An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash which leads to denial of service.


Eclipse tinydtls 0.8.2 for Eclipse IoT allows remote attackers to cause a denial of service (DTLS peer crash) by sending a \Change cipher spec\ packet without pre-handshake.


Ninka before 1.3.2 might allow remote attackers to obtain sensitive information manipulate license compliance scan results or cause a denial of service (process hang) via a crafted filename.


LibTIFF 4.0.7 has a \shift exponent too large for 64-bit type long\ undefined behavior issue which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


aacplusenc.c in HE-AAC+ Codec (aka libaacplus) 2.0.2 has an assertion failure which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.


The get_relocs_64 function in libr/bin/format/mach0/mach0.c in radare2 1.3.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted Mach0 file.


SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory consumption) via large values in the width and height parameters to otp_logon_ui_resources/qr aka SAP Security Note 2389042.


tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.


A Predictable Value Range from Previous Values issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA Series A and B Version 16.00 and prior versions; 1763-L16BBB Series A and B Version 16.00 and prior versions; 1763-L16BWA Series A and B Version 16.00 and prior versions; and 1763-L16DWD Series A and B Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA Series A and B Version 16.00 and prior versions; 1766-L32BWA Series A and B Version 16.00 and prior versions; 1766-L32BWAA Series A and B Version 16.00 and prior versions; 1766-L32BXB Series A and B Version 16.00 and prior versions; 1766-L32BXBA Series A and B Version 16.00 and prior versions; and 1766-L32AWAA Series A and B Version 16.00 and prior versions. Insufficiently random TCP initial sequence numbers are generated which may allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connections resulting in a denial of service for the target device.


The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image.


An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the \CFNetwork Proxies\ component. It allows remote attackers to cause a denial of service.


elf_compress.c in elfutils 0.168 does not validate the zlib compression factor which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.


Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with \SecurityLevel None\ and with empty \AuthFile\ options) via a crafted UDP packet.


An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the \iBooks\ component. It allows remote attackers to cause a denial of service (persistent outage) via a crafted iBooks file.


The AMD Ryzen processor with AGESA microcode through 2017-01-27 allows local users to cause a denial of service (system hang) via an application that makes a long series of FMA3 instructions as demonstrated by the Flops test suite.


Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.


PostgreSQL versions before 9.4.13 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object resulting in a denial of service.


Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView client login credentials.


An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party \file\ product. Versions before 5.30 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.


In ARM Trusted Firmware through 1.3 the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service (secure world panic) via vectors involving debug exceptions and debug registers.


The iwgif_read_image function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.


The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52.


An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the \libc\ component. It allows remote attackers to cause a denial of service (resource consumption) via a crafted string that is mishandled by the glob function.


Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local denial of service condition due to insecure permissions when running in Agent Mode.


elflink.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.28 has a \member access within null pointer\ undefined behavior issue which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an \int main() {return 0;}\ program.


On the D-Link DIR-615 before v20.12PTb04 if a victim logged in to the Router's Web Interface visits a malicious site from another Browser tab the malicious site then can send requests to the victim's Router without knowing the credentials (CSRF). An attacker can host a page that sends a POST request to Form2File.htm that tries to upload Firmware to victim's Router. This causes the router to reboot/crash resulting in Denial of Service. An attacker may succeed in uploading malicious Firmware.


When handling a decoding failure for a malformed URL path of an HTTP request libprocess in Apache Mesos before 1.1.3 1.2.x before 1.2.2 1.3.x before 1.3.1 and 1.4.0-dev might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.


Palo Alto Networks Traps ESM Console before 3.4.4 allows attackers to cause a denial of service by leveraging improper validation of requests to revoke a Traps agent license.


An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. The issue involves the \Kernel\ component. It allows local users to bypass intended memory-read restrictions or cause a denial of service (system crash).


The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.


crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling its own callback and infinite recursion) by triggering EBUSY on a full queue.


The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8 and so cause a denial of service for the clients.


An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. watchOS before 3.2.3 is affected. The issue involves the \Messages\ component. It allows remote attackers to cause a denial of service (memory consumption and application crash).


LibTIFF 4.0.7 has an \outside the range of representable values of type unsigned char\ undefined behavior issue which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


The cp_report_fixup function in drivers/hid/hid-cypress.c in the Linux kernel 3.2 and 4.x before 4.9.4 allows physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report.


The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.


au_channel.h in HE-AAC+ Codec (aka libaacplus) 2.0.2 has a left-shift undefined behavior issue which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted audio file.


LibTIFF 4.0.7 has an \outside the range of representable values of type short\ undefined behavior issue which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


tif_dirread.c in LibTIFF 4.0.7 has an \outside the range of representable values of type float\ undefined behavior issue which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests the thread pool becomes exhausted. Once the thread pool is exhausted Traffic Router is unable to service any DNS request regardless of transport protocol.


libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access and application crash) by triggering an invalid Unicode property lookup.


The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain levels data which allows local users to cause a denial of service (ZERO_SIZE_PTR dereference and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device.


OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.


An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party \file\ product. Versions before 5.30 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


If a long user name is used in a username/password combination in a site URL (such as \ http://UserName:Password@example.com\) the resulting modal prompt will hang in a non-responsive state or crash causing a denial of service. This vulnerability affects Firefox < 55.


The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply related to net/sunrpc/svc.c fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.


The (1) v9fs_create and (2) v9fs_lcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS privileged users to cause a denial of service (file descriptor or memory consumption) via vectors related to an already in-use fid.


The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.7 does not validate certain levels data which allows local users to cause a denial of service (system hang) via a crafted ioctl call for a /dev/dri/renderD* device.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the \CoreText\ component. It allows remote attackers to cause a denial of service (application crash) via a crafted file.


An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the third-party \SQLite\ product. Versions before 3.19.3 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the \EventKitUI\ component. It allows remote attackers to cause a denial of service (resource consumption and application crash).


The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memory allocation and application crash) via a crafted file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862 and CVE-2016-8866.


coders/rle.c in ImageMagick 7.0.5-4 has an \outside the range of representable values of type unsigned char\ undefined behavior issue which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion) or conduct HTTP Response Splitting attacks with resultant XSS via an invalid parameter value.


The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file.


An assertion-failure flaw was found in Qemu before 2.10.1 in the Network Block Device (NBD) server's initial connection negotiation where the I/O coroutine was undefined. This could crash the qemu-nbd server if a client sent unexpected data during connection negotiation. A remote user or process could use this flaw to crash the qemu-nbd server resulting in denial of service.


An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. The issue involves the \Safari Printing\ component. It allows remote attackers to cause a denial of service (excessive print dialogs) via a crafted web site.


The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data which allows local users to cause a denial of service (integer signedness error and out-of-bounds write) or gain privileges (if the CAP_NET_RAW capability is held) via crafted system calls.


iSmartAlarm cube devices allow Denial of Service. Sending a SYN flood on port 12345 will freeze the \cube\ and it will stop responding.


In Eclipse Mosquitto 1.4.15 and earlier a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can send crafted CONNECT packets which could cause a denial of service in the Mosquitto Broker.


An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the \Messages\ component. It allows remote attackers to cause a denial of service (crash) via a crafted image.


An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. If the certreq field is not present in a certificate an assertion error is triggered causing a denial of service.


LibTIFF 4.0.7 has an \outside the range of representable values of type float\ undefined behavior issue which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


The cookie feature in the packet action API implementation in net/sched/act_api.c in the Linux kernel 4.11.x through 4.11-rc7 mishandles the tb nlattr array which allows local users to cause a denial of service (uninitialized memory access and refcount underflow and system hang or crash) or possibly have unspecified other impact via \tc filter add\ commands in certain contexts. NOTE: this does not affect stable kernels such as 4.10.x from kernel.org.


** DISPUTED ** BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addresses (as defined in RFC 1812 section 5.3.7). This product enables net.ipv4.conf.all.log_martians by default. NOTE: the vendor reports \It has been proved that this vulnerability has no foundation and it is totally fake and based on false assumptions.\


The allocate_channel_framebuffer function in uncompressed_components.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a malformed JPEG image.


Nitro Pro 11.0.3 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted PCX file.


elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.


An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party \file\ product. Versions before 5.30 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


** DISPUTED ** The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an \outside the range of representable values of type long\ undefined behavior issue which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports \This is not a security issue in my view. The conversion surely is truncating the double into a long value but there is no impact as the value is one of the RGB components.\


OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.


It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content and possibly permissions to arbitrary files which could be used for denial of service or possibly privilege escalation.


The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


An Improper XML Parser Configuration issue was discovered in Schneider Electric Wonderware Historian Client 2014 R2 SP1 and prior. An improperly restricted XML parser (with improper restriction of XML external entity reference or XXE) may allow an attacker to enter malicious input through the application which could cause a denial of service or disclose file contents from a server or connected network.


The TFTP server in ExtraPuTTY 0.30 and earlier allows remote attackers to cause a denial of service (crash) via a large (1) read or (2) write TFTP protocol message.


Use-after-free vulnerability in the fz_subsample_pixmap function in fitz/pixmap.c in Artifex Software Inc. MuPDF 1.10a allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted document.


In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence) an authenticated client can cause a double free leading to denial of service or potentially code execution.


An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the \AppSandbox\ component. It allows attackers to cause a denial of service via a crafted app.


Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server.


The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiCreateAllocation where untrusted user input is used as a divisor without validation during a calculation which may lead to a potential divide by zero and denial of service.


The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.


FastStone MaxView 3.0 and 3.1 allows user-assisted attackers to cause a denial of service (application crash) via a malformed BMP image with a crafted biSize field in the BITMAPINFOHEADER section.


The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection which allows remote attackers to cause a denial of service (CPU consumption) by sending many ACK packets. After the attacker stops the exploit the CPU usage is 100% and the router requires a reboot for normal operation.


The Multicast DNS (mDNS) responder used in BOSE Soundtouch 30 inadvertently responds to IPv4 unicast queries with source addresses that are not link-local which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets.


A vulnerability in the IPv6 stack on Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b 8.1.2 and 8.2.0 could allow an attacker to cause a denial of service (CPU consumption and device hang) condition by sending crafted Router Advertisement (RA) messages to a targeted system.


The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors a different vulnerability than CVE-2017-9330.


The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.


avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive information from the responding device via port-5353 UDP packets. NOTE: this may overlap CVE-2015-2809.


The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.


net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986.


An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Denial of service affecting NetBackup server can occur.


The reset1 function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted file.


Symantec Encryption Desktop before SED 10.4.1MP2 can allow remote attackers to cause a denial of service (resource consumption) via crafted web requests.\


The decodeSample function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.


NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.


Multiple

use-after-free

vulnerabilities

in

the

function

in

base/gxipixel.c

in

Ghostscript

before

allow

remote

attackers

to

cause

a

denial

of

service

(application

crash)

or

possibly

have

unspecified

other

impact

via

a

crafted

PostScript

document.


NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiCreateAllocation where untrusted user input is used as a divisor without validation while processing block linear information which may lead to a potential divide by zero and denial of service.


WAVE.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via vectors related to a large number of coefficients.


The runPull function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted file.


The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages lock dropping which allows local users to cause a denial of service (deadlock) via crafted operations on IrDA devices.


A Resource Exhaustion issue was discovered in Rockwell Automation ControlLogix 5580 controllers V28.011 V28.012 and V28.013; ControlLogix 5580 controllers V29.011; CompactLogix 5380 controllers V28.011; and CompactLogix 5380 controllers V29.011. This vulnerability may allow an attacker to cause a denial of service condition by sending a series of specific CIP-based commands to the controller.


The jas_matrix_bindsub function in jas_seq.c in JasPer 2.0.10 allows remote attackers to cause a denial of service (invalid read) via a crafted image.


The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a fork bomb in the sandbox or by using a large amount of disk space.


It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.


Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string in the HTTP Referer header.


The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. The issue involves the \Notifications\ component. It allows attackers to cause a denial of service via a crafted app.


The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in required circumstances which allows local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls.


The Symantec Management Console prior to ITMS 8.1 RU1 ITMS 8.0_POST_HF6 and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data denial of service server side request forgery port scanning from the perspective of the machine where the parser is located and other system impacts.


The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag.


The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (invalid read) via a crafted file.


NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive related to the unpeer option.


F5 BIG-IP LTM AAM AFM Analytics APM ASM DNS GTM Link Controller PEM Websafe software version 12.0.0 to 12.1.2 11.6.0 to 11.6.1 are vulnerable to a denial of service attack when the MPTCP option is enabled on a virtual server. Data plane is vulnerable when using the MPTCP option of a TCP profile. There is no control plane exposure. An attacker may be able to disrupt services by causing TMM to restart hence temporarily failing to process traffic.


The parse_char_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression library as used in Ruby 2.4.0 allows remote attackers to cause a denial of service (deep recursion and application crash) via a crafted regular expression.


An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion stack consumption and hypervisor crash) or possibly gain privileges via crafted page-table stacking.


The named pipes in qtsingleapp in Qt 5.x as used in qBittorrent and SugarSync are configured for remote access and allow remote attackers to cause a denial of service (application crash) via an unspecified string.


IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to \Data from Faulting Address controls Branch Selection starting at CADIMAGE+0x000000000002ca2e.\


IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file related to \Data from Faulting Address controls Branch Selection starting at PDF!xmlListWalk+0x00000000000166c4.\


IrfanView

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.tif

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at


find_abstract_instance_name in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.


An issue was discovered in Xen 4.5.x through 4.9.x allowing attackers (who control a stub domain kernel or tool stack) to cause a denial of service (host OS crash) because of a missing comparison (of range start to range end) within the DMOP map/unmap implementation.


XnView

Classic

for

Windows

Version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.dll

file

that

is

mishandled

during

an

attempt

to

render

the

DLL

icon

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77310000!LdrpResCompareResourceNames+0x0000000000000087.\


IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file related to \Data from Faulting Address controls Branch Selection starting at PDF!xmlListWalk+0x0000000000019fc8.\


In Flexense VX Search Enterprise v10.1.12 the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9123.


IrfanView

with

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.dwg

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

verifier!AVrfpDphFindBusyMemoryNoCheck+0x0000000000000091.\


IrfanView

with

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.dwg

file

related

to

a

\Read

Access

Violation

starting

at

BabaCAD4Image!ShowPlugInOptions+0x000000000001e6b0.\


IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to \Data from Faulting Address controls Branch Selection starting at CADIMAGE+0x00000000000348b9.\


p_lx_elf.cpp in UPX 3.94 mishandles ELF headers which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted binary file as demonstrated by an Invalid Pointer Read in PackLinuxElf64::unpack().


IrfanView

with

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.dwg

file

related

to

a

\Read

Access

Violation

starting

at

BabaCAD4Image!ShowPlugInOptions+0x0000000000009f39.\


The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before 2017-09-25 mishandles a certain case where a variable may reside in a register which allows remote attackers to cause a denial of service (Fitz fz_drop_imp use-after-free and application crash) or possibly have unspecified other impact via a crafted PDF document.


In Flexense Disk Pulse Enterprise v10.1.18 the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9120.


Huawei Smartphones with software LON-L29DC721B186 have a denial of service vulnerability. An attacker could make an loop exit condition that cannot be reached by sending the crafted 3GPP message. Successful exploit could cause the device to reboot.


The store_versioninfo_gnu_verdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service (r_read_le16 invalid write and application crash) or possibly have unspecified other impact via a crafted ELF file.


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

a

\Possible

Stack

Corruption

starting

at

PDF!xmlGetGlobalState+0x00000000000568a4.\


IrfanView

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

\Data

from

Faulting

Address

may

be

used

as

a

return

value

starting

at

PDF!xmlParserInputRead+0x0000000000040db4.\


IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to \Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at CADIMAGE+0x00000000003e9462.\


dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 miscalculates DW_FORM_ref_addr die refs in the case of a relocatable object file which allows remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read segmentation fault and application crash).


_bfd_dwarf2_cleanup_debug_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 allows remote attackers to cause a denial of service (memory leak) via a crafted ELF file.


Huawei AR3200 V200R008C20 V200R008C30 TE40 V600R006C00 TE50 V600R006C00 TE60 V600R006C00 have a denial of service vulnerability. The software decodes X.509 certificate in an improper way. A remote unauthenticated attacker could send a crafted X.509 certificate to the device. Successful exploit could result in a denial of service on the device.


Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.


In Flexense SysGauge Server 3.6.18 the Control Protocol suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9221.


EmTec PyroBatchFTP before 3.18 allows remote servers to cause a denial of service (application crash).


** DISPUTED ** The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression \function()\ substring as demonstrated by a \function(){console.log(\ call or a simple infinite loop. NOTE: the vendor agrees that denial of service can occur but notes that deserialize is explicitly listed as \harmful\ within the README.md file.


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

PDF!xmlParserInputRead+0x00000000001168a1.\


IrfanView

with

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.dwg

file

related

to

a

\Read

Access

Violation

starting

at

BabaCAD4Image!ShowPlugInOptions+0x0000000000009ae0.\


An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hypervisor crash) or gain privileges because IDT settings are mishandled during CPU hotplugging.


The foreach function in ext/ccsv.c in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file.


plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbis_block_clear function with uninitialized data upon detection of invalid input which allows remote attackers to cause a denial of service (application crash) via a crafted file.


XnView Classic for Windows Version 2.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to \Data from Faulting Address controls Branch Selection starting at CADImage+0x0000000000259aa4.\


IrfanView 4.50 - 64bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dds file related to \Read Access Violation starting at FORMATS!ReadBLP_W+0x0000000000001b22.\


decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted ELF file.


An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because MSI mapping was mishandled.


XnView

Classic

for

Windows

Version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.dll

file

that

is

mishandled

during

an

attempt

to

render

the

DLL

icon

related

to

\Data

from

Faulting

Address

is

used

as

one

or

more

arguments

in

a

subsequent

Function

Call

starting

at

ntdll_77310000!LdrpResCompareResourceNames+0x0000000000000150.\


The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) or possibly have unspecified other impact by leveraging \limited access to the machine.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

PDF!xmlParserInputRead+0x000000000011624a.\


A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin using HTML::Parser we setup an object and hook into the begin and end tag event handlers In both cases the \open\ event is immediately followed by a \close\ event - even if the tag *does not* close in the HTML being parsed. Because of this we are missing the \text\ event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the future.


ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file related to \Conditional jump or move depends on uninitialised value(s).\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

PDF!xmlParserInputRead+0x00000000000929f5.\


In Flexense DiskBoss Enterprise 8.5.12 the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 8094.


The London Trust Media Private Internet Access (PIA) application before 1.3.3.1 for Android allows remote attackers to cause a denial of service (application crash) via a large VPN server-list file.


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

PDF!xmlGetGlobalState+0x0000000000057b76.\


The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 when invoked with GLOB_TILDE could skip freeing allocated memory when processing the ~ operator with a long user name potentially leading to a denial of service (memory leak).


An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial of service (prevent physical CPU usage) because of lock mishandling upon detection of an add-to-physmap error.


IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to \Data from Faulting Address controls Branch Selection starting at CADIMAGE+0x00000000003d21b3.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

\Data

from

Faulting

Address

may

be

used

as

a

return

value

starting

at

PDF!xmlParserInputRead+0x0000000000129a59.\


The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation.


An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because self-linear shadow mappings are mishandled for translated guests.


The miner statistics HTTP API in EWBF Cuda Zcash Miner Version 0.3.4b hangs on incoming TCP connections until some sort of request is made (such as \GET / HTTP/1.1\) which allows for a Denial of Service attack preventing a user from viewing their mining statistics by an attacker opening a session with telnet or netcat and connecting to the miner on the HTTP API port.


IrfanView

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.tif

file

related

to

\Data

from

Faulting

Address

is

used

as

one

or

more

arguments

in

a

subsequent

Function

Call

starting

at


XnView

Classic

for

Windows

Version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.dll

file

that

is

mishandled

during

an

attempt

to

render

the

DLL

icon

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77310000!LdrpResSearchResourceInsideDirectory+0x000000000000029e.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

a

\Read

Access

Violation

starting

at

PDF!xmlParserInputRead+0x00000000001601b0.\


A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vulnerability a remote user must be able to establish an AMQP connection to the Qpid Dispatch Router and send a specifically crafted AMQP frame which will cause it to segfault and shut down.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel While processing the RIC Data Descriptor IE in an artificially crafted 802.11 frame with IE length more than 255 an infinite loop may potentially occur resulting in a denial of service.


The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

a

\Read

Access

Violation

starting

at

PDF!xmlParserInputRead+0x0000000000132e19.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

a

\Possible

Stack

Corruption

starting

at

PDF!xmlGetGlobalState+0x0000000000057b35.\


XnView Classic for Windows Version 2.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to \Data from Faulting Address may be used as a return value starting at CADImage+0x0000000000285ec1.\


XnView Classic for Windows Version 2.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to \Data from Faulting Address controls Branch Selection starting at CADImage+0x0000000000285ce1.\


In Apache httpd 2.0.23 to 2.0.65 2.2.0 to 2.2.34 and 2.4.0 to 2.4.29 mod_authnz_ldap if configured with AuthLDAPCharsetConfig uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case quite unlikely the process would crash which could be used as a Denial of Service attack. In the more likely case this memory is already reserved for future use and the issue has no effect at all.


An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (memory leak) because reference counts are mishandled.


XnView Classic for Windows Version 2.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to \Data from Faulting Address may be used as a return value starting at CADImage+0x0000000000285e9d.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

a

\Read

Access

Violation

starting

at

PDF!xmlGetGlobalState+0x000000000007dfa5.\


IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file related to \Data from Faulting Address may be used as a return value starting at CADIMAGE+0x00000000003d24a0.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

a

\Read

Access

Violation

starting

at

PDF!xmlParserInputRead+0x0000000000161a9c.\


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

a

\Read

Access

Violation

starting

at

PDF!xmlParserInputRead+0x0000000000132cef.\


IrfanView

with

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.dwg

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

BabaCAD4Image!ShowPlugInOptions+0x00000000000029ba.\


Git through 2.14.2 mishandles layers of tree objects which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository aka a Git bomb. This can also have an impact of disk consumption; however an affected process typically would not survive its attempt to build the data structure in memory before writing to disk.


IrfanView

with

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.dwg

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

BabaCAD4Image!ShowPlugInOptions+0x000000000001f0a0.\


Huawei DP300 V500R002C00 TE60 V600R006C00 TP3106 V100R002C00 eSpace U1981 V200R003C30SPC100 have a denial of service vulnerability. The software does not correctly calculate the rest size in a buffer when handling SSL connections. A remote unauthenticated attacker could send a lot of crafted SSL messages to the device successful exploit could cause no space in the buffer and then denial of service.


In Flexense Sync Breeze Enterprise v10.1.16 the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9121.


IrfanView

version

with

PDF

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.pdf

file

related

to

an

\Error

Code

starting

at

wow64!Wow64NotifyDebugger+0x000000000000001d.\


IrfanView

with

plugin

version

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.dwg

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

BabaCAD4Image!ShowPlugInOptions+0x00000000000029c2.\


VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain an integer-overflow vulnerability in the True Type Font parser in the TPView.dll. On Workstation this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.


An issue was discovered in Cloud Foundry release v247 through v252 UAA stand-alone release v3.9.0 through v3.11.0 and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack.


VMware vCenter Server (6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c) does not correctly handle specially crafted LDAP network packets which may allow for remote denial of service.


VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds write vulnerability in JPEG2000 parser in the TPView.dll. On Workstation this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View Client.


The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG 6.0 U3 without patch ESXi600-201703401-SG 6.0 U2 without patch ESXi600-201703403-SG 6.0 U1 without patch ESXi600-201703402-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 has uninitialized memory usage. This issue may allow a guest to execute code on the host. The issue is reduced to a Denial of Service of the guest on ESXi 5.5.


VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple heap buffer-overflow vulnerabilities in JPEG2000 parser in the TPView.dll. On Workstation this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.


VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain a heap buffer-overflow vulnerability in TrueType Font (TTF) parser in the TPView.dll. On Workstation this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.


VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds write vulnerabilities in JPEG2000 parser in the TPView.dll. On Workstation this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.


OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets which allows remote attackers to cause a denial of service (system crash or application crash) via crafted fields as demonstrated by an integer underflow and assertion failure for a small MTU value.


The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.


The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights which allows remote attackers to cause a denial of service (integer signedness error and out-of-array read) via a crafted MPEG file.


An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode.


In TG Soft Vir.IT eXplorer Lite 8.5.65 the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273E060.


An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to gain privileges on the host OS obtain sensitive information or cause a denial of service (BUG and host OS crash) by leveraging the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors.


The Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (memory access violation) or possibly have unspecified other impact via a COFF binary in which a relocation refers to a location after the end of the to-be-relocated section.


An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.


PEM

module

of

Huawei

IPS

Module

NGFW

Module

Secospace

Secospace

Secospace

ViewPoint

has

a

pointer

reference

vulnerability

due

to

insufficient

verification.

An

authenticated

local

attacker

calls

PEM

decoder

with

special

parameter

which

could

cause

a

denial

of

service.


An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service because of attempts to match arbitrarily long strings aka TBE-01-003.


In TG Soft Vir.IT eXplorer Lite 8.5.65 the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x827300A4.


MikroTik v6.40.5 devices allow remote attackers to cause a denial of service via a flood of ICMP packets.


Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10 allows attackers to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration because a kfree of the usbtv data structure occurs during a usbtv_video_free call but the usbtv_video_fail label's code attempts to both access and free this data structure.


The ff_vc1_mc_4mv_chroma4 function in libavcodec/vc1_mc.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation fault and application crash) or possibly have unspecified other impact via a crafted file.


An issue was discovered on D-Link DIR-605L Model B before FW2.11betaB06_hbrf devices related to the code that handles the authentication values for HNAP. An attacker can cause a denial of service (device crash) or possibly have unspecified other impact by sending a sufficiently long string in the password field of the HTTP Basic Authentication section of the HTTP request.


Huawei Secospace USG6600 V500R001C30SPC100 has an Out-of-Bounds memory access vulnerability due to insufficient verification. An authenticated local attacker can make processing crash by executing some commands. The attacker can exploit this vulnerability to cause a denial of service.


The h264_slice_init function in libavcodec/h264_slice.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted file.


An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page.


An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to cause a denial of service (infinite loop and host OS hang) by leveraging the mishandling of Populate on Demand (PoD) errors.


In TG Soft Vir.IT eXplorer Lite 8.5.65 the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273A0A0 a different vulnerability than CVE-2017-17798.


kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code even though it would still be processed by JIT compilers. This behavior also considered an improper branch-pruning logic issue could possibly be used by local users for denial of service.


PEM

module

of

Huawei

IPS

Module

NGFW

Module

Secospace

Secospace

Secospace

ViewPoint

has

a

heap

overflow

vulnerability

due

to

insufficient

verification.

An

authenticated

local

attacker

can

make

processing

crash

by

a

malicious

certificate.

The

attacker

can

exploit

this

vulnerability

to

cause

a

denial

of

service.


Huawei VP9660 V500R002C10 has a uncontrolled format string vulnerability when the license module output the log information. An authenticated local attacker could exploit this vulnerability to cause a denial of service.


The load_debug_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via an ELF file that lacks section headers.


An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode.


Huawei

MAX

PRESENCE

have

a

denial

of

service

vulnerability

in

the

specific

module.

An

authenticated

local

attacker

may

craft

a

specific

XML

file

to

the

affected

products.

Due

to

improper

handling

of

input

successful

exploit

will

cause

some

service

abnormal.


MikroTik RouterBOARD v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a denial of service by connecting to TCP port 53 and sending data that begins with many '\\0' characters possibly related to DNS.


In Tidy 5.7.0 the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service (Segmentation Fault) because the currentNode variable in the \children of the head\ processing feature is modified in the loop without validating the new value.


In TG Soft Vir.IT eXplorer Lite 8.5.65 the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x82730068.


In TG Soft Vir.IT eXplorer Lite 8.5.65 the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273E080.


Conarc iChannel allows remote attackers to obtain sensitive information modify the configuration or cause a denial of service (by deleting the configuration) via a wc.dll?wwMaint~EditConfig request (which reaches an older version of a West Wind Web Connection HTTP service).


Indeo Otter through 1.7.4 mishandles a \</script>\ substring in an initial DP payload which allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact as demonstrated by the Plan Editor.


An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place because of an incorrect assertion related to M2P.


ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (CPU consumption) via a flood of IP packets with a TTL of 1.


contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45 when both the nops module and the memberof overlay are enabled attempts to free a buffer that was allocated on the stack which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.


In TG Soft Vir.IT eXplorer Lite 8.5.65 the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x82736068 a different vulnerability than CVE-2017-17475.


pptreader.dll in Kingsoft WPS Office 10.1.0.6930 allows remote attackers to cause a denial of service via a crafted PPT file aka CNVD-2017-35482.


In TG Soft Vir.IT eXplorer Lite 8.5.42 the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8273A0A0 a different vulnerability than CVE-2017-17800.


PEM

module

of

Huawei

IPS

Module

NGFW

Module

Secospace

Secospace

Secospace

ViewPoint

has

an

Out-of-Bounds

memory

access

vulnerability

due

to

insufficient

verification.

An

authenticated

local

attacker

can

make

processing

crash

by

a

malicious

certificate.

The

attacker

can

exploit

this

vulnerability

to

cause

a

denial

of

service.


The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.


Huawei VP9660 V500R002C10 has a null pointer reference vulnerability in license module due to insufficient verification. An authenticated local attacker could place a malicious license file into system which cause memory null pointer accessing and related processing crash. The attacker can exploit this vulnerability to cause a denial of service.


The Mem_File_Reader::read_avail function in Data_Reader.cpp in the Game_Music_Emu library (aka game-music-emu) 0.6.1 does not ensure a non-negative size which allows remote attackers to cause a denial of service (application crash) via a crafted file.


The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.


** DISPUTED ** p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file related to canPack and unpack functions. NOTE: the vendor has stated \there is no security implication whatsoever.\


drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device.


The coff_slurp_line_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted PE file.


The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.


in

the

Linux

kernel

through

allows

local

users

to

cause

a

denial

of

service

(BUG

and

system

crash)

or

possibly

have

unspecified

other

impact

via

a

crafted

USB

device.


Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0 an attacker that forces an error can crash the server causing a denial of service.


Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out.


The pe_bfd_read_buildid function in peicode.h in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29.1 does not validate size and offset values in the data dictionary which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file.


The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods.


An exploitable denial of service vulnerability exists in Insteon Hub running firmware version 1012. Leftover demo functionality allows for arbitrarily rebooting the device without authentication. An attacker can send a UDP packet to trigger this vulnerability.


The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.


slug is a module to slugify strings even if they contain unicode. slug is vulnerable to regular expression denial of service is specially crafted untrusted input is passed as input. About 50k characters can block the event loop for 2 seconds.


sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device.


In the yajl-ruby gem 1.3.0 for Ruby when a crafted JSON file is supplied to Yajl::Parser.new.parse the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.


The aout_get_external_symbols function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) or possibly have unspecified other impact via a crafted ELF file.


The ReadWPGImage function in coders/wpg.c in GraphicsMagick 1.3.26 does not properly validate colormapped images which allows remote attackers to cause a denial of service (ImportIndexQuantumType invalid write and application crash) or possibly have unspecified other impact via a malformed WPG image.


The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.


The condor_schedd component in HTCondor before 8.6.8 and 8.7.x before 8.7.5 allows remote authenticated users to cause a denial of service (daemon crash) by leveraging use of GSI and VOMS extensions.


method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially crafted input is passed in to be parsed via the X-HTTP-Method-Override header.


The mime module < 1.4.1 2.0.1 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.


The content module is a module to parse HTTP Content-* headers. It is used by the hapijs framework to provide this functionality. The module is vulnerable to regular expression denial of service when passed a specifically crafted Content-Type or Content-Disposition header.


** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities which allow attackers to cause a denial of service (memory consumption) as demonstrated by tif_open.c tif_lzw.c and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.


The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.


Winamp Pro 5.66 Build 3512 allows remote attackers to cause a denial of service via a crafted WAV WMV AU ASF AIFF or AIF file.


Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.


The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device related to disconnection and failed setup.


The DrawImage function in magick/render.c in GraphicsMagick 1.3.26 does not properly look for pop keywords that are associated with push keywords which allows remote attackers to cause a denial of service (negative strncpy and application crash) or possibly have unspecified other impact via a crafted file.


The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.


The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.


The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.


drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner).


The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content related to the bdat_getc function.


The \stub_recv_cmd_submit()\ function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8 4.9.71 and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service (arbitrary memory allocation) via a specially crafted USB over IP packet.


The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.


In SWFTools 0.9.2 the png_load function in lib/png.c does not check the return value of a realloc call which allows remote attackers to cause a denial of service (invalid write and application crash) or possibly have unspecified other impact via vectors involving an IDAT tag in a crafted PNG file.


The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette which allows remote attackers to cause a denial of service (use of uninitialized data or invalid memory allocation) or possibly have unspecified other impact via a malformed WPG file.


The dvb_frontend_free function in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device. NOTE: the function was later renamed __dvb_frontend_free.


The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device.


The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file.


sound/core/seq_device.c in the Linux kernel before 4.13.4 allows local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device.


The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the server to hang until eventually replying (~300 seconds) with an HTTP 500 error. While the server is hung print jobs over the network are blocked and the web interface is inaccessible. An attacker can continuously send this malformed request to keep the device inaccessible to legitimate traffic.


Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a string and takes unescaped separator values which can be used to create a denial of service attack.


The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue 1k characters can block for around 6 seconds.


The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loop causing a denial of service condition.


In radare2 2.0.1 libr/bin/dwarf.c allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file related to r_bin_dwarf_parse_comp_unit in dwarf.c and sdb_set_internal in shlr/sdb/src/sdb.c.


The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted video file.


libjasper/jp2/jp2_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.


The SAP Message Server HTTP daemon in SAP KERNEL 7.21-7.49 allows remote attackers to cause a denial of service (memory consumption and process crash) via multiple msgserver/group?group= requests with a crafted size of the group parameter aka SAP Security Note 2358972.


Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.


A STUN server in conjunction with a large number of \webkitRTCPeerConnection\ objects can be used to send large STUN packets in a short period of time due to a lack of rate limiting being applied on e10s systems allowing for a denial of service attack. This vulnerability affects Firefox < 51.


Firmware in the Intel Puma 5 6 and 7 Series might experience resource depletion or timeout which allows a network attacker to create a denial of service via crafted network traffic.


The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets as demonstrated by an attack against the kernel-3.10.0 package in CentOS Linux 7. NOTE: third parties have been unable to discern any relationship between the GitHub Engineering finding and the Trigemini.c attack code.


In Apache Batik before 1.9 files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.


The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that \goes behind\ the surrounding tag.


The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors involving the transfer mode register during multi block transfer.


The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving ncdt tags.


Odata Server in SAP Adaptive Server Enterprise (ASE) 16 allows remote attackers to cause a denial of service (process crash) via a series of crafted requests aka SAP Security Note 2330422.


The free_options function in options_manager.c in mp3splt 2.6.2 allows remote attackers to cause a denial of service (invalid free and crash) via a crafted file.


An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's SSH service using a password cracking tool to establish SSH connections quickly. This will trigger an increase in the SSH login timeout (each of the login attempts will occupy a connection slot for a longer time). Once this occurs legitimate login attempts via SSH/telnet will be refused resulting in a denial of service; you must restart the device.


The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors related to control transfer descriptor sequence.


The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted ASF file.


The zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted ZIP file.


EasyCom SQL iPlug allows remote attackers to cause a denial of service via the D$EVAL parameter to the default URI.


Splunk Web in Splunk Enterprise versions 6.5.x before 6.5.2 6.4.x before 6.4.5 6.3.x before 6.3.9 6.2.x before 6.2.13 6.1.x before 6.1.12 6.0.x before 6.0.13 5.0.x before 5.0.17 and Splunk Light versions before 6.5.2 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted GET request aka SPL-130279.


libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_compiler_destroy function.


The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving the current stts index.


Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to a Denial of Service.


The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.


The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.


Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.


The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM parsing.


The vrend_draw_vbo function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors involving vertext_buffer_index.


httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header.


The dec_clnpass function in libjasper/jpc/jpc_t1dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via a crafted image.


Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.


The vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 does not set an errno value upon certain overflow detections which allows local users to cause a denial of service (incorrect pointer dereference and OOPS) via inconsistent size values in a VC4_SUBMIT_CL ioctl call.


The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of service (duplicate freelist entries and system crash) or possibly have unspecified other impact in opportunistic circumstances by leveraging the selection of a large value for a random number.


In Apache FOP before 2.2 files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.


The gst_asf_demux_process_ext_stream_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors related to the number of languages in a video file.


libjasper/include/jasper/jas_math.h in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.


Data corruption vulnerability in firmware in Intel Solid-State Drive Professional PSF104P PSF109P allows local users to cause a denial of service via unspecified vectors.


The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted SMI file as demonstrated by OneNote_Manager.smi.


The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a malformed datetime string.


The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.


The SingleDocParser::HandleNode function in yaml-cpp (aka LibYaml-C++) 0.5.3 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.


The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file.


ownCloud Server before 8.1.11 8.2.x before 8.2.9 9.0.x before 9.0.7 and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (server hang and logfile flooding) via a one bit BMP file.


The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.


Mozilla Network Security Services (NSS) before 3.21.4 3.22.x through 3.28.x before 3.28.4 3.29.x before 3.29.5 and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.


Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb.


Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.


Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file aka an XML Entity Expansion (XEE) attack.


The

PoDoFo::PdfPage::GetInheritedKeyFromObject

function

in

base/PdfVariant.cpp

in

PoDoFo

allows

remote

attackers

to

cause

a

denial

of

service

(infinite

loop)

via

a

crafted

file.


JavaScriptCore in WebKit as distributed in Safari Technology Preview Release 22 allows remote attackers to cause a denial of service (heap-based out-of-bounds write and application crash) or possibly have unspecified other impact via crafted JavaScript code that triggers access to red-zone memory locations related to jit/ThunkGenerators.cpp llint/LowLevelInterpreter32_64.asm and llint/LowLevelInterpreter64.asm.


Input validation error in Intel MinnowBoard 3 Firmware versions prior to 0.65 allow local attacker to cause denial of service via UEFI APIs.


Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_UNREF commands sent without detaching the backing storage beforehand.


The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.


libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.


The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows attackers to cause a denial of service (system crash) via (1) an application that makes crafted system calls or possibly (2) IPv4 traffic with invalid IP options.


The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.


seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file.


Data

corruption

vulnerability

in

firmware

in

Intel

Solid-State

Drive

Consumer

Professional

Embedded

Data

Center

affected

firmware

versions

allows

local

users

to

cause

a

denial

of

service

via

unspecified

vectors.


Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref (2) gst_tag_list_unref and (3) gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags as demonstrated by 02785736.mxf.


The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX.


The TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 57.1 before 57.152 58.1 before 58.142 or 59.1 before 59.172 when running a TLS 1.2 service allows remote attackers to cause a denial of service (network connectivity disruption) via a client hello with a signature_algorithms extension above those defined in RFC 5246 which triggers a full memory dump.


The Linux Kernel 2.6.32 and later are affected by a denial of service by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic.


Denial of Service attack when the switch rejects to receive packets from the controller. Component: This vulnerability affects OpenDaylight odl-l2switch-switch which is the feature responsible for the OpenFlow communication. Version: OpenDaylight versions 3.3 (Lithium-SR3) 3.4 (Lithium-SR4) 4.0 (Beryllium) 4.1 (Beryllium-SR1) 4.2 (Beryllium-SR2) and 4.4 (Beryllium-SR4) are affected by this flaw. Java version is openjdk version 1.8.0_91.


TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature resulting in the ability to disable arbitrary running splits and cause denial of service to clients in the field.


Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service


Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.


Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remote execution of code.


Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and execution of javascript code.


XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks.


ImageMagick 7.0.7-12 Q16 a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c which allows attackers to cause a denial of service.


ImpulseAdventure JPEGsnoop version 1.7.5 is vulnerable to a division by zero in the JFIF decode handling resulting denial of service.


tcmu-runner daemon version 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler resulting in denial of service


The UNIX IPC layer in WebKit including WebKitGTK+ prior to 2.16.3 does not properly validate certain message metadata allowing a compromised secondary process to cause a denial of service (release assertion) of the UI process. This vulnerability does not affect Apple products.


The Snap7 Server version 1.4.1 can be crashed when the ItemCount field of the ReadVar or WriteVar functions of the S7 protocol implementation in Snap7 are provided with unexpected input thus resulting in denial of service attack.


Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.


The tcmu-runner daemon in tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a local denial of service attack