.0.6 allows remote attackers to cause a denial of service (daemon crash) via an RTP comfort noise payload with a long data length.


The StartServiceCtrlDispatcher function in the cvpnd service (cvpnd.exe) in Cisco VPN client for Windows before 5.0.06.0100 does not properly handle an ERROR_FAILED_SERVICE_CONTROLLER_CONNECT error which allows local users to cause a denial of service (service crash and VPN connection loss) via a manual start of cvpnd.exe while the cvpnd service is running.


Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to cause a denial of service (device reload) via a high volume of SIP traffic aka Bug ID CSCsr65901.


Unspecified vulnerability in sapstartsrv.exe in the SAP Kernel 6.40 7.00 7.01 7.10 7.11 and 7.20 as used in SAP NetWeaver 7.x and SAP Web Application Server 6.x and 7.x allows remote attackers to cause a denial of service (Management Console shutdown) via a crafted request. NOTE: some of these details are obtained from third party information.


Home FTP Server 1.10.1.139 allows remote attackers to cause a denial of service (daemon outage) via multiple invalid SITE INDEX commands.


A certain Red Hat patch for acpid 1.0.4 effectively triggers a call to the open function with insufficient arguments which might allow local users to leverage weak permissions on /var/log/acpid and obtain sensitive information by reading this file cause a denial of service by overwriting this file or gain privileges by executing this file.


Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote authenticated users to cause a denial of service (traceback) by establishing many IPsec L2L tunnels from remote peer IP addresses aka Bug ID CSCso15583.


XM Easy Personal FTP Server 5.8.0 allows remote authenticated users to cause a denial of service (crash) by uploading or creating a large number of files or directories then performing a LIST command.


inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10 and possibly earlier versions allows remote attackers to cause a denial of service (CPU consumption) via a crafted request with a large year value which triggers a long loop as reachable through member.php and possibly other vectors.


UseBB 1.0.9 before 1.0.10 allows remote attackers to cause a denial of service (infinite loop) via crafted BBCode tags.


Unspecified vulnerability in multiple versions of Hitachi JP1/Automatic Job Management System 2 - View JP1/Integrated Management - View and JP1/Cm2/SNMP System Observer allows remote attackers to cause a denial of service (\abnormal\ termination) via vectors related to the display of an \invalid GIF file.\


traveler.exe in IBM Lotus Notes Traveler before 8.0.1.3 CF1 allows remote authenticated users to cause a denial of service (daemon crash) via a malformed invitation document in a sync operation.


The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (memory consumption and process crash) via a large file that is not properly handled during buffering.


The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service (service crash) via an attachment with a crafted size.


konversation before 1.2.3 allows attackers to cause a denial of service.


Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.14 services for Lotus Domino when Domino Native Authentication is enabled might allow remote authenticated users to cause a denial of service (daemon crash) by going offline aka SPR MLZG7UPB9N.


Monkey's Audio before 4.02 allows remote attackers to cause a denial of service (application crash) via a malformed APE file.


GoAhead WebServer allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests as demonstrated by Slowloris.


CallManager Express (CME) on Cisco IOS before 15.0(1)XA allows remote authenticated users to cause a denial of service (device crash) by using an extension mobility (EM) phone to interact with the menu for SNR number changes aka Bug ID CSCta63555.


The LunaSysMgr process in Palm Pre WebOS 1.1 and earlier when not viewing web pages in landscape mode allows remote attackers to cause a denial of service (crash) via a web page containing a long string following a refresh tag which triggers a floating point exception.


Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.10 services for Lotus Domino might allow remote authenticated users to cause a denial of service (daemon crash) by checking out a document that is accessed through a connector aka SPR MMOI7PSR8J.


The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (intermittent LDAP authentication outage) via a login attempt with an incorrect password.


Memory leak in the gk_circuit_info_do_in_acf function in the H.323 implementation in Cisco IOS before 15.0(1)XA allows remote attackers to cause a denial of service (memory consumption) via a large number of calls over a long duration as demonstrated by InterZone Clear Token (IZCT) test traffic aka Bug ID CSCsz72535.


In the GNU C Library (aka glibc or libc6) before 2.28 parse_reg_exp in posix/regcomp.c misparses alternatives which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.


IBM Lotus Quickr 8.1 before 8.1.0.15 services for Lotus Domino on AIX allows remote authenticated users to cause a denial of service (daemon crash) by subscribing to an Atom feed aka SPR JRIE7VKMP9.


IBM Lotus Notes Traveler before 8.5.0.2 allows remote authenticated users to cause a denial of service (memory consumption and daemon crash) by syncing a large volume of data related to the launch of a new process to handle the data while the previous process is still operating on the data.


The Cluster::deliveredEvent function in cluster/Cluster.cpp in Apache Qpid as used in Red Hat Enterprise MRG before 1.3 and other products allows remote attackers to cause a denial of service (daemon crash and cluster outage) via invalid AMQP data.


The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 106 and 7.x before 7.1 allow remote attackers to cause a denial of service (filtering outage) via a crafted URL.


The policy definition evaluator in Condor before 7.4.2 does not properly handle attributes in a WANT_SUSPEND policy that evaluate to an UNDEFINED state which allows remote authenticated users to cause a denial of service (condor_startd exit) via a crafted job.


Memory leak in the embedded_profile_len function in pngwutil.c in libpng before 1.2.39beta5 allows context-dependent attackers to cause a denial of service (memory leak or segmentation fault) via a JPEG image containing an iCCP chunk with a negative embedded profile length. NOTE: this is due to an incomplete fix for CVE-2006-7244.


IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.59 (aka 6.0.0.8-TIV-ITDS-IF0001) allows remote authenticated users to cause a denial of service (infinite loop and daemon hang) by adding a nested group that contains the Distinguished Name (DN) of its parent entry.


Cisco IOS before 15.0(1)XA does not properly handle IRC traffic during a specific time period after an initial reload which allows remote attackers to cause a denial of service (device reload) via an attempted connection to a certain IRC server related to a \corrupted magic value \ aka Bug ID CSCso05336.


SMC Networks Barricade Wireless Cable/DSL Broadband Router SMC7004VWBR allows remote attackers to cause a denial of service via certain packets to PPTP port 1723 on the internal interface.


Unknown vulnerability in tcpdump before 3.7.2 related to an inability to \Handle unknown RADIUS attributes properly \ allows remote attackers to cause a denial of service (infinite loop) a different vulnerability than CAN-2003-0093.


The TCP/IP fragment reassembly handling in the Linux kernel 2.4 allows remote attackers to cause a denial of service (CPU consumption) via certain packets that cause a large number of hash table collisions.


The fetchnews NNTP client in leafnode 1.9.3 to 1.9.41 allows remote attackers to cause a denial of service (process hang and termination) via certain malformed Usenet news articles that cause fetchnews to hang while waiting for input.


The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept which could lead to a denial of service.


ISC dhcrelay (dhcp-relay) 3.0rc9 and earlier and possibly other versions allows remote attackers to cause a denial of service (packet storm) via a certain BOOTP packet that is forwarded to a broadcast MAC address causing an infinite loop that is not restricted by a hop count.


NeoModus Direct Connect 1.0 build 9 and possibly other versions allows remote attackers to cause a denial of service (connection and possibly memory exhaustion) via a flood of ConnectToMe requests containing arbitrary IP addresses and ports.


The SPNEGO dissector in Ethereal 0.9.12 and earlier allows remote attackers to cause a denial of service (crash) via an invalid ASN.1 value.


The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows attackers to cause a denial of service (daemon crash) when a chosen host expires a different issue than CVE-2003-0549.


Unknown vulnerability in ip_nat_sack_adjust of Netfilter in Linux kernels 2.4.20 and some 2.5.x when CONFIG_IP_NF_NAT_FTP or CONFIG_IP_NF_NAT_IRC is enabled or the ip_nat_ftp or ip_nat_irc modules are loaded allows remote attackers to cause a denial of service (crash) in systems using NAT possibly due to an integer signedness error.


Unknown vulnerability in Windows Media Station Service and Windows Media Monitor Service components of Windows Media Services 4.1 allows remote attackers to cause a denial of service (disallowing new connections) via a certain sequence of TCP/IP packets.


Cisco CSS 11000 routers on the CS800 chassis allow remote attackers to cause a denial of service (CPU consumption or reboot) via a large number of TCP SYN packets to the circuit IP address aka \ONDM Ping failure.\


rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag which causes memcpy to be called with a -1 length argument as demonstrated using the Tunnel-Password attribute.


Lotus Domino Web Server (nhttp.exe) before 6.0.1 allows remote attackers to cause a denial of service via a \Fictionary Value Field POST request\ as demonstrated using the s_Validation form with a long unknown parameter name.


The RADIUS decoder in tcpdump 3.6.2 and earlier allows remote attackers to cause a denial of service (crash) via an invalid RADIUS packet with a header length field of 0 which causes tcpdump to generate data within an infinite loop.


GDM 2.4.4.x before 2.4.4.4 and 2.4.1.x before 2.4.1.7 does not limit the number or duration of commands and uses a blocking socket connection which allows attackers to cause a denial of service (resource exhaustion) by sending commands and not reading the results.


CUPS before 1.1.19 allows remote attackers to cause a denial of service via a partial printing request to the IPP port (631) which does not time out.


icqateimg32.dll parsing/rendering library in Mirabilis ICQ Pro 2003a allows remote attackers to cause a denial of service via malformed GIF89a headers that do not contain a GCT (Global Color Table) or an LCT (Local Color Table) after an Image Descriptor.


OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs which allows remote attackers to cause a denial of service (crash) via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used.


Unknown vulnerability in mod_python 3.0.x before 3.0.4 and 2.7.x before 2.7.9 allows remote attackers to cause a denial of service (httpd crash) via a certain query string.


wzdftpd 0.1rc4 and earlier allows remote attackers to cause a denial of service (crash) via a PORT command without an argument.


The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers which allow remote attackers to generate a large header to cause a denial of service (memory consumption) with an ASP page.


The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.


Various routines for the ppc64 architecture on Linux kernel 2.6 prior to 2.6.2 and 2.4 prior to 2.4.24 do not use the copy_from_user function when copying data from userspace to kernelspace which crosses security boundaries and allows local users to cause a denial of service.


GtkHTML as included in Evolution before 1.2.4 allows remote attackers to cause a denial of service (crash) via certain malformed messages.


The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a denial of service (lock) via (1) a malformed envelope address to a local host that would generate a bounce and contains the \.!\ string in the MAIL FROM or Errors-To headers which causes nqmgr to lock up or (2) via a valid MAIL FROM with a RCPT TO containing a \.!\ string which causes an instance of the SMTP listener to lock up.


Zebra 0.93b and earlier and quagga before 0.95 allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.


Remote PC Access Server 2.2 allows remote attackers to cause a denial of service (crash) by receiving packets from the server and sending them back to the server.


The getipnodebyname() API in AIX 5.1 and 5.2 does not properly close sockets which allows attackers to cause a denial of service (resource exhaustion).


Nokia Gateway GPRS support node (GGSN) allows remote attackers to cause a denial of service (kernel panic) via a malformed IP packet with a 0xFF TCP option.


Unknown vulnerability in mah-jong 1.5.6 and earlier allows remote attackers to cause a denial of service (tight loop).


Memory leak in xinetd 2.3.10 allows remote attackers to cause a denial of service (memory consumption) via a large number of rejected connections.


The IPv6 capability in IRIX 6.5.19 allows remote attackers to cause a denial of service (hang) in inetd via port scanning.


The vty layer in Quagga before 0.96.4 and Zebra 0.93b and earlier does not verify that sub-negotiation is taking place when processing the SE marker which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port which may trigger a null dereference.


The OSI networking kernel (sys/netiso) in NetBSD 1.6.1 and earlier does not use a BSD-required \PKTHDR\ mbuf when sending certain error responses to the sender of an OSI packet which allows remote attackers to cause a denial of service (kernel panic or crash) via certain OSI packets.


The DB2 Discovery Service for IBM DB2 before FixPak 10a allows remote attackers to cause a denial of service (crash) via a long packet to UDP port 523.


The Message Session window in Mirabilis ICQ Pro 2003a allows remote attackers to cause a denial of service (CPU consumption) by spoofing the address of an ADS server and sending HTML with a -1 width in a table tag.


The getifaddrs function in GNU libc (glibc) 2.2.4 and earlier allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.


The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka \buffer underrun\).


Unknown vulnerability in the DNS intrusion detection application filter for Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service (blocked traffic to DNS servers) via a certain type of incoming DNS request that is not properly handled.


SGI IRIX before 6.5.21 allows local users to cause a denial of service (kernel panic) via a certain call to the PIOCSWATCH ioctl.


Sygate Enforcer 4.0 earlier allows remote attackers to cause a denial of service (service hang) by replaying a malformed discovery packet to UDP port 39999.


Microsoft NetMeeting 3.01 2000 before SP4 allows remote attackers to cause a denial of service (shutdown of NetMeeting conference) via malformed packets as demonstrated via the chat conversation.


OpenSSL 0.9.6k allows remote attackers to cause a denial of service (crash via large recursion) via malformed ASN.1 sequences.


The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows attackers to cause a denial of service (daemon crash) via a short authorization key name.


The STP protocol implementation in Linux 2.4.x does not properly verify certain lengths which could allow attackers to cause a denial of service.


hpnst.exe in the GoAhead-Webs webserver for HP Instant TopTools before 5.55 allows remote attackers to cause a denial of service (CPU consumption) via a request to hpnst.exe that calls itself which causes an infinite loop.


Lotus Domino Web Server (nhttp.exe) before 6.0.1 allows remote attackers to cause a denial of service via an incomplete POST request as demonstrated using the h_PageUI form.


The getCanonicalPath function in Windows NT 4.0 may free memory that it does not own and cause heap corruption which allows attackers to cause a denial of service (crash) via requests that cause a long file name to be passed to getCanonicalPath as demonstrated on the IBM JVM using a long string to the java.io.getCanonicalPath Java method.


The DEC UDK processing feature in the hanterm (hanterm-xf) terminal emulator before 2.0.5 allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.


Memory leak in libmcrypt before 2.5.5 allows attackers to cause a denial of service (memory exhaustion) via a large number of requests to the application which causes libmcrypt to dynamically load algorithms via libtool.


Unknown vulnerability in filestat.c for Apache running on OS2 versions 2.0 through 2.0.45 allows unknown attackers to cause a denial of service via requests related to device names.


The Network Management Port on Sun Fire B1600 systems allows remote attackers to cause a denial of service (packet loss) via ARP packets which cause all ports to become temporarily disabled.


Microsoft Internet Information Services (IIS) 5.0 and 5.1 allows remote attackers to cause a denial of service via a long WebDAV request with a (1) PROPFIND or (2) SEARCH method which generates an error condition that is not properly handled.


The mremap system call (do_mremap) in Linux kernel 2.4.x before 2.4.21 and possibly other versions before 2.4.24 does not properly perform bounds checks which allows local users to cause a denial of service and possibly gain privileges by causing a remapping of a virtual memory area (VMA) to create a zero length VMA a different vulnerability than CAN-2004-0077.


decrypt_msg for the Gaim-Encryption GAIM plugin 1.15 and earlier does not properly validate a message length parameter which allows remote attackers to cause a denial of service (crash) via a negative length which overwrites arbitrary heap memory with a zero byte.


The WebDAV Message Handler for Internet Information Services (IIS) 5.0 5.1 and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes.


The route cache implementation in Linux 2.4 and the Netfilter IP conntrack module allows remote attackers to cause a denial of service (CPU consumption) via packets with forged source addresses that cause a large number of hash table collisions.


Unknown vulnerability in nsd in SGI IRIX 6.5.x through 6.5.20f and possibly earlier versions allows attackers to cause a denial of service (memory consumption).


The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol which causes Tomcat to reject later requests.


The (1) ipq_read and (2) ipulog_read functions in iptables allow local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.


The rotatelogs program on Apache before 1.3.28 for Windows and OS/2 systems does not properly ignore certain control characters that are received over the pipe which could allow remote attackers to cause a denial of service.


Memory leak in eServ 2.9x allows remote attackers to cause a denial of service (memory exhaustion) via a large number of connections whose memory is not freed when the connection is terminated.


MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allows remote authenticated attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that causes a null dereference.


The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.


BitchX IRC client 1.0c20cvs and earlier allows attackers to cause a denial of service (core dump) via certain channel mode changes that are not properly handled in names.c.


tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets a different vulnerability than CVE-2004-0057.


The Service Assurance Agent (SAA) in Cisco IOS 12.0 through 12.2 aka Response Time Reporter (RTR) allows remote attackers to cause a denial of service (crash) via malformed RTR packets to port 1967.


The arplookup function in FreeBSD 5.1 and earlier Mac OS X before 10.2.8 and possibly other BSD-based systems allows remote attackers on a local subnet to cause a denial of service (resource starvation and panic) via a flood of spoofed ARP requests.


psdoccgi.exe in PeopleSoft PeopleTools 8.4 through 8.43 allows remote attackers to cause a denial of service (application crash) possibly via the headername and footername arguments.


lyskom-server 2.0.7 and earlier allows unauthenticated users to cause a denial of service (CPU consumption) via a large query.


The Name Service Daemon (nsd) when running on an NIS master on SGI IRIX 6.5.x through 6.5.20f and possibly earlier versions allows remote attackers to cause a denial of service (crash) via a UDP port scan.


Vignette StoryServer 5 and Vignette V/5 allows remote attackers to read and modify license information and cause a denial of service (service halt) by directly accessing the /vgn/license template.


Cisco IOS 11.x and 12.0 through 12.2 allows remote attackers to cause a denial of service (traffic block) by sending a particular sequence of IPv4 packets to an interface on the device causing the input queue on that interface to be marked as full.


ypserv NIS server before 2.7 allows remote attackers to cause a denial of service via a TCP client request that does not respond to the server which causes ypserv to block.


Various Distributed Computing Environment (DCE) implementations including HP OpenView allow remote attackers to cause a denial of service (process hang or termination) via certain malformed inputs as triggered by attempted exploits against the vulnerabilities CVE-2003-0352 or CVE-2003-0605 such as the Blaster/MSblast/LovSAN worm.


Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client 2.x.x through 3.6.7A allow remote attackers to cause a denial of service (slowdown and possibly reload) via a flood of malformed ICMP packets.


The connection tracking core of Netfilter for Linux 2.4.20 with CONFIG_IP_NF_CONNTRACK enabled or the ip_conntrack module loaded allows remote attackers to cause a denial of service (resource consumption) due to an inconsistency with Linux 2.4.20's support of linked lists which causes Netfilter to fail to identify connections with an UNCONFIRMED status and use large timeouts.


Polycom MGC 25 allows remote attackers to cause a denial of service (crash) via a large number of \user\ requests to the control port 5003 as demonstrated using the blast TCP stress tester.


gkrellm-newsticker gkrellm plugin before 0.3-3.1 allows remote attackers to cause a denial of service (crash) via (1) link or (2) title elements that contain multiple lines.


isakmp_sub_print in tcpdump 3.6 through 3.7.1 allows remote attackers to cause a denial of service (CPU consumption) via a certain malformed ISAKMP packet to UDP port 500 which causes tcpdump to enter an infinite loop.


The calendar module in phpWebSite 0.9.x and earlier allows remote attackers to cause a denial of service (crash) via a long year parameter.


The Winsock Proxy service in Microsoft Proxy Server 2.0 and the Microsoft Firewall service in Internet Security and Acceleration (ISA) Server 2000 allow remote attackers to cause a denial of service (CPU consumption or packet storm) via a spoofed malformed packet to UDP port 1745.


The DNS map code in Sendmail 8.12.8 and earlier when using the \enhdnsbl\ feature does not properly initialize certain data structures which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data.


Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client 2.x.x through 3.6.7 allows remote attackers to cause a denial of service (reload) via a malformed SSH initialization packet.


Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002 and Microsoft SharePoint Team Services 2002 allows remote attackers to cause a denial of service (response failure) via a certain request.


Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service (crash) via a request to view_broadcast.cgi that does not contain the required parameters.


Snowblind Web Server 1.0 allows remote attackers to cause a denial of service (crash) via a URL that ends in a \</\ sequence.


Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service (memory consumption) via a mail message that is uuencoded multiple times.


Trillian 1.0 Pro and 0.74 Freeware allows remote attackers to cause a denial of service (crash) via a TypingUser message in which the \TypingUser\ string has been modified.


Unknown vulnerability in ns-ldapd for Sun ONE Directory Server 4.16 5.0 and 5.1 allows LDAP clients to cause a denial of service (service halt).


Unknown vulnerability in rpcbind for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (rpcbind crash).


The PluginContext object of Opera 6.05 and 7.0 allows remote attackers to cause a denial of service (crash) via an HTTP request containing a long string that gets passed to the ShowDocument method.


Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (crash) by creating a web page or HTML e-mail with a textarea in a div element whose scrollbar-base-color is modified by a CSS style which is then moved.


The SMB dissector in Ethereal before 0.10.0 allows remote attackers to cause a denial of service via a malformed SMB packet that triggers a segmentation fault during processing of Selected packets.


BitchX 75p3 and 1.0c16 through 1.0c20cvs allows remote attackers to cause a denial of service (segmentation fault) via a malformed RPL_NAMREPLY numeric 353 message.


Sun Cluster 2.2 through 3.2 for Oracle Parallel Server / Real Application Clusters (OPS/RAC) allows local users to cause a denial of service (cluster node panic or abort) by launching a daemon listening on a TCP port that would otherwise be used by the Distributed Lock Manager (DLM) possibly involving this daemon responding in a manner that spoofs a cluster reconfiguration.


Baby FTP Server (BabyFTP) 1.2 and possibly other versions before May 31 2003 allows remote attackers to cause a denial of service via a large number of connections from the same IP address which triggers an access violation.


ftpd.c in wu-ftpd 2.6.2 when running on \operating systems that only allow one non-connected socket bound to the same local address \ does not close failed connections which allows remote attackers to cause a denial of service.


Croteam Serious Sam demo test 2 2.1a Serious Sam: the First Encounter 1.05 and Serious Sam: the Second Encounter 1.05 allow remote attackers to cause a denial of service (crash or freeze) via a TCP packet with an invalid first parameter.


Twilight Webserver 1.3.3.0 allows remote attackers to cause a denial of service (application crash) via a GET request for a long URI a different vulnerability than CVE-2004-2376.


The SV_CheckForDuplicateNames function in Valve Software Half-Life CSTRIKE Dedicated Server 1.1.1.0 and earlier allows remote authenticated users to cause a denial of service (infinite loop and daemon hang) via a certain connection string to UDP port 27015 that represents \absence of player informations \ a related issue to CVE-2006-0734.


The NFS Server for Solaris 7 8 and 9 allows remote attackers to cause a denial of service (UFS panic) via certain invalid UFS requests which triggers a null dereference.


The Node Manager for BEA WebLogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (Node Manager crash) via malformed data to the Node Manager's port as demonstrated by nmap.


MDaemon POP server 6.0.7 and earlier allows remote authenticated users to cause a denial of service (crash) via a (1) DELE or (2) UIDL with a negative number.


Origo ASR-8100 ADSL Router 3.21 has an administration service running on port 254 that does not require a password which allows remote attackers to cause a denial of service by restoring the factory defaults.


Cisco Firewall Services Module (FWSM) in Cisco Catalyst 6500 and 7600 series devices allows remote attackers to cause a denial of service (crash and reload) via an SNMPv3 message when snmp-server is set.


SpamProbe 0.8a allows remote attackers to cause a denial of service (crash) via HTML e-mail with newline characters within an href tag which is not properly handled by certain regular expressions.


Solaris 8 with IPv6 enabled allows remote attackers to cause a denial of service (kernel panic) via a crafted IPv6 packet.


The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs conduct a denial of service and obtain sensitive information via a crafted SQL statement related to \inadequate security settings and library bugs in sun.* and org.apache.* packages.\


Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (crash) by creating a DHTML link that uses the AnchorClick \A\ object with a blank href attribute.


Kaspersky Antivirus (KAV) 4.0.9.0 allows local users to cause a denial of service (CPU consumption or crash) and prevent malicious code from being detected via a file with a long pathname.


Sun Java 1.3.1 1.4.1 and 1.4.2 allows local users to cause a denial of service (JVM crash) possibly by calling the ClassDepth function with a null parameter which causes a crash instead of generating a null pointer exception.


Unknown vulnerability in Internet Explorer 5.01 SP3 through 6.0 SP1 allows remote attackers to cause a denial of service (browser or Outlook Express crash) via HTML with certain input tags that are not properly rendered.


Cisco PIX firewall 5.x.x and 6.3.1 and earlier allows remote attackers to cause a denial of service (crash and reload) via an SNMPv3 message when snmp-server is set.


Unknown vulnerability in UDP RPC for Solaris 2.5.1 through 9 for SPARC and 2.5.1 through 8 for x86 allows remote attackers to cause a denial of service (memory consumption) via certain arguments in RPC calls that cause large amounts of memory to be allocated.


Posadis 0.50.4 through 0.50.8 allows remote attackers to cause a denial of service (crash) via a DNS message without a question section which triggers null dereference.


BisonFTP Server 4 release 2 allows remote attackers to cause a denial of service (CPU consumption) via a long (1) ls or (2) cwd command.


Sun Java Media Framework (JMF) 2.1.1 through 2.1.1c allows unsigned applets to cause a denial of service (JVM crash) and read or write unauthorized memory locations via the ReadEnv class as demonstrated by reading environment variables using modified .data and .size fields.


Unknown vulnerability in patches 108993-14 through 108993-19 and 108994-14 through 108994-19 for Solaris 8 may allow local users to cause a denial of service (automountd crash).


mod_access_referer 1.0.2 allows remote attackers to cause a denial of service (crash) via a malformed Referer header that is missing a hostname as parsed by the ap_parse_uri_components function in Apache which triggers a null dereference.


Pocket Internet Explorer (PIE) 3.0 allows remote attackers to cause a denial of service (crash) via a Javascript function that uses the object.innerHTML function to recursively call that function.


SSH Secure Shell before 3.2.9 allows remote attackers to cause a denial of service via malformed BER/DER packets.


Trend Micro Virus Control System (TVCS) 1.8 running with IIS allows remote attackers to cause a denial of service (memory consumption) in IIS via multiple URL requests for ActiveSupport.exe.


hash.c in Ganglia gmond 2.5.3 allows remote attackers to cause a denial of service (segmentation fault) via a UDP packet that contains a single-byte name string which is used as an out-of-bounds array index.


Microsoft Internet Explorer allows remote attackers to cause a denial of service (resource consumption) via a Javascript src attribute that recursively loads the current web page.


Konqueror in KDE 3.0.3 allows remote attackers to cause a denial of service (core dump) via a web page that begins with a \xFFxFE\ byte sequence and a large number of CRLF sequences as demonstrated using freeze.htm.


Efficient Networks 5861 DSL router when running firmware 5.3.80 configured to block incoming TCP SYN packets allows remote attackers to cause a denial of service (crash) via a flood of TCP SYN packets to the WAN interface using a port scanner such as nmap.


The Xsun server for Sun Solaris 2.6 through 9 when running in Direct Graphics Access (DGA) mode allows local users to cause a denial of service (Xsun crash) or to create or overwrite arbitrary files on the system probably via a symlink attack on temporary server files.


The Q.931 dissector in Ethereal before 0.10.0 and Tethereal allows remote attackers to cause a denial of service (crash) via a malformed Q.931 which triggers a null dereference.


The \file handling\ in sort in HP-UX 10.01 through 10.20 and 11.00 through 11.11 is \incorrect \ which allows attackers to gain access or cause a denial of service via unknown vectors.


The Telnet daemon (in.telnetd) for Solaris 2.6 through 9 allows remote attackers to cause a denial of service (CPU consumption by infinite loop).


Sun Java Runtime Environment (JRE) 1.x before 1.4.2_11 and 1.5.x before 1.5.0_06 and as used in multiple web browsers allows remote attackers to cause a denial of service (application crash) via deeply nested object arrays which are not properly handled by the garbage collector and trigger invalid memory accesses.


Adiscon WinSyslog 4.21 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a long syslog message.


Crob FTP Server 3.5.1 allows remote authenticated users to cause a denial of service (crash) via a dir command with a large number of \.\ characters followed by a \/*\ string.


Monit 1.4 to 4.1 allows remote attackers to cause a denial of service (daemon crash) via an HTTP POST request with a negative Content-Length field.


Unspecified vulnerability in mod_mysql_logger shared object in SuckBot 0.006 allows remote attackers to cause a denial of service (seg fault) via unknown attack vectors.


The Post_Method function in Monkey HTTP Daemon before 0.6.2 allows remote attackers to cause a denial of service (crash) via a POST request without a Content-Type header.


BEA WebLogic Server proxy plugin for BEA Weblogic Express and Server 6.1 through 8.1 SP 1 allows remote attackers to cause a denial of service (proxy plugin crash) via a malformed URL.


BlackICE Defender 2.9.cap and Server Protection 3.5.cdf when configured to automatically block attacks allows remote attackers to block IP addresses and cause a denial of service via spoofed packets.


The DNS server for Cisco Content Service Switch (CSS) 11000 and 11500 when prompted for a nonexistent AAAA record responds with response code 3 (NXDOMAIN or \Name Error\) instead of response code 0 (\No Error\) which allows remote attackers to cause a denial of service (inaccessible domain) by forcing other DNS servers to send and cache a request for a AAAA record to the vulnerable server.


The PKI functionality in Mac OS X 10.2.8 and 10.3.2 allows remote attackers to cause a denial of service (service crash) via malformed ASN.1 sequences.


Unknown vulnerability in SunOne/iPlanet Web Server SP3 through SP5 on Windows platforms allows remote attackers to cause a denial of service.


Memory leak in HP OpenView Network Node Manager (NNM) 6.2 and 6.4 allows remote attackers to cause a denial of service (memory exhaustion) via crafted TCP packets.


ICAL.EXE in iCal 3.7 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request possibly due to an invalid method name.


libxml2 possibly before 2.5.0 does not properly detect recursion during entity expansion which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references aka the \billion laughs attack.\


mod_survey 3.0.0 through 3.0.15-pre6 does not check whether a survey exists before creating a subdirectory for it which allows remote attackers to cause a denial of service (disk consumption and possible crash).


The format_send_to_gui function in formats.c for irssi before 0.8.9 allows remote IRC users to cause a denial of service (crash).


ldbm_back_exop_passwd in the back-ldbm backend in passwd.c for OpenLDAP 2.1.12 and earlier when the slap_passwd_parse function does not return LDAP_SUCCESS attempts to free an uninitialized pointer which allows remote attackers to cause a denial of service (segmentation fault).


Unknown vulnerability in UFS for Solaris 9 for SPARC with logging enabled allows local users to cause a denial of service (UFS file system hang).


NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 allows user-assisted remote attackers to cause a denial of service (console hang) via a large number of FTP sessions which are not properly handled during an NLM unload.


connection.c in Cherokee web server before 0.4.6 allows remote attackers to cause a denial of service via an HTTP POST request without a Content-Length header field.


Easy File Sharing (EFS) Web Server 1.2 allows remote authenticated users to cause a denial of service via (1) an \empty symbol\ in the Title field or (2) certain data in the Your Message field possibly a long argument.


Memory leak in lofiadm in Solaris 8 allows local users to cause a denial of service (kernel memory consumption).


Aprelium Technologies Abyss Web Server 1.1.2 and possibly other versions before 1.1.4 allows remote attackers to cause a denial of service (crash) via an HTTP GET message with empty (1) Connection or (2) Range fields.


Plug and Play Web Server Proxy 1.0002c allows remote attackers to cause a denial of service (server crash) via an invalid URI in an HTTP GET request to TCP port 8080.


Unknown vulnerability in sendmail for Solaris 7 8 and 9 allows local users to cause a denial of service (unknown impact) and possibly gain privileges via certain constructs in a .forward file.


The (1) FTP (2) POP3 (3) SMTP and (4) NNTP servers in EServer 2.92 through 2.97 and possibly 2.98 allow remote attackers to cause a denial of service (crash) via a large amount of data.


The IMAP functionality in PHP before 4.3.1 allows remote attackers to cause a denial of service via an e-mail message with a (1) To or (2) From header with an address that contains a large number of \\\\ (backslash) characters.


Unknown vulnerability in diagmond and possibly other applications in HP9000 Series 700/800 running HP-UX B.11.00 B.11.04 B.11.11 and B.11.22 allows remote attackers to cause a denial of service (program failure) via certain network traffic.


Unrestricted critical resource lock in Terminal Services for Windows 2000 before SP4 and Windows XP allows remote authenticated users to cause a denial of service (reboot) by obtaining a read lock on msgina.dll which prevents msgina.dll from being loaded.


The L2TP protocol parser in tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (infinite loop and memory consumption) via a packet with invalid data to UDP port 1701 which causes l2tp_avp_print to use a bad length value when calling print_octets.


The SMTP service in Microsoft Windows 2000 before SP4 allows remote attackers to cause a denial of service (crash or hang) via an e-mail message with a malformed time stamp in the FILETIME attribute.


chatbox.php in e107 0.554 and 0.603 allows remote attackers to cause a denial of service (pages fail to load) via HTML in the Name field which prevents the main.php form from being loaded.


GoAhead WebServer before 2.1.5 on Windows 95 98 and ME allows remote attackers to cause a denial of service (daemon crash) via an HTTP request with a (1) con (2) nul (3) clock$ or (4) config$ device name in a path component different vectors than CVE-2001-0385.


Cisco PIX firewall 6.2.x through 6.2.3 when configured as a VPN Client allows remote attackers to cause a denial of service (dropped IPSec tunnel connection) via an IKE Phase I negotiation request to the outside interface of the firewall.


MAILsweeper for SMTP 4.3.6 and 4.3.7 allows remote attackers to cause a denial of service (CPU consumption) via a PowerPoint attachment that either (1) is corrupt or (2) contains \embedded objects.\


Unknown vulnerability in Nokia IPSO 3.7 configured as IP Clusters allows remote attackers to cause a denial of service via unknown attack vectors.


3Com HiPer Access Router Card (HiperARC) 4.0 through 4.2.29 allows remote attackers to cause a denial of service (reboot) via a flood of IAC packets to the telnet port.


Quake 2 server allows remote attackers to cause a denial of service via a spoofed UDP packet with a source address of 127.0.0.1 which causes the server to attempt to connect to itself.


Windows 95 and Windows 98 systems when configured with multiple TCP/IP stacks bound to the same MAC address allow remote attackers to cause a denial of service (traffic amplification) via a certain ICMP echo (ping) packet which causes all stacks to send a ping response aka TCP Chorusing.


IIS 3.x and 4.x does not distinguish between pages requiring encryption and those that do not which allows remote attackers to cause a denial of service (resource exhaustion) via SSL requests to the HTTPS port for normally unencrypted files which will cause IIS to perform extra work to send the files over SSL.


IBM/Tivoli OPC Tracker Agent version 2 release 1 allows remote attackers to cause a denial of service (resource exhaustion) via malformed data to the localtracker client port (5011) which prevents the connection from being closed properly.


Linuxconf on Red Hat Linux 6.0 and earlier does not properly disable PAM-based access to the shutdown command which could allow local users to cause a denial of service.


Windows NT 3.51 and 4.0 running WINS (Windows Internet Name Service) allows remote attackers to cause a denial of service (resource exhaustion) via a flood of malformed packets which causes the server to slow down and fill the event logs with error messages.


Eicon Technology Diva LAN ISDN modem allows a remote attacker to cause a denial of service (hang) via a long password argument to the login.htm file in its HTTP service.


ip_print procedure in Tcpdump 3.4a allows remote attackers to cause a denial of service via a packet with a zero length header which causes an infinite loop and core dump when tcpdump prints the packet.


LSA (LSASS.EXE) in Windows NT 4.0 allows remote attackers to cause a denial of service via a NULL policy handle in a call to (1) SamrOpenDomain (2) SamrEnumDomainUsers and (3) SamrQueryDomainInfo.


NBase switches NH208 and NH215 run a TFTP server which allows remote attackers to send software updates to modify the switch or cause a denial of service (crash) by guessing the target filenames which have default names.


Symantec pcAnywhere 8.0 allows remote attackers to cause a denial of service (CPU utilization) via a large amount of data to port 5631.


Vulnerability in AIX 4.1.4 and HP-UX 10.01 and 9.05 allows local users to cause a denial of service (crash) by using a socket to connect to a port on the localhost calling shutdown to clear the socket then using the same socket to connect to a different port on localhost.


counter.exe 2.70 allows a remote attacker to cause a denial of service (hang) via an HTTP request that ends in %0A (newline) which causes a malformed entry in the counter log that produces an access violation.


FTP service in IIS 4.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via many passive (PASV) connections at the same time.


Windows NT 4.0 allows remote attackers to cause a denial of service (crash) via extra source routing data such as (1) a Routing Information Field (RIF) field with a hop count greater than 7 or (2) a list containing duplicate Token Ring IDs.


Internet Explorer 4.0 allows remote attackers to cause a denial of service (crash) via HTML code that contains a long CLASSID parameter in an OBJECT tag.


Memory leak in Simple Network Management Protocol (SNMP) agent (snmp.exe) for Windows NT 4.0 before Service Pack 4 allows remote attackers to cause a denial of service (memory consumption) via a large number of SNMP packets with Object Identifiers (OIDs) that cannot be decoded.


A bug in Intel Pentium processor (MMX and Overdrive) allows local users to cause a denial of service (hang) in Intel-based operating systems such as Windows NT and Windows 95 via an invalid instruction aka the \Invalid Operand with Locked CMPXCHG8B Instruction\ problem.


Microsoft Outlook client allows remote attackers to cause a denial of service by sending multiple email messages with the same X-UIDL headers which causes Outlook to hang.


counter.exe 2.70 allows a remote attacker to cause a denial of service (hang) via a long argument.


Bug in AMD K6 processor on Linux 2.0.x and 2.1.x kernels allows local users to cause a denial of service (crash) via a particular sequence of instructions possibly related to accessing addresses outside of segments.


IIS 3.0 and 4.0 on x86 and Alpha allows remote attackers to cause a denial of service (hang) via a malformed GET request aka the IIS \GET\ vulnerability.


Compaq/Microcom 6000 Access Integrator does not cause a session timeout after prompting for a username or password which allows remote attackers to cause a denial of service by connecting to the integrator without providing a username or password.


Quake 1 and NetQuake servers allow remote attackers to cause a denial of service (resource exhaustion or forced disconnection) via a flood of spoofed UDP connection packets which exceeds the server's player limit.


The asynchronous I/O facility in 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification which allows local users to cause a denial of service by using certain ioctl and fcntl calls to cause the signal to be sent to an arbitrary process ID.


Microsoft Exchange Server 5.5 and 5.0 does not properly handle (1) malformed NNTP data or (2) malformed SMTP data which allows remote attackers to cause a denial of service (application error).


Windows NT 4.0 does not properly shut down invalid named pipe RPC connections which allows remote attackers to cause a denial of service (resource exhaustion) via a series of connections containing malformed data aka the \Named Pipes Over RPC\ vulnerability.


mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands which causes Apache to dump core.


Windows NT 4.0 before SP3 allows remote attackers to bypass firewall restrictions or cause a denial of service (crash) by sending improperly fragmented IP packets without the first fragment which the TCP/IP stack incorrectly reassembles into a valid session.


Windows NT 4.0 allows local users to cause a denial of service (crash) via an illegal kernel mode address to the functions (1) GetThreadContext or (2) SetThreadContext.


Vintra SMTP MailServer allows remote attackers to cause a denial of service via a malformed \EXPN *@\ command.


NFS daemon (nfsd.exe) for Omni-NFS/X 6.1 allows remote attackers to cause a denial of service (resource exhaustion) via certain packets possibly with the Urgent (URG) flag set to port 111.


Windows NT 4.0 allows local users to cause a denial of service via a user mode application that closes a handle that was opened in kernel mode which causes a crash when the kernel attempts to close the handle.


The Cenroll ActiveX control (xenroll.dll) for Terminal Server Editions of Windows NT 4.0 and Windows NT Server 4.0 before SP6 allows remote attackers to cause a denial of service (resource consumption) by creating a large number of arbitrary files on the target machine.


Cabletron SmartSwitch Router (SSR) 8000 firmware 2.x can only handle 200 ARP requests per second allowing a denial of service attack to succeed with a flood of ARP requests exceeding that limit.


Network Flight Recorder (NFR) 1.5 and 1.6 allows remote attackers to cause a denial of service in nfrd (crash) via a TCP packet with a null header and data field.


Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same name aka the \sioux\ vulnerability.


Vulnerability in union file system in FreeBSD 2.2 and earlier and possibly other operating systems allows local users to cause a denial of service (system reload) via a series of certain mount_union commands.


Windows NT 4.0 SP2 allows remote attackers to cause a denial of service (crash) possibly via malformed inputs or packets such as those generated by a Linux smbmount command that was compiled on the Linux 2.0.29 kernel but executed on Linux 2.0.25.


A non-default configuration in TenFour TFS Gateway 4.0 allows an attacker to cause a denial of service via messages with incorrect sender and recipient addresses which causes the gateway to continuously try to return the message every 10 seconds.


Tcpip.sys in Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service via an ICMP Subnet Mask Address Request packet when certain multiple IP addresses are bound to the same network interface.


Vulnerability when Network Address Translation (NAT) is enabled in Linux 2.2.10 and earlier with ipchains or FreeBSD 3.2 with ipfw allows remote attackers to cause a denial of service (kernel panic) via a ping -R (record route) command.


ndd in Solaris 2.6 allows local users to cause a denial of service by modifying certain TCP/IP parameters.


Vulnerability in passwd in SCO UNIX 4.0 and earlier allows attackers to cause a denial of service by preventing users from being able to log into the system.


HTTP server for Xerox DocuColor 4 LP allows remote attackers to cause a denial of service (hang) via a long URL that contains a large number of . characters.


Vulnerability in direct audio user space code on HP-UX 10.20 and 10.10 allows local users to cause a denial of service.


Seapine Software TestTrack server allows a remote attacker to cause a denial of service (high CPU) via (1) TestTrackWeb.exe and (2) ttcgi.exe by connecting to port 99 and disconnecting without sending any data.


Oracle Webserver 2.1 when serving PL/SQL stored procedures allows remote attackers to cause a denial of service via a long HTTP GET request.


StarTech (1) POP3 proxy server and (2) telnet server allows remote attackers to cause a denial of service via a long USER command.


Nachuatec D435 and D445 printer allows remote attackers to cause a denial of service via ICMP redirect storm.


pnserver in RealServer 5.0 and earlier allows remote attackers to cause a denial of service by sending a short malformed request.


Gene6 G6 FTP Server 2.0 allows a remote attacker to cause a denial of service (resource exhaustion) via a long (1) user name or (2) password.


Win32k.sys in Windows NT 4.0 before SP2 allows local users to cause a denial of service (crash) by calling certain WIN32K functions with incorrect parameters.


Microsoft HTML control as used in (1) Internet Explorer 5.0 (2) FrontPage Express (3) Outlook Express 5 and (4) Eudora and possibly others allows remote malicious web site or HTML emails to cause a denial of service (100% CPU consumption) via large HTML form fields such as text inputs in a table cell.


The Sun HotSpot Performance Engine VM allows a remote attacker to cause a denial of service on any server running HotSpot via a URL that includes the character.


SunOS 4.1.4 on a Sparc 20 machine allows local users to cause a denial of service (kernel panic) by reading from the /dev/tcx0 TCX device.


Vulnerability in integer multiplication emulation code on SPARC architectures for SunOS 4.1 through 4.1.2 allows local users to gain root access or cause a denial of service (crash).


Stalker Internet Mail Server 1.6 allows a remote attacker to cause a denial of service (crash) via a long HELO command.


Multilink PPP for ISDN dialup users in Ascend before 4.6 allows remote attackers to cause a denial of service via a spoofed endpoint identifier.


Windows 95 98 and NT 4.0 allow remote attackers to cause a denial of service by spoofing ICMP redirect messages from a router which causes Windows to change its routing tables.


inetd in AIX 4.1.5 dynamically assigns a port N when starting ttdbserver (ToolTalk server) but also inadvertently listens on port N-1 without passing control to ttdbserver which allows remote attackers to cause a denial of service via a large number of connections to port N-1 which are not properly closed by inetd.


Operating systems with shared memory implementations based on BSD 4.4 code allow a user to conduct a denial of service and bypass memory limits (e.g. as specified with rlimits) using mmap or shmget to allocate memory and cause page faults.


SMTP server in SLmail 3.1 and earlier allows remote attackers to cause a denial of service via malformed commands whose arguments begin with a \(\ (parenthesis) character such as (1) SEND (2) VRFY (3) EXPN (4) MAIL FROM (5) RCPT TO.


Sendmail before 8.10.0 allows remote attackers to cause a denial of service by sending a series of ETRN commands then disconnecting from the server while Sendmail continues to process the commands after the connection has been terminated.


Windows Internet Naming Service (WINS) allows remote attackers to cause a denial of service (connectivity loss) or steal credentials via a 1Ch registration that causes WINS to change the domain controller to point to a malicious server. NOTE: this problem may be limited when Windows 95/98 clients are used or if the primary domain controller becomes unavailable.


Windows NT 3.51 and 4.0 allow local users to cause a denial of service (crash) by running a program that creates a large number of locks on a file which exhausts the NonPagedPool.


Internet Anywhere POP3 Mail Server 2.3.1 allows remote attackers to cause a denial of service (crash) via (1) LIST (2) TOP or (3) UIDL commands using letters as arguments.


Vulnerabilities in DECnet/OSI for OpenVMS before 5.8 on DEC Alpha AXP and VAX/VMS systems allow local users to gain privileges or cause a denial of service.


Hummingbird Exceed X version 5 allows remote attackers to cause a denial of service via malformed data to port 6000.


ping in Solaris 2.3 through 2.6 allows local users to cause a denial of service (crash) via a ping request to a multicast address through the loopback interface e.g. via ping -i.


A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs which generates a large number of processes.


Netbt.sys in Windows NT 4.0 allows remote malicious DNS servers to cause a denial of service (crash) by returning 0.0.0.0 as the IP address for a DNS host name lookup.


Vulnerability in telnet service in HP-UX 10.30 allows attackers to cause a denial of service.


BisonWare FTP Server 4.1 and earlier allows remote attackers to cause a denial of service via a malformed PORT command that contains a non-numeric character and a large number of carriage returns.


AnswerBook2 (AB2) web server dwhttpd 3.1a4 allows remote attackers to cause a denial of service (resource exhaustion) via an HTTP POST request with a large content-length.


nsd in IRIX 6.5 through 6.5.2 exports a virtual filesystem on a UDP port which allows remote attackers to view files and cause a possible denial of service by mounting the nsd virtual file system.


FORE PowerHub before 5.0.1 allows remote attackers to cause a denial of service (hang) via a TCP SYN scan with TCP/IP OS fingerprinting e.g. via nmap.


ICQ ActiveList Server allows remote attackers to cause a denial of service (crash) via malformed packets to the server's UDP port.


Teardrop IP denial of service.


The Windows NT Client Server Runtime Subsystem (CSRSS) can be subjected to a denial of service when all worker threads are waiting for user input.


Firewall-1 sets a long timeout for connections that begin with ACK or other packets except SYN allowing an attacker to conduct a denial of service via a large number of connection attempts to unresponsive systems.


Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer.


The passwd command in Solaris can be subjected to a denial of service.


ip_input.c in BSD-derived TCP/IP implementations allows remote attackers to cause a denial of service (crash or hang) via crafted packets.


BMC Patrol allows any remote attacker to flood its UDP port causing a denial of service.


IP fragmentation denial of service in FreeBSD allows a remote attacker to cause a crash.


Windows NT 4.0 allows remote attackers to cause a denial of service via a malformed SMB logon request in which the actual data size does not match the specified size.


The ping command in Linux 2.0.3x allows local users to cause a denial of service by sending large packets with the -R (record route) option.


The Syntax Checker in ColdFusion Server 4.0 allows remote attackers to conduct a denial of service.


Local users can perform a denial of service in NetBSD 1.3.3 and earlier versions by creating an unusual symbolic link with the ln command triggering a bug in VFS.


Arkiea nlservd allows remote attackers to conduct a denial of service.


TCP RST denial of service in FreeBSD.


Unauthorized privileged access or denial of service via dtappgather program in CDE.


FTP PASV \Pizza Thief\ denial of service and unauthorized data access. Attackers can steal data by connecting to a port that was intended for use by a client.


XFree86 xfs command is vulnerable to a symlink attack allowing local users to create files in restricted directories possibly allowing them to gain privileges or cause a denial of service.


Remote attackers can cause a denial of service on Linux in.telnetd telnet daemon through a malformed TERM environmental variable.


Remote attackers can perform a denial of service using IRIX fcagent.


Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages.


An attacker can conduct a denial of service in Windows NT by executing a program with a malformed file image header.


Denial of service when an attacker sends many SYN packets to create multiple connections without ever sending an ACK to complete the connection aka SYN flood.


Cisco Catalyst LAN switches running Catalyst 5000 supervisor software allows remote attackers to perform a denial of service by forcing the supervisor module to reload.


Access violation in LSASS.EXE (LSA/LSARPC) program in Windows NT allows a denial of service.


Windows 95/NT out of band (OOB) data denial of service through NETBIOS port aka WinNuke.


64 bit Solaris 7 procfs allows local users to perform a denial of service.


Cisco PIX firewall and CBAC IP fragmentation attack results in a denial of service.


The Windows NT RPC service allows remote attackers to conduct a denial of service using spoofed malformed RPC packets which generate an error message that is sent to the spoofed host potentially setting up a loop aka Snork.


Windows NT Service Control Manager (SCM) allows remote attackers to cause a denial of service via a malformed argument in a resource enumeration request.


A later variation on the Teardrop IP denial of service attack a.k.a. Teardrop-2.


Memory leak in SNMP agent in Windows NT 4.0 before SP5 allows remote attackers to conduct a denial of service (memory exhaustion) via a large number of queries.


Land IP denial of service.


Check Point FireWall-1 can be subjected to a denial of service via UDP packets that are sent through VPN-1 to port 0 of a host.


WS_FTP server remote denial of service through cwd command.


Remote attackers can cause a denial of service in Sendmail 8.8.x and 8.9.2 by sending messages with a large number of headers.


Windows NT Terminal Server performs extra work when a client opens a new connection but before it is authenticated allowing for a denial of service.


A bug in Cyrix CPUs on Linux allows local users to perform a denial of service.


Novell NetWare Transaction Tracking System (TTS) in Novell 4.11 and earlier allows remote attackers to cause a denial of service via a large number of requests.


Denial of service Netscape Enterprise Server with VirtualVault on HP-UX VVOS systems.


Windows NT Local Security Authority (LSA) allows remote attackers to cause a denial of service via malformed arguments to the LsaLookupSids function which looks up the SID aka \Malformed Security Identifier Request.\


Local users can perform a denial of service in Tripwire 1.2 and earlier using long filenames.


The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to the (1) advsearch.asp (2) query.asp or (3) search.asp scripts.


The WINS server in Microsoft Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service (process termination) via invalid UDP frames to port 137 (NETBIOS Name Service) as demonstrated via a flood of random packets.


Sun's ftpd daemon can be subjected to a denial of service.


Process table attack in Unix systems allows a remote attacker to perform a denial of service by filling a machine's process tables through multiple connections to network services.


FreeBSD VFS cache (vfs_cache) allows local users to cause a denial of service by opening a large number of files.


Sample runnable code snippets in ColdFusion Server 4.0 allow remote attackers to read files conduct a denial of service or use the server as a proxy for other HTTP calls.


NIS finger allows an attacker to conduct a denial of service via a large number of finger requests resulting in a large number of NIS queries.


Microsoft SQL 7.0 server allows a remote attacker to cause a denial of service via a malformed TDS packet.


The OmniHTTPD visadmin.exe program allows a remote attacker to conduct a denial of service via a malformed URL which causes a large number of temporary files to be created.


ColdFusion MX 6.1 and 6.1 J2EE allows remote attackers to cause a denial of service via an HTTP request containing a large number of form fields.


Sophos Anti-Virus 3.78 allows remote attackers to cause a denial of service (infinite loop) via a MIME header that is not properly terminated.


Reptile Web Server allows remote attackers to cause a denial of service (CPU consumption) via multiple incomplete GET requests without the HTTP version.


X.509 Certificate Signature Verification in Gnu transport layer security library (GnuTLS) 1.0.16 allows remote attackers to cause a denial of service (CPU consumption) via certificates containing long chains and signed with large RSA keys.


Clearswift MAILsweeper for SMTP before 4.3_13 allows remote attackers to cause a denial of service (infinite loop) via an e-mail with a crafted RAR archive attached.