IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM X-Force ID: 220485.


IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0 6.0.2.0 and 3.4.3.2 could allow a remote user to consume resources causing a denial of service due to a resource leak. IBM X-Force ID: 219395.


Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image parsing causes a reboot but image parsing is restarted as soon as the boot process finishes. However this boot loop can be resolved by a field technician. The TIFF file must have an incomplete Image Directory. Affected firmware versions include xx.42.01 and xx.50.61. NOTE: the 2022-01-24 NeoSmart article included \believed to affect all previous and later versions as of the date of this posting\ but a 2022-01-26 vendor statement reports \the latest versions of firmware are not vulnerable to this issue.\


Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that any binary op would trigger `CHECK` failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the `dtype` no longer matches the `dtype` expected by the op. In that case calling the templated binary operator for the binary op would receive corrupted data due to the type confusion involved. If `Tin` and `Tout` don't match the type of data in `out` and `input_*` tensors then `flat<*>` would interpret it wrongly. In most cases this would be a silent failure but we have noticed scenarios where this results in a `CHECK` crash hence a denial of service. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


In Stormshield Network Security (SNS) before 3.7.25 3.8.x through 3.11.x before 3.11.13 4.x before 4.2.10 and 4.3.x before 4.3.5 a flood of connections to the SSLVPN service might lead to saturation of the loopback interface. This could result in the blocking of almost all network traffic making the firewall unreachable. An attacker could exploit this via forged and properly timed traffic to cause a denial of service.


Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch 2.9.0.beta2 in the `beta` branch and 2.9.0.beta2 in the `tests-passed` branch users can trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job trigger an infinite loop which cause memory leaks. This issue is patched in version 2.8.1 of the `stable` branch 2.9.0.beta2 of the `beta` branch and 2.9.0.beta2 of the `tests-passed` branch. As a workaround disable onebox in admin panel completely or specify allow list of domains that will be oneboxed.


Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence denial of service) if called with scalar shapes. If all shapes are scalar then `maxRank` is 0 so we build an empty `SmallVector`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.


Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that assertions in `function.cc` would be falsified and crash the Python interpreter. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that `TensorByteSize` would trigger `CHECK` failures. `TensorShape` constructor throws a `CHECK`-fail if shape is partial or has a number of elements that would overflow the size of an `int`. The `PartialTensorShape` constructor instead does not cause a `CHECK`-abort if the shape is partial which is exactly what this function needs to be able to return `-1`. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. An attacker can trigger denial of service via assertion failure by altering a `SavedModel` on disk such that `AttrDef`s of some operation are duplicated. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Point-to-Point Tunneling Protocol Denial of Service Vulnerability.


Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that Grappler optimizer would attempt to build a tensor using a reference `dtype`. This would result in a crash due to a `CHECK`-fail in the `Tensor` constructor as reference types are not allowed. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `SafeToRemoveIdentity` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf a TensorFlow process can encounter cases where a `CHECK` assertion is invalidated based on user controlled arguments if the tensors have an invalid `dtype` and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow processes. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. Multiple operations in TensorFlow can be used to trigger a denial of service via `CHECK`-fails (i.e. assertion failures). This is similar to TFSA-2021-198 and has similar fixes. We have patched the reported issues in multiple GitHub commits. It is possible that other similar instances exist in TensorFlow we will issue fixes as these are discovered. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `IsSimplifiableReshape` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Tensorflow is an Open Source Machine Learning Framework. When decoding a resource handle tensor from protobuf a TensorFlow process can encounter cases where a `CHECK` assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Pexip Infinity before 27.0 has improper WebRTC input validation. An unauthenticated remote attacker can use excessive resources temporarily causing denial of service.


decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment leading to denial of service.


Microsoft Teams Denial of Service Vulnerability.


client_golang is the instrumentation library for Go applications in Prometheus and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1 HTTP server is susceptible to a Denial of Service through unbounded cardinality and potential memory exhaustion when handling requests with non-standard HTTP methods. In order to be affected an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall configured to only allow a limited set of methods.


An out of bounds read vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.7.7. A specially-crafted PE file can trigger this vulnerability to cause denial of service and termination of malware scan. An attacker can provide a malicious file to trigger this vulnerability.


OnionShare is an open source tool that lets you securely and anonymously share files host websites and chat with friends using the Tor network. Affected versions of the desktop application were found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing. Roughly 20 bytes lead to 2GB memory consumption and this can be triggered multiple times. To be abused this vulnerability requires rendering in the history tab so some user interaction is required. An adversary with knowledge of the Onion service address in public mode or with authentication in private mode can perform a Denial of Service attack which quickly results in out-of-memory for the server. This requires the desktop application with rendered history therefore the impact is only elevated. This issue has been patched in version 2.5.


Windows IKE Extension Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-21843 CVE-2022-21848 CVE-2022-21889 CVE-2022-21890.


Windows IKE Extension Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-21848 CVE-2022-21883 CVE-2022-21889 CVE-2022-21890.


Envoy is an open source edge and service proxy designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.


Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ConcatV2` can be used to trigger a denial of service attack via a segfault caused by a type confusion. The `axis` argument is translated into `concat_dim` in the `ConcatShapeHelper` helper function. Then a value for `min_rank` is computed based on `concat_dim`. This is then used to validate that the `values` tensor has at least the required rank. However `WithRankAtLeast` receives the lower bound as a 64-bits value and then compares it against the maximum 32-bits integer value that could be represented. Due to the fact that `min_rank` is a 32-bits value and the value of `axis` the `rank` argument is a negative value so the error check is bypassed. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability.


NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory which can lead to denial of service.


Access of uninitialized pointer in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable denial of service via local access.


Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9 vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE one must use next start or a custom server and the built-in i18n support. Deployments on Vercel along with similar environments where invalid requests are filtered before reaching Next.js are not affected. A patch has been released `next@12.0.9` that mitigates this issue. As a workaround one may ensure `/${locale}/_next/` is blocked from reaching the Next.js instance until it becomes feasible to upgrade.


NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko) where a user in the guest OS can cause a GPU interrupt storm on the hypervisor host leading to a denial of service.


Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.


Tensorflow is an Open Source Machine Learning Framework. The implementation of `*Bincount` operations allows malicious users to cause denial of service by passing in arguments which would trigger a `CHECK`-fail. There are several conditions that the input arguments must satisfy. Some are not caught during shape inference and others are not caught during kernel implementation. This results in `CHECK` failures later when the output tensors get allocated. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Windows IKE Extension Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-21843 CVE-2022-21848 CVE-2022-21883 CVE-2022-21890.


DirectX Graphics Kernel File Denial of Service Vulnerability.


Windows IKE Extension Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-21843 CVE-2022-21883 CVE-2022-21889 CVE-2022-21890.


A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A specially-crafted series of network requests can lead to denial of service. An attacker can send a sequence of malformed iec61850 messages to trigger this vulnerability.


Windows IKE Extension Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-21843 CVE-2022-21848 CVE-2022-21883 CVE-2022-21889.


NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory which can lead to denial of service.


Tensorflow is an Open Source Machine Learning Framework. The implementation of `ThreadPoolHandle` can be used to trigger a denial of service attack by allocating too much memory. This is because the `num_threads` argument is only checked to not be negative but there is no upper bound on its value. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Windows Media Center Update Denial of Service Vulnerability.


.NET Framework Denial of Service Vulnerability.


In Bluetooth there is a possible application crash due to bluetooth does not properly handle the reception of multiple LMP_host_connection_req. This could lead to remote denial of service of bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06198513; Issue ID: ALPS06198513.


On April 20 2022 the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in the TIFF file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability see the ClamAV blog. This advisory will be updated as additional information becomes available.


On April 20 2022 the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability see the ClamAV blog. This advisory will be updated as additional information becomes available.


On April 20 2022 the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability see the ClamAV blog. This advisory will be updated as additional information becomes available.


In Bluetooth there is a possible link disconnection due to bluetooth does not properly handle a connection attempt from a host with the same BD address as the currently connected BT host. This could lead to remote denial of service of bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06198578; Issue ID: ALPS06198578.


On May 4 2022 the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4 0.103.5 0.104.1 and 0.104.2 could allow an authenticated local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability see the ClamAV blog.


In ims service there is a possible unexpected application behavior due to incorrect privilege assignment. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219127; Issue ID: ALPS06219127.


In Bluetooth there is a possible application crash due to bluetooth flooding a device with LMP_AU_rand packet. This could lead to remote denial of service of bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06198608; Issue ID: ALPS06198608.


A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that may result in an invalid pointer read. An attacker could exploit this vulnerability by sending a crafted OOXML file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash resulting in a denial of service condition.


The ASN.1 parser (pluto/asn1.c libstrongswan/asn1/asn1.c libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10 4.2 before 4.2.16 and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs) (2) a crafted UTCTIME string or (3) a crafted GENERALIZEDTIME string.


The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service (application crash) by specifying (1) an empty string or (2) a non-numeric string when selecting a forum related to the fmessagelist function.


The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34 1.4.x before 1.4.26.1 1.6.0.x before 1.6.0.12 and 1.6.1.x before 1.6.1.4; Asterisk Business Edition A.x.x B.x.x before B.2.5.9 C.2.x before C.2.4.1 and C.3.x before C.3.1; and Asterisk Appliance s800i 1.2.x before 1.3.0.3 does not use a maximum width when invoking sscanf style functions which allows remote attackers to cause a denial of service (stack memory consumption) via SIP packets containing large sequences of ASCII decimal characters as demonstrated via vectors related to (1) the CSeq value in a SIP header (2) large Content-Length value and (3) SDP.


Microsoft Internet Explorer 5 through 8 allows remote attackers to cause a denial of service (memory consumption and application crash) via a large integer value for the length property of a Select object a related issue to CVE-2009-1692.


kmxIds.sys before 7.3.1.18 in CA Host-Based Intrusion Prevention System (HIPS) 8.1 allows remote attackers to cause a denial of service (system crash) via a malformed packet.


The Over-the-Air Provisioning (OTAP) functionality on Cisco Aironet Lightweight Access Point 1100 and 1200 devices does not properly implement access-point association which allows remote attackers to spoof a controller and cause a denial of service (service outage) via crafted remote radio management (RRM) packets aka \SkyJack\ or Bug ID CSCtb56664.


The DS\\NDSD component in Novell eDirectory 8.8 before SP5 allows remote attackers to cause a denial of service (ndsd core dump) via an LDAP request containing multiple . (dot) wildcard characters in the Relative Distinguished Name (RDN).


The Web Services functionality in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 in certain circumstances involving the ibm-webservicesclient-bind.xmi file and custom password encryption uses weak password obfuscation which allows local users to cause a denial of service (deployment failure) via unspecified vectors.


Unspecified vulnerability in the udp subsystem in the kernel in Sun Solaris 10 and OpenSolaris snv_90 through snv_108 when Solaris Trusted Extensions is enabled allows remote attackers to cause a denial of service (panic) via unspecified vectors involving the crgetlabel function related to a \TX panic.\ NOTE: this issue exists because of a regression in earlier kernel patches.


Memory leak in the Ultra-SPARC T2 crypto provider device driver (aka n2cp) in Sun Solaris 10 and OpenSolaris snv_54 through snv_112 allows context-dependent attackers to cause a denial of service (memory consumption) via unspecified vectors related to a large keylen value.


Cisco Unified Communications Manager (aka CUCM formerly CallManager) 4.x 5.x before 5.1(3g) 6.x before 6.1(4) 7.0 before 7.0(2a)su1 and 7.1 before 7.1(2) allows remote attackers to cause a denial of service (file-descriptor exhaustion and SCCP outage) via a flood of TCP packets aka Bug ID CSCsx32236.


Apple Safari 3.2.3 does not properly implement the file: protocol handler which allows remote attackers to read arbitrary files or cause a denial of service (launch of multiple Windows Explorer instances) via vectors involving an unspecified HTML tag possibly a related issue to CVE-2009-1703.


The Research In Motion (RIM) BlackBerry 8800 allows remote attackers to cause a denial of service (memory consumption and browser crash) via a large integer value for the length property of a Select object a related issue to CVE-2009-1692.


neon before 0.28.6 when expat is used does not properly detect recursion during entity expansion which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references a similar issue to CVE-2003-1564.


The kernel in Microsoft Windows Server 2003 SP2 does not properly handle unspecified exceptions when an error condition occurs which allows local users to cause a denial of service (reboot) via a crafted application aka \Windows Kernel Exception Handler Vulnerability.\


Unspecified vulnerability in ia32el (aka the IA 32 emulation functionality) before 7042_7022-0.4.2 in SUSE Linux Enterprise (SLE) 10 SP2 on Itanium IA64 machines allows local users to cause a denial of service (system crash) via a 32-bit x86 application.


SystemTap 1.0 when the --unprivileged option is used does not properly restrict certain data sizes which allows local users to (1) cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow (2) cause a denial of service via crafted DWARF expressions that trigger a kernel stack frame overflow or (3) cause a denial of service (infinite loop) via vectors that trigger creation of large unwind tables related to Common Information Entry (CIE) and Call Frame Instruction (CFI) records.


Microsoft Windows Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets which allows remote attackers to cause a denial of service (infinite loop and system hang) via a crafted packet to the Server service aka \SMBv2 Infinite Loop Vulnerability.\


Opera possibly 9.64 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object a related issue to CVE-2009-1692.


The Secure Gateway service in Citrix Secure Gateway 3.1 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an unspecified request.


Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request. NOTE: some of these details are obtained from third party information.


The ICMPv6 implementation on the Apple Time Capsule AirPort Extreme Base Station and AirPort Express Base Station with firmware before 7.5.2 does not limit the rate of (1) Router Advertisement and (2) Neighbor Discovery packets which allows remote attackers to cause a denial of service (resource consumption and device restart) by sending many packets.


Unspecified vulnerability in the com.android.phone process in Android 1.0 1.1 and 1.5 allows remote attackers to cause a denial of service (network disconnection) via a crafted SMS message as demonstrated by Collin Mulliner and Charlie Miller at Black Hat USA 2009.


Apple Mac OS X 10.5 before 10.5.8 does not properly share file descriptors over local sockets which allows local users to cause a denial of service (system crash) by placing file descriptors in messages sent to a socket that has no receiver related to a \synchronization issue.\


Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of service (application crash) via a certain DIV element in conjunction with SCRIPT elements that have empty contents and no reference to a valid external script location.


in.lpd in the print service in Sun Solaris 8 and 9 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors that trigger a \fork()/exec() bomb.\


Unspecified vulnerability in the TCP/IP networking stack in Sun Solaris 10 and OpenSolaris snv_01 through snv_82 and snv_111 through snv_117 when a Cassini GigaSwift Ethernet Adapter (aka CE) interface is used allows remote attackers to cause a denial of service (panic) via vectors involving jumbo frames.


Cisco Unified Communications Manager (aka CUCM formerly CallManager) 4.x 5.x before 5.1(3g) 6.x before 6.1(4) 7.0 before 7.0(2) and 7.1 before 7.1(2); and Cisco Unified Presence 1.x 6.x before 6.0(6) and 7.x before 7.0(4); allows remote attackers to cause a denial of service (TCP services outage) via a large number of TCP connections related to \tracking of network connections \ aka Bug IDs CSCsq22534 and CSCsw52371.


The TimesTenD process in Cisco Unified Presence 1.x 6.x before 6.0(6) and 7.x before 7.0(4) allows remote attackers to cause a denial of service (process crash) via a large number of TCP connections to ports 16200 and 22794 aka Bug ID CSCsy17662.


Stack consumption vulnerability in libxml2 2.5.10 2.6.16 2.6.26 2.6.27 and 2.6.32 and libxml 1.8.17 allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD related to a function recursion as demonstrated by the Codenomicon XML fuzzing framework.


The web browser on the Sony PLAYSTATION 3 (PS3) allows remote attackers to cause a denial of service (memory consumption and console hang) via a large integer value for the length property of a Select object a related issue to CVE-2009-1692.


Tor before 0.2.0.35 allows remote attackers to cause a denial of service (application crash) via a malformed router descriptor.


Cisco IOS XR 3.8.1 and earlier allows remote authenticated users to cause a denial of service (process crash) via vectors involving a BGP UPDATE message with many AS numbers prepended to the AS path.


Unspecified vulnerability in an ActiveX control in Adobe Reader and Acrobat 7.x before 7.1.4 8.x before 8.1.7 and 9.x before 9.2 on Windows allows remote attackers to cause a denial of service via unknown vectors.


Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 does not properly enforce \buffer limits and related bound checks \ which allows remote attackers to cause a denial of service via (1) an incomplete request or (2) a request with a large header size related to (a) HttpMsg.cc and (b) client_side.cc.


The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.


Cisco Unified Communications Manager (aka CUCM formerly CallManager) 5.x before 5.1(3g) 6.x before 6.1(4) 7.0.x before 7.0(2a)su1 and 7.1.x before 7.1(2) allows remote attackers to cause a denial of service (service restart) via malformed SIP messages aka Bug ID CSCsz95423.


KDE Konqueror allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object a related issue to CVE-2009-1692.


XMLScanner.java in Apache Xerces2 Java as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20 and in other products allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input as demonstrated by the Codenomicon XML fuzzing framework.


The exif_read_data function in the Exif module in PHP before 5.2.10 allows remote attackers to cause a denial of service (crash) via a malformed JPEG image with invalid offset fields a different issue than CVE-2005-3353.


Multiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace and is processed by the (1) Bluetooth L2CAP (2) RADIUS or (3) MIOP dissector. NOTE: it was later reported that the RADIUS issue also affects 0.10.13 through 1.0.9.


avp.exe in Kaspersky Internet Security 9.0.0.459 and Anti-Virus 9.0.0.463 allows remote attackers to cause a denial of service (CPU consumption and network connectivity loss) via an HTTP URL request that contains a large number of dot \.\ characters.


rmserver in RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allows remote attackers to cause a denial of service (daemon exit) via multiple RTSP SET_PARAMETER requests with empty DataConvertBuffer headers.


The DS\\NDSD component in Novell eDirectory 8.8 before SP5 allows remote attackers to cause a denial of service (crash) via a malformed bind LDAP packet.


Google Chrome 2.x through 2.0.172 allows remote attackers to cause a denial of service (application crash) via a long Unicode string argument to the write method a related issue to CVE-2009-2479.


Unspecified vulnerability in db2jds in IBM DB2 8.1 before FP18 allows remote attackers to cause a denial of service (service crash) via \malicious packets.\


The com.android.phone process in Android 1.5 CRBxx allows remote attackers to cause a denial of service (application restart and network disconnection) via an SMS message containing a malformed WAP Push message that triggers an ArrayIndexOutOfBoundsException exception possibly a related issue to CVE-2009-2656.


The IATA (ata) driver in FreeBSD 6.0 and 8.0 when read access to /dev is available allows local users to cause a denial of service (kernel panic) via a certain IOCTL request with a large count which triggers a malloc call with a large value.


Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a long Unicode string argument to the write method a related issue to CVE-2009-2479. NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.


The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35 1.4.x before 1.4.26.2 1.6.0.x before 1.6.0.15 and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10 C.2.x before C.2.4.3 and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges a related issue to CVE-2008-3263.


The (1) sendfile and (2) sendfilev functions in Sun Solaris 8 through 10 and OpenSolaris before snv_110 allow local users to cause a denial of service (panic) via vectors related to vnode function calls.


Unspecified vulnerability in wsadmin in the System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 allows remote attackers to bypass intended Java Management Extensions (JMX) Management Beans (aka MBeans) access restrictions and cause a denial of service (daemon stop) via unknown vectors.


Multiple use-after-free vulnerabilities in libxml2 2.5.10 2.6.16 2.6.26 2.6.27 and 2.6.32 and libxml 1.8.17 allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file as demonstrated by the Codenomicon XML fuzzing framework.


The Aigo P8860 allows remote attackers to cause a denial of service (memory consumption and browser hang) via a large integer value for the length property of a Select object a related issue to CVE-2009-1692.


Cisco Unified Communications Manager (aka CUCM formerly CallManager) 4.x 5.x before 5.1(3g) 6.x before 6.1(4) 7.0 before 7.0(2a)su1 and 7.1 before 7.1(2a)su1 allows remote attackers to cause a denial of service (file-descriptor exhaustion and SIP outage) via a flood of TCP packets aka Bug ID CSCsx23689.


Google Chrome 1.0.154.65 1.0.154.48 and earlier allows remote attackers to (1) cause a denial of service (application hang) via vectors involving a chromehtml: URI value for the document.location property or (2) cause a denial of service (application hang and CPU consumption) via vectors involving a series of function calls that set a chromehtml: URI value for the document.location property.


Cisco IOS 12.0 through 12.4 when IP-based tunnels and the Cisco Express Forwarding feature are enabled allows remote attackers to cause a denial of service (device reload) via a malformed packet that is not properly handled during switching from one tunnel to a second tunnel aka Bug IDs CSCsh97579 and CSCsq31776.


mshtml.dll in Microsoft Internet Explorer 7 and 8 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash) by calling the JavaScript findText method with a crafted Unicode string in the first argument and only one additional argument as demonstrated by a second argument of -1.


The ARD-9808 DVR card security camera allows remote attackers to cause a denial of service via a long URI composed of //.\\ (slash slash dot backslash) sequences.


Microsoft Internet Explorer 6 through 6.0.2900.2180 and 7 through 7.0.6000.16473 allows remote attackers to cause a denial of service (CPU consumption) via an XML document composed of a long series of start-tags with no corresponding end-tags a related issue to CVE-2009-1232.


The kernel in Sun Solaris 8 9 and 10 and OpenSolaris before snv_103 does not properly handle interaction between the filesystem and virtual-memory implementations which allows local users to cause a denial of service (deadlock and system halt) via vectors involving mmap and write operations on the same file.


The Sun Java System (SJS) Access Manager Policy Agent module 2.2 for SJS Web Proxy Server 4.0 allows remote attackers to cause a denial of service (daemon crash) via a GET request.


The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9 as used in the Apache HTTP Server before 2.2.14 and other products does not properly handle errors which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests related to the prefork and event MPMs.


Mozilla Firefox before 2.0.0.19 and 3.x before 3.0.5 SeaMonkey and Thunderbird allow remote attackers to cause a denial of service (memory consumption and application crash) via a large integer value for the length property of a Select object a related issue to CVE-2009-1692.


Google Chrome 1.0.154.48 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka location.hash) a related issue to CVE-2008-5715.


Mozilla Firefox 3.0.10 and earlier on Linux allows remote attackers to cause a denial of service (application crash) via a URI for a large GIF image in the BACKGROUND attribute of a BODY element.


Event Monitor in Apple Mac OS X 10.5.8 does not properly handle crafted authentication data sent to an SSH daemon which allows remote attackers to cause a denial of service via vectors involving processing of XML log documents by other services related to a \log injection\ issue.


smbd in Samba 3.0 before 3.0.37 3.2 before 3.2.15 3.3 before 3.3.8 and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet.


The LAN game feature in Carom3D 5.06 allows remote authenticated users to cause a denial of service (application hang) via a crafted HTTP request to TCP port 28012.


Multiple memory leaks in the (1) IP and (2) IPv6 multicast implementation in the kernel in Sun Solaris 10 and OpenSolaris snv_67 through snv_93 allow local users to cause a denial of service (memory consumption) via vectors related to the association of (a) DL_ENABMULTI_REQ and (b) DL_DISABMULTI_REQ messages with ARP messages.


Unspecified vulnerability in the utaudiod daemon in Sun Ray Server Software (SRSS) 4.0 when Solaris Trusted Extensions is enabled allows local users to cause a denial of service (audio outage) or possibly gain privileges via unknown vectors related to \resource leaks.\


Unspecified vulnerability in the Remote Management Interface (RMI) for MSL Tape Libraries and 1/8 G2 Tape Autoloaders in HP StorageWorks 1/8 G2 Tape Autoloader firmware 2.30 and earlier MSL2024 Tape Library firmware 4.20 and earlier MSL4048 Tape Library firmware 6.50 and earlier and MSL8096 Tape Library firmware 8.90 and earlier allows remote attackers to cause a denial of service via unknown vectors.


Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) \missing or mismatched protocol identifier \ (2) missing or negative status value \ (3) \missing version \ or (4) \missing or invalid status number \ related to (a) HttpMsg.cc and (b) HttpReply.cc.


Unspecified vulnerability in idmap in Sun OpenSolaris snv_88 through snv_110 when a CIFS server is enabled allows local users to cause a denial of service (idpmapd daemon crash and idmapd outage) via unknown vectors.


Unspecified vulnerability in the Solaris Auditing subsystem in Sun Solaris 9 and 10 and OpenSolaris before snv_121 when extended file attributes are used allows local users to cause a denial of service (panic) via vectors related to fad_aupath structure members.


Sun VirtualBox 2.2 through 3.0.2 r49928 allows guest OS users to cause a denial of service (Linux host OS reboot) via a sysenter instruction.


RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allow remote attackers to cause a denial of service (daemon crash) via an RTSP SETUP request that (1) specifies the / URI or (2) lacks a / character in the URI.


Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31 when the appletalk and ipddp modules are loaded but the ipddp\N\ device is not found allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams.


Unspecified vulnerability in Cisco IOS 12.2XNA 12.2XNB 12.2XNC 12.2XND 12.4T 12.4XZ and 12.4YA when Zone-Based Policy Firewall SIP Inspection is enabled allows remote attackers to cause a denial of service (device reload) via a crafted SIP transit packet aka Bug ID CSCsr18691.


Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU consumption and application hang) via JavaScript code with a long string value for the hash property (aka location.hash) a related issue to CVE-2008-5715.


The Cisco Video Surveillance Stream Manager firmware before 5.3 as used on Cisco Video Surveillance Services Platforms and Video Surveillance Integrated Services Platforms allows remote attackers to cause a denial of service (reboot) via a malformed payload in a UDP packet to port 37000 related to the xvcrman process aka Bug ID CSCsj47924.


git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments.


Unspecified

vulnerability

in

the

javax.swing.plaf.synth.SynthContext.isSubregion

method

in

the

Swing

implementation

in

Sun

Java

SE

before

Update

allows

context-dependent

attackers

to

cause

a

denial

of

service

(NullPointerException

in

the

Jemmy

library)

via

unknown

vectors.


The Axesstel MV 410R allows remote attackers to cause a denial of service via a flood of SYN packets a related issue to CVE-1999-0116.


The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635 3.0 before 3.0.3-11636 and 3.1 before 3.1.1-11637 a module for the Apache HTTP Server allows remote attackers to cause a denial of service (memory consumption) via an HTTP request with a large Content-Length value but no POST data.


Cisco IOS 12.2 through 12.4 and 15.0 through 15.1 Cisco IOS XE 2.5.x and 2.6.x before 2.6.1 and Cisco Unified Communications Manager (aka CUCM formerly CallManager) 4.x 5.x before 5.1(3g) 6.x before 6.1(4) and 7.x before 7.1(2) allow remote attackers to cause a denial of service (device reload or voice-services outage) via a malformed SIP INVITE message that triggers an improper call to the sipSafeStrlen function aka Bug IDs CSCsz40392 and CSCsz43987.


Unspecified vulnerability in bootpd in HP HP-UX B.11.11 B.11.23 and B.11.31 allows remote attackers to cause a denial of service via unknown attack vectors.


Cisco IOS 12.0(32)S12 through 12.0(32)S13 and 12.0(33)S3 through 12.0(33)S4 12.0(32)SY8 through 12.0(32)SY9 12.2(33)SXI1 through 12.2(33)SXI2 12.2XNC before 12.2(33)XNC2 12.2XND before 12.2(33)XND1 and 12.4(24)T1; and IOS XE 2.3 through 2.3.1t and 2.4 through 2.4.0; when RFC4893 BGP routing is enabled allows remote attackers to cause a denial of service (device reload) by using an RFC4271 peer to send a malformed update aka Bug ID CSCta33973.


The asn1_length function in strongSwan 2.8 before 2.8.11 4.2 before 4.2.17 and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs) which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.


cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to cause a denial of service (configuration reset) via a RESTORE=RESTORE query string.


The Java Web Start implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException) via a crafted .jnlp file as demonstrated by the jnlp_file/appletDesc/index.html#misc test in the Technology Compatibility Kit (TCK) for the Java Network Launching Protocol (JNLP).


The Nokia N95 running Symbian OS 9.2 N82 and N810 Internet Tablet allow remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object a related issue to CVE-2009-1692.


Netscape 6 and 8 allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object a related issue to CVE-2009-1692.


Mozilla Firefox 3.5.2 on Windows XP in some situations possibly involving an incompletely configured protocol handler does not properly implement setting the document.location property to a value specifying a protocol associated with an external application which allows remote attackers to cause a denial of service (memory consumption) via vectors involving a series of function calls that set this property as demonstrated by (1) the chromehtml: protocol and (2) the aim: protocol.


Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute as demonstrated in the wild on 17 August 2009.


Unspecified vulnerability in IBM Tivoli Directory Server (TDS) 6.0 on Linux allows remote attackers to cause a denial of service via unknown vectors as demonstrated by a certain module in VulnDisco Pack Professional 8.11. NOTE: as of 20090903 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22 JDK and JRE 6 before Update 17 SDK and JRE 1.3.x before 1.3.1_27 and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted DER encoded data which is not properly decoded by the ASN.1 DER input stream parser aka Bug Id 6864911.


Apple Safari on iPhone OS 3.0.1 allows remote attackers to cause a denial of service (application crash) via a long tel: URL in the SRC attribute of an IFRAME element.


Rhino Software Serv-U 7.0.0.1 through 8.2.0.3 allows remote attackers to cause a denial of service (server crash) via unspecified vectors related to the \SITE SET TRANSFERPROGRESS ON\ FTP command.


Unspecified vulnerability in Code-Crafters Ability Mail Server before 2.70 allows remote attackers to cause a denial of service (daemon crash) via an IMAP4 FETCH command.


xscreensaver (aka Gnome-XScreenSaver) in Sun Solaris 10 and OpenSolaris snv_109 through snv_122 does not properly handle Trusted Extensions which allows local users to cause a denial of service (CPU consumption and console hang) by locking the screen related to a regression in certain Solaris and OpenSolaris patches.


Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.


WebKit before r50173 as used in Google Chrome before 3.0.195.32 allows remote attackers to cause a denial of service (CPU consumption) via a web page that calls the JavaScript setInterval method which triggers an incompatibility between the WTF::currentTime and base::Time functions.


The kvm_emulate_hypercall function in arch/x86/kvm/x86.c in KVM in the Linux kernel 2.6.25-rc1 and other versions before 2.6.31 when running on x86 systems does not prevent access to MMU hypercalls from ring 0 which allows local guest OS users to cause a denial of service (guest kernel crash) and read or write guest kernel memory via unspecified \random addresses.\


SolarWinds TFTP Server 9.2.0.111 and earlier allows remote attackers to cause a denial of service (service stop) via a crafted Option Acknowledgement (OACK) request. NOTE: some of these details are obtained from third party information.


MP3 Collector 2.3 allows remote attackers to cause a denial of service (application crash) via a long URL in a .m3u playlist file.


Polipo 1.0.4 and possibly other versions allows remote attackers to cause a denial of service (crash) via a request with a Cache-Control header that lacks a value for the max-age field which triggers a segmentation fault in the httpParseHeaders function in http_parse.c and possibly other unspecified vectors.


Memory leak in Solaris TCP sockets in Sun OpenSolaris snv_106 through snv_126 allows local users to cause a denial of service (kernel memory consumption) via unspecified vectors involving tcp_sendmsg processing \ancillary data.\


The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1 when running on certain Windows operating systems allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) \e\ or (2) \er\ string in the second argument (aka mode) possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.


The NDSD process in Novell eDirectory 8.7.3 before 8.7.3.10 ftf2 and eDirectory 8.8 before 8.8.5 ftf1 does not properly handle certain LDAP search requests which allows remote attackers to cause a denial of service (application hang) via a search request with a NULL BaseDN value.


The msn_slp_process_msg function in libpurple/protocols/msn/slpcall.c in the MSN protocol plugin in libpurple 2.6.0 and 2.6.1 as used in Pidgin before 2.6.2 allows remote attackers to cause a denial of service (application crash) via a handwritten (aka Ink) message related to an uninitialized variable and the incorrect \UTF16-LE\ charset name.


Multiple unspecified vulnerabilities on the Rockwell Automation AB Micrologix 1100 and 1400 controllers allow remote attackers to obtain privileged access or cause a denial of service (halt) via unknown vectors.


The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference which triggers generation of an invalid UTF-8 character.


The rad_decode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service (radiusd crash) via zero-length Tunnel-Password attributes as demonstrated by a certain module in VulnDisco Pack Professional 7.6 through 8.11. NOTE: this is a regression error related to CVE-2003-0967.


An unspecified function in the Dalvik API in Android 1.5 and earlier allows remote attackers to cause a denial of service (system process restart) via a crafted application possibly a related issue to CVE-2009-2656.


JetAudio 7.5.3 COWON Media Center allows remote attackers to cause a denial of service (memory consumption and application crash) via a long string at the end of a .wav file.


Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU consumption and server hang) via a long title parameter in conjunction with a charset parameter composed of many comma-separated \UTF-8\ substrings related to the mb_convert_encoding function in PHP.


npvmgr.exe in BakBone NetVault Backup 8.22 Build 29 allows remote attackers to cause a denial of service (daemon crash) via a packet to (1) TCP or (2) UDP port 20031 with a large value in an unspecified size field which is not properly handled in a malloc operation. NOTE: some of these details are obtained from third party information.


gpg2.exe in Gpg4win 2.0.1 as used in KDE Kleopatra 2.0.11 allows remote attackers to cause a denial of service (application crash) via a long certificate signature.


The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22 allows remote attackers to cause a denial of service (IOMMU space exhaustion and system crash) by using jumbo frames for a large amount of network traffic as demonstrated by a flood ping.


LSASS.exe in the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 allows remote authenticated users to cause a denial of service (CPU consumption) via a malformed ISAKMP request over IPsec aka \Local Security Authority Subsystem Service Resource Exhaustion Vulnerability.\


The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a custom smiley which allows remote attackers to cause a denial of service (application crash) via XHTML-IM content with cid: images.


Multiple memory leaks in the IP module in the kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_109 allow local users to cause a denial of service (memory consumption) via vectors related to (1) M_DATA (2) M_PROTO (3) M_PCPROTO and (4) M_SIG STREAMS messages.


Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large invalid codepoint which is not properly handled during a regular-expression match.


ntp_request.c in ntpd in NTP before 4.2.4p8 and 4.2.5 allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.


Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22 JDK and JRE 6 before Update 17 SDK and JRE 1.3.x before 1.3.1_27 and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP headers which are not properly parsed by the ASN.1 DER input stream parser aka Bug Id 6864911.


Google Chrome 1.0.154.48 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an automatically submitted form containing a KEYGEN element a related issue to CVE-2009-1828.


Unspecified vulnerability in Guest Additions in Sun xVM VirtualBox 1.6.x and 2.0.x before 2.0.12 2.1.x and 2.2.x and Sun VirtualBox before 3.0.10 allows guest OS users to cause a denial of service (memory consumption) on the guest OS via unknown vectors.


Unspecified vulnerability in Symantec Norton AntiVirus 2005 through 2008; Norton Internet Security 2005 through 2008; AntiVirus Corporate Edition 9.0 before MR7 10.0 10.1 before MR8 and 10.2 before MR3; and Client Security 2.0 before MR7 3.0 and 3.1 before MR8; when Internet Email Scanning is installed and enabled allows remote attackers to cause a denial of service (CPU consumption and persistent connection loss) via unknown attack vectors.


Unspecified vulnerability on the HP Color LaserJet M3530 Multifunction Printer with firmware 05.058.4 and the Color LaserJet CP3525 Printer with firmware 53.021.2 allows remote attackers to obtain \access to data\ or cause a denial of service via unknown vectors.


Acoustica MP3 Audio Mixer 1.0 and possibly 2.471 allows remote attackers to cause a denial of service (crash) via a long string in a .sgp playlist file.


Research In Motion (RIM) BlackBerry Browser on the BlackBerry 8800 allows remote attackers to cause a denial of service (application hang) via a JavaScript loop that configures the home page by using the setHomePage method and a DHTML behavior property.


xscreensaver (aka Gnome-XScreenSaver) in Sun Solaris 9 and 10 OpenSolaris snv_109 through snv_122 and X11 6.4.1 on Solaris 8 does not properly handle Accessibility support which allows local users to cause a denial of service (system hang) by locking the screen and then attempting to launch an Accessibility pop-up window related to a regression in certain Solaris and OpenSolaris patches.


rep_serv.exe 6.3.1.3 in the server in EMC RepliStor allows remote attackers to cause a denial of service via a crafted packet to TCP port 7144.


The core server component in PostgreSQL 8.4 before 8.4.1 8.3 before 8.3.8 and 8.2 before 8.2.14 allows remote authenticated users to cause a denial of service (backend shutdown) by \re-LOAD-ing\ libraries from a certain plugins directory.


The

WebFrameLoaderClient::dispatchDidChangeLocationWithinPage

function

in

in

Google

Chrome

before

allows

user-assisted

remote

attackers

to

cause

a

denial

of

service

via

a

page-local

link

related

to

an

\empty

redirect

chain

as

demonstrated

by

a

message

in

Yahoo!

Mail.


The handle_dr function in arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 2.6.31.1 does not properly verify the Current Privilege Level (CPL) before accessing a debug register which allows guest OS users to cause a denial of service (trap) on the host OS via a crafted application.


Unspecified vulnerability in nserver.exe in the server in IBM Lotus Domino 8.0 on Windows Server 2003 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors as demonstrated by a certain module in VulnDisco Pack Professional 8.11. NOTE: as of 20090903 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


The do_mmap_pgoff function in mm/nommu.c in the Linux kernel before 2.6.31.6 when the CPU lacks a memory management unit allows local users to cause a denial of service (OOPS) via an application that attempts to allocate a large amount of memory.


Unspecified vulnerability in Pidgin 2.6.0 allows remote attackers to cause a denial of service (crash) via a link in a Yahoo IM.


The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM as demonstrated by the SIM IM client.


The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID as demonstrated by a series of keyctl request2 and keyctl list commands.


Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service via a crafted RAR archive file that triggers stack corruption a different vulnerability than CVE-2009-3587.


Unspecified vulnerability in the IPv6 networking stack in Sun Solaris 10 and OpenSolaris snv_01 through snv_82 and snv_111 through snv_122 when a Cassini GigaSwift Ethernet Adapter (aka CE) interface is used allows remote attackers to cause a denial of service (panic) via vectors involving jumbo frames. NOTE: this issue exists because of an incomplete fix for CVE-2009-2136.


Stack consumption vulnerability in WebKit.dll in WebKit in Apple Safari 3.2.3 and possibly other versions before 4.1.2 allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls eval on a long string composed of A/ sequences.


The embedded database engine service (aka ovdbrun.exe) in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to cause a denial of service (daemon crash) via an invalid Error Code field in a packet.


FileCopa FTP Server 5.01 allows remote attackers to cause a denial of service (server hang) via a large number of crafted NOOP commands.


Unspecified vulnerability in SAP Crystal Reports Server 2008 on Windows XP allows attackers to cause a denial of service (infinite loop) via unknown vectors as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of 20090917 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


Unspecified vulnerability in packet.c in the GSM A RR dissector in Wireshark 1.2.0 and 1.2.1 allows remote attackers to cause a denial of service (application crash) via unknown vectors related to \an uninitialized dissector handle \ which triggers an assertion failure.


Sun Java SE 5.0 before Update 22 and 6 before Update 17 on Windows allows remote attackers to cause a denial of service via a BMP file containing a link to a UNC share pathname for an International Color Consortium (ICC) profile file probably a related issue to CVE-2007-2789 aka Bug Id 6632445.


Microsoft Internet Explorer 6 through 6.0.2900.2180 and 7 through 7.0.6000.16711 allows remote attackers to cause a denial of service (application hang) via a JavaScript loop that configures the home page by using the setHomePage method and a DHTML behavior property.


DataWizard Technologies FtpXQ FTP Server 3.0 allows remote authenticated users to cause a denial of service (crash) via a long ABOR command.


Microsoft Internet Explorer 6 on Windows XP SP2 and SP3 and Internet Explorer 7 on Vista allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls createElement to create an instance of the LI element and then calls setAttribute to set the value attribute.


Unspecified vulnerability in FreeSSHD 1.2.4 allows remote attackers to cause a denial of service via unknown vectors as demonstrated by a certain module in VulnDisco Pack Professional 8.11. NOTE: as of 20090917 this disclosure has no actionable information. However because the VulnDisco Pack author is a reliable researcher the issue is being assigned a CVE identifier for tracking purposes.


The Web Administrator service (STEMWADM.EXE) in Websense Personal Email Manager 7.1 before Hotfix 4 and Email Security 7.1 before Hotfix 4 allows remote attackers to cause a denial of service (crash) by sending a HTTP GET request to TCP port 8181 and closing the socket before the service can send a response.


The Siemens Gigaset SE361 WLAN router allows remote attackers to cause a denial of service (device reboot) via a flood of crafted TCP packets to port 1723.


win32k.sys in Microsoft Windows Server 2003 SP2 allows remote attackers to cause a denial of service (system crash) by referencing a crafted .eot file in the src descriptor of an @font-face Cascading Style Sheets (CSS) rule in an HTML document possibly related to the Embedded OpenType (EOT) Font Engine a different vulnerability than CVE-2006-0010 CVE-2009-0231 and CVE-2009-0232. NOTE: some of these details are obtained from third party information.


Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote attackers to cause a denial of service via a long argument to the (1) LIST and (2) NLST commands a differnt issue than CVE-2008-5626 and CVE-2006-5728.


A certain ActiveX control in lnresobject.dll 7.1.1.119 in the Research In Motion (RIM) Lotus Notes connector for BlackBerry Desktop Manager 5.0.0.11 allows remote attackers to cause a denial of service (Internet Explorer crash) by referencing the control's CLSID in the classid attribute of an OBJECT element.


net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket performing a shutdown operation on this socket and then performing a series of connect operations to this socket.


The management interface on the 2wire Gateway 1700HG 1701HG 1800HW 2071 2700HG and 2701HG-T with software before 5.29.52 allows remote attackers to cause a denial of service (reboot) via a %0d%0a sequence in the page parameter to the xslt program on TCP port 50001 a related issue to CVE-2006-4523.


Stack consumption vulnerability in Adobe Reader and Acrobat 9.1.3 9.1.2 9.1.1 and earlier 9.x versions; 8.1.6 and earlier 8.x versions; and possibly 7.1.4 and earlier 7.x versions allows remote attackers to cause a denial of service (application crash) via a PDF file with a large number of (open square bracket) characters in the argument to the alert method. NOTE: some of these details are obtained from third party information.


packet-paltalk.c in the Paltalk dissector in Wireshark 1.2.0 through 1.2.2 on SPARC and certain other platforms allows remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace.


Off-by-one error in the dissect_negprot_response function in packet-smb.c in the SMB dissector in Wireshark 1.2.0 through 1.2.2 allows remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace. NOTE: some of these details are obtained from third party information.


The SVG component in Mozilla Firefox 3.0.4 allows remote attackers to cause a denial of service (application hang) via a large value in the r (aka Radius) attribute of a circle element related to an \unclamped loop.\


The vmx_set_msr function in arch/x86/kvm/vmx.c in the VMX implementation in the KVM subsystem in the Linux kernel before 2.6.29.1 on the i386 platform allows guest OS users to cause a denial of service (OOPS) by setting the EFER_LME (aka \Long mode enable\) bit in the Extended Feature Enable Register (EFER) model-specific register which is specific to the x86_64 platform.


Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in \simply nested DTD structures \ as demonstrated by the Codenomicon XML fuzzing framework.


Memory leak on the Cisco Wireless LAN Controller (WLC) platform 4.x before 4.2.205.0 5.1 before 5.1.163.0 and 5.0 and 5.2 before 5.2.178.0 as used in Cisco 1500 Series 2000 Series 2100 Series 4100 Series 4200 Series and 4400 Series Wireless Services Modules (WiSM) WLC Modules for Integrated Services Routers and Catalyst 3750G Integrated Wireless LAN Controllers allows remote attackers to cause a denial of service (memory consumption and device reload) via SSH management connections aka Bug ID CSCsw40789.


ajaxterm.js in AjaxTerm 0.10 and earlier generates session IDs with predictable random numbers based on certain JavaScript functions which makes it easier for remote attackers to (1) hijack a session or (2) cause a denial of service (session ID exhaustion) via a brute-force attack.


Cisco IOS XR 3.8.1 and earlier allows remote attackers to cause a denial of service (process crash) via a long BGP UPDATE message as demonstrated by a message with many AS numbers in the AS Path Attribute.


Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6 when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2 allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups a related issue to CVE-2004-2540.


Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows remote attackers to cause a denial of service by triggering a stop or crash in httpd aka PR_18770 a different vulnerability than CVE-2009-1423 and CVE-2009-1424.


mod/server.mod/servmsg.c in Eggheads Eggdrop and Windrop 1.6.19 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PRIVMSG that causes an empty string to trigger a negative string length copy. NOTE: this issue exists because of an incorrect fix for CVE-2007-2807.


The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding.


The pci_register_iommu_region function in arch/sparc/kernel/pci_common.c in the Linux kernel before 2.6.29 on the sparc64 platform allows local users to cause a denial of service (system crash) by reading the /proc/iomem file related to uninitialized pointers and the request_resource function.


The IMAP task in the server in IBM Lotus Domino 8.0.2 before FP1 IF1 and 8.5 before IF3 allows remote attackers to cause a denial of service (daemon crash) via a MIME e-mail message with RFC822 attachments (aka blobs) containing malformed root entities.


fs/nfs/client.c in the Linux kernel before 2.6.23 does not properly initialize a certain structure member that stores the maximum NFS filename length which allows local users to cause a denial of service (OOPS) via a long filename related to the encode_lookup function.


Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allows remote attackers to cause a denial of service (daemon crash) via multiple requests to the default URI with alphabetic characters in the tzid parameter.


The Telephony component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted ICMP echo request which triggers an assertion error related to a \logic issue.\


Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service (openssl s_client crash) and possibly have unspecified other impact via a DTLS packet as demonstrated by a packet from a server that uses a crafted server certificate.


The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed which allows remote attackers to cause a denial of service (CPU consumption).


Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 Series devices 7.0 before 7.0(8)6 7.1 before 7.1(2)82 7.2 before 7.2(4)26 8.0 before 8.0(4)24 and 8.1 before 8.1(2)14 when H.323 inspection is enabled allows remote attackers to cause a denial of service (device reload) via a crafted H.323 packet.


NTRtScan.exe in Trend Micro OfficeScan Client 8.0 SP1 and 8.0 SP1 Patch 1 allows local users to cause a denial of service (application crash) via directories with long pathnames. NOTE: some of these details are obtained from third party information.


The ptrace_start function in kernel/ptrace.c in the Linux kernel 2.6.18 does not properly handle simultaneous execution of the do_coredump function which allows local users to cause a denial of service (deadlock) via vectors involving the ptrace system call and a coredumping thread.


The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number as demonstrated by an attempted conversion to the Float data type.


The OSCAR protocol implementation in Pidgin before 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type which allows remote attackers to cause a denial of service (application crash) via a crafted ICQ web message that triggers allocation of a large amount of memory.


Stack consumption vulnerability in the LDAP service in Active Directory on Microsoft Windows 2000 SP4 Server 2003 SP2 and Server 2008 Gold and SP2; Active Directory Application Mode (ADAM) on Windows XP SP2 and SP3 and Server 2003 SP2; and Active Directory Lightweight Directory Service (AD LDS) on Windows Server 2008 Gold and SP2 allows remote attackers to cause a denial of service (system hang) via a malformed (1) LDAP or (2) LDAPS request aka \LSASS Recursive Stack Overflow Vulnerability.\


InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6 a module in Pinnacle Systems Pinnacle Studio 12 allows remote attackers to cause a denial of service (application crash) via a crafted Hollywood FX Compressed Archive (.hfz) file.


ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1 when ASP 2.0 is used in integrated mode on IIS 7.0 does not properly manage request scheduling which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests aka \Remote Unauthenticated Denial of Service in ASP.NET Vulnerability.\


The kernel in Sun Solaris 9 allows local users to cause a denial of service (panic) by calling fstat with a first argument of AT_FDCWD.


The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3 when a reverse proxy is configured does not properly handle an amount of streamed data that exceeds the Content-Length value which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.


Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers aka \DTLS fragment handling memory leak.\


Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.2 before 7.2(4)26 8.0 before 8.0(4)22 and 8.1 before 8.1(2)12 when SQL*Net inspection is enabled allows remote attackers to cause a denial of service (traceback and device reload) via a series of SQL*Net packets.


The hypervisor_callback function in Xen possibly before 3.4.0 as applied to the Linux kernel 2.6.30-rc4 2.6.18 and probably other versions allows guest user applications to cause a denial of service (kernel oops) of the guest OS by triggering a segmentation fault in \certain address ranges.\


The php_zip_make_relative_path function in php_zip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of service (crash) via a ZIP file that contains filenames with relative paths which is not properly handled during extraction.


Integer underflow in the e1000_clean_rx_irq function in drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel before 2.6.30-rc8 the e1000e driver in the Linux kernel and Intel Wired Ethernet (aka e1000) before 7.5.5 allows remote attackers to cause a denial of service (panic) via a crafted frame size.


WebKit before r41741 as used in Apple iPhone OS 1.0 through 2.2.1 iPhone OS for iPod touch 1.1 through 2.2.1 Safari and other software allows remote attackers to cause a denial of service (memory consumption or device reset) via a web page containing an HTMLSelectElement object with a large length attribute related to the length property of a Select object.


net/ipv4/udp.c in the Linux kernel before 2.6.29.1 performs an unlocking step in certain incorrect circumstances which allows local users to cause a denial of service (panic) by reading zero bytes from the /proc/net/udp file and unspecified other files related to the \udp seq_file infrastructure.\


The administrative web interface on the Cisco Wireless LAN Controller (WLC) platform 4.2 before 4.2.205.0 and 5.x before 5.2.178.0 as used in Cisco 1500 Series 2000 Series 2100 Series 4100 Series 4200 Series and 4400 Series Wireless Services Modules (WiSM) WLC Modules for Integrated Services Routers and Catalyst 3750G Integrated Wireless LAN Controllers allows remote attackers to cause a denial of service (device reload) via a malformed response to a (1) HTTP or (2) HTTPS authentication request aka Bug ID CSCsx03715.


LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails which allows remote attackers to cause a denial of service (LDAP service hang).


lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.


The message engine in CA ARCserve Backup r12.0 and r12.0 SP1 for Windows allows remote attackers to cause a denial of service (crash) via (1) an invalid 0x13 message which is not properly handled in the ASCORE module or (2) a 0x3B message with invalid stub data that triggers an RPC marshalling error.


Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows remote attackers to cause a denial of service via unknown vectors aka PR_39412 a different vulnerability than CVE-2009-1423 and CVE-2009-1425.


The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3 2.6.27 before 2.6.27.24 2.6.29 before 2.6.29.4 and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write splice_from_pipe and ocfs2_file_splice_write functions.


Unspecified vulnerability in the VMware Descheduled Time Accounting driver in VMware Workstation 6.5.1 and earlier VMware Player 2.5.1 and earlier VMware ACE 2.5.1 and earlier VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745 VMware Fusion 2.x before 2.0.2 build 147997 VMware ESXi 3.5 and VMware ESX 3.0.2 3.0.3 and 3.5 when the Descheduled Time Accounting Service is not running allows guest OS users on Windows to cause a denial of service via unknown vectors.


Microsoft Internet Explorer 7 and 8 on Windows XP and Vista allows remote attackers to cause a denial of service (application hang) via a large document composed of unprintable characters aka MSRC 9011jr.


Apple Safari 3.2.2 and 4 Beta on Windows allows remote attackers to cause a denial of service (application crash) via an XML document containing many nested A elements.


The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use the GET method.


Unspecified vulnerability in portmapper (aka portmap) in IBM AIX 5.3 allows attackers to cause a denial of service (daemon hang) via unknown vectors related to libtli.


dhcpd in ISC DHCP 3.0.4 and 3.1.1 when the dhcp-client-identifier and hardware ethernet configuration settings are both used allows remote attackers to cause a denial of service (daemon crash) via unspecified requests.


The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier CUPS 1.3.9 and earlier Poppler before 0.10.6 and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file.


requests/status.xml in VLC 0.9.8a allows remote attackers to cause a denial of service (stack consumption and crash) via a long input argument in an in_play action.


Mozilla Firefox 3.0.10 allows remote attackers to cause a denial of service (infinite loop application hang and memory consumption) via a KEYGEN element in conjunction with (1) a META element specifying automatic page refresh or (2) a JavaScript onLoad event handler for a BODY element. NOTE: it was later reported that earlier versions are also affected.


Memory leak in the LDAP service in Active Directory on Microsoft Windows 2000 SP4 and Server 2003 SP2 and Active Directory Application Mode (ADAM) on Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to cause a denial of service (memory consumption and service outage) via (1) LDAP or (2) LDAPS requests with unspecified OID filters aka \Active Directory Memory Leak Vulnerability.\


libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted TAR file that causes (1) clamd and (2) clamscan to hang.


Multiple memory leaks in Ipsec-tools before 0.7.2 allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) signature verification during user authentication with X.509 certificates related to the eay_check_x509sign function in src/racoon/crypto_openssl.c; and (2) the NAT-Traversal (aka NAT-T) keepalive implementation related to src/racoon/nattraversal.c.


The Check Point High-Availability Protocol (CPHAP) dissector in Wireshark 0.9.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted FWHA_MY_STATE packet.


The administrative web interface on the Cisco Wireless LAN Controller (WLC) platform 4.x before 4.2.205.0 and 5.x before 5.2.191.0 as used in Cisco 1500 Series 2000 Series 2100 Series 4100 Series 4200 Series and 4400 Series Wireless Services Modules (WiSM) WLC Modules for Integrated Services Routers and Catalyst 3750G Integrated Wireless LAN Controllers allows remote attackers to cause a denial of service (device reload) via a crafted (1) HTTP or (2) HTTPS request aka Bug ID CSCsy27708.


Memory leak on Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)6 7.1 before 7.1(2)82 7.2 before 7.2(4)30 8.0 before 8.0(4)28 and 8.1 before 8.1(2)19 allows remote attackers to cause a denial of service (memory consumption or device reload) via a crafted TCP packet.


charon/sa/tasks/child_create.c in the charon daemon in strongSWAN before 4.3.1 switches the NULL checks for TSi and TSr payloads which allows remote attackers to cause a denial of service via an IKE_AUTH request without a (1) TSi or (2) TSr traffic selector.


Multiple unspecified vulnerabilities in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier and 6 Update 12 and earlier allow remote attackers to cause a denial of service (disk consumption) via vectors related to temporary font files and (1) \limits on Font creation \ aka CR 6522586 and (2) another unspecified vector aka CR 6632886.


Unspecified vulnerability on HP ProLiant DL and ML 100 Series G5 G5p and G6 servers with ProLiant Onboard Administrator Powered by LO100i (formerly Lights Out 100) 3.07 and earlier allows remote attackers to cause a denial of service via unknown vectors.


Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP2 Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 allow remote attackers to cause a denial of service (TCP outage) via a series of TCP sessions that have pending data and a (1) small or (2) zero receive window size and remain in the FIN-WAIT-1 or FIN-WAIT-2 state indefinitely aka \TCP/IP Orphaned Connections Vulnerability.\


Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows remote attackers to cause a denial of service via unknown vectors aka PR_39898 a different vulnerability than CVE-2009-1424 and CVE-2009-1425.


Pablo Software Solutions Quick 'n Easy Mail Server 3.3 allows remote attackers to cause a denial of service (daemon outage or CPU consumption) via multiple long SMTP commands as demonstrated by HELO commands.


The JSON_parser function (ext/json/JSON_parser.c) in PHP 5.2.x before 5.2.9 allows remote attackers to cause a denial of service (segmentation fault) via a malformed string to the json_decode API function.


The directory-services functionality in the scheduler in CUPS 1.1.17 and 1.1.22 allows remote attackers to cause a denial of service (cupsd daemon outage or crash) via manipulations of the timing of CUPS browse packets related to a \pointer use-after-delete flaw.\


agent/snmp_agent.c in snmpd in net-snmp 5.0.9 in Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP GETBULK request that triggers a divide-by-zero error. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-4309.


Unspecified vulnerability in Wireshark 0.99.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted Tektronix .rf5 file.


Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 Series devices 8.0 before 8.0(4)25 and 8.1 before 8.1(2)15 when an SSL VPN or ASDM access is configured allows remote attackers to cause a denial of service (device reload) via a crafted (1) SSL or (2) HTTP packet.


The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of \future epoch\ DTLS records that are buffered in a queue aka \DTLS record buffer limitation bug.\


Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to cause a denial of service (probably resource consumption) for a JAX-WS service endpoint via a connection without any data which triggers a file descriptor \leak.\


The BGP daemon (bgpd) in Quagga 0.99.11 and earlier allows remote attackers to cause a denial of service (crash) via an AS path containing ASN elements whose string representation is longer than expected which triggers an assert error.


The logging feature in eMule Plus before 1.2e allows remote attackers to cause a denial of service (infinite loop) via unspecified attack vectors.


Siemens Gigaset SE461 WiMAX router 1.5-BL024.9.6401 and possibly other versions allows remote attackers to cause a denial of service (device restart and loss of configuration) by connecting to TCP port 53 then closing the connection.


Microsoft Windows XP SP3 allows local users to cause a denial of service (system crash) by making an SPI_SETDESKWALLPAPER SystemParametersInfo call with an improperly terminated pvParam argument followed by an SPI_GETDESKWALLPAPER SystemParametersInfo call.


Memory leak on the Cisco Physical Access Gateway with software before 1.1 allows remote attackers to cause a denial of service (memory consumption) via unspecified TCP packets.


TYPSoft FTP Server 1.11 allows remote attackers to cause a denial of service (CPU consumption) by sending an ABOR (abort) command without an active file transfer.


The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 and IBM AFS 3.6 before Patch 19 on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced related to use of the ERR_PTR macro.


Unspecified vulnerability in an ioctl in hcmon.sys in VMware Workstation 6.5.1 and earlier VMware Player 2.5.1 and earlier VMware ACE 2.5.1 and earlier and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 allows local users to cause a denial of service via unknown vectors a different vulnerability than CVE-2008-3761.


The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7 as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references as demonstrated by a PROPFIND request a similar issue to CVE-2003-1564.


The Cisco Firewall Services Module (FWSM) 2.x 3.1 before 3.1(16) 3.2 before 3.2(13) and 4.0 before 4.0(6) for Cisco Catalyst 6500 switches and Cisco 7600 routers allows remote attackers to cause a denial of service (traffic-handling outage) via a series of malformed ICMP messages.


Sun Java System Directory Proxy Server in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3 when a JDBC data source is used does not properly handle (1) a long value in an ADD or (2) long string attributes which allows remote attackers to cause a denial of service (JDBC backend outage) via crafted LDAP requests.


vetmonnt.sys in CA Internet Security Suite r3 vetmonnt.sys before 9.0.0.184 in Internet Security Suite r4 and vetmonnt.sys before 10.0.0.217 in Internet Security Suite r5 do not properly verify IOCTL calls which allows local users to cause a denial of service (system crash) via a crafted call.


Microsoft Internet Explorer 6.0 through 8.0 beta2 allows remote attackers to cause a denial of service (application crash) via an onload=screen\\ attribute value in a BODY element.


QIP 2005 build 8082 allows remote attackers to cause a denial of service (CPU consumption and application hang) via a crafted Rich Text Format (RTF) ICQ message as demonstrated by an {\\rtf\\pict\\&&} message. NOTE: the vulnerability may be in Sergey Tkachenko TRichView. If so then this should not be treated as a vulnerability in QIP.


The aspath_prepend function in rde_attr.c in bgpd in OpenBSD 4.3 and 4.4 allows remote attackers to cause a denial of service (application crash) via an Autonomous System (AS) advertisement containing a long AS path.


The

originates_from_local_legacy_unicast_socket

function

in

avahi-core/server.c

in

avahi-daemon

does

not

account

for

the

network

byte

order

of

a

port

number

when

processing

incoming

multicast

packets

which

allows

remote

attackers

to

cause

a

denial

of

service

(network

bandwidth

and

CPU

consumption)

via

a

crafted

legacy

unicast

mDNS

query

packet

that

triggers

a

multicast

packet

storm.


The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.


ACPI Event Daemon (acpid) before 1.0.10 allows remote attackers to cause a denial of service (CPU consumption and connectivity loss) by opening a large number of UNIX sockets without closing them which triggers an infinite loop.


Unspecified vulnerability in ppdmgr in Sun Solaris 10 and OpenSolaris snv_61 through snv_106 allows local users to cause a denial of service via unspecified vectors related to a failure to \include all cache files \ and improper handling of temporary files.


Unspecified vulnerability in the SNMPv2c implementation in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisco ACE 4710 Application Control Engine Appliance before A3(2.1) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv1 packet.


The CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to cause a denial of service (daemon crash) via a long consumer name as demonstrated by an M-POST request to a long /CIMListener/ URI.


Memory leak in the SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (memory consumption and device crash) by disconnecting an SSL session in an abnormal manner leading to a Transmission Control Block (TCB) leak.


The ABI in the Linux kernel 2.6.28 and earlier on s390 powerpc sparc64 and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application but cannot verify this which allows local users to cause a denial of service (crash) or possibly gain privileges via a crafted system call.


The (1) Cisco Unified Communications Manager Express; (2) SIP Gateway Signaling Support Over Transport Layer Security (TLS) Transport; (3) Secure Signaling and Media Encryption; (4) Blocks Extensible Exchange Protocol (BEEP); (5) Network Admission Control HTTP Authentication Proxy; (6) Per-user URL Redirect for EAPoUDP Dot1x and MAC Authentication Bypass; (7) Distributed Director with HTTP Redirects; and (8) TCP DNS features in Cisco IOS 12.0 through 12.4 do not properly handle IP sockets which allows remote attackers to cause a denial of service (outage or resource consumption) via a series of crafted TCP packets.


Unspecified vulnerability in Tor before 0.2.0.34 allows directory mirrors to cause a denial of service (exit node crash) via \malformed input.\


Unspecified vulnerability in Sun OpenSolaris snv_39 through snv_45 when running in 64-bit mode on x86 architectures allows local users to cause a denial of service (hang of UFS filesystem write) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines aka CR 6442712.


The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager 5.x before 5.1(3e) and 6.x before 6.1(3) allows remote attackers to cause a denial of service (voice service outage) by sending malformed input over a TCP session in which the \client terminates prematurely.\


The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3 9.5 before 9.5.1-P3 and 9.6 before 9.6.1-P1 when configured as a master server allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message as exploited in the wild in July 2009.


Multiple unspecified vulnerabilities in the home agent (HA) implementation in the (1) Mobile IP NAT Traversal feature and (2) Mobile IPv6 subsystem in Cisco IOS 12.3 through 12.4 allow remote attackers to cause a denial of service (input queue wedge and interface outage) via an ICMP packet aka Bug ID CSCso05337.


The (1) Airline Product Set (aka ALPS) (2) Serial Tunnel Code (aka STUN) (3) Block Serial Tunnel Code (aka BSTUN) (4) Native Client Interface Architecture (NCIA) support (5) Data-link switching (aka DLSw) (6) Remote Source-Route Bridging (RSRB) (7) Point to Point Tunneling Protocol (PPTP) (8) X.25 for Record Boundary Preservation (RBP) (9) X.25 over TCP (XOT) and (10) X.25 Routing features in Cisco IOS 12.2 and 12.4 allows remote attackers to cause a denial of service (device reload) via a series of crafted TCP packets.


Multiple unspecified vulnerabilities in the Doors subsystem in the kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_94 allow local users to cause a denial of service (process hang) or possibly bypass file permissions or gain kernel-context privileges via vectors including ones related to (1) an argument handling deadlock in a door server and (2) watchpoint problems in the door_call function.


Unspecified vulnerability in the Java agent in Cisco Application Networking Manager (ANM) before 2.0 Update A allows remote attackers to gain privileges and cause a denial of service (service outage) by stopping processes or obtain sensitive information by reading configuration files.


The FormWidgetChoice::loadDefaults function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file with an invalid Form Opt entry.


Unspecified vulnerability in Cisco IOS 12.0 through 12.4 when configured with (1) IP Service Level Agreements (SLAs) Responder (2) Session Initiation Protocol (SIP) (3) H.323 Annex E Call Signaling Transport or (4) Media Gateway Control Protocol (MGCP) allows remote attackers to cause a denial of service (blocked input queue on the inbound interface) via a crafted UDP packet.


Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file as demonstrated by a file with exactly one frame.


Remote Apple Events in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) or obtain sensitive information via unspecified vectors that trigger an out-of-bounds memory access.


Unspecified vulnerability in Sun Solaris 10 on SPARC sun4v systems and OpenSolaris snv_47 through snv_85 allows local users to cause a denial of service (hang of UFS filesystem write) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines aka CR 6425723.


The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25 when configured as a router with a REJECT route does not properly manage the Protocol Independent Destination Cache (aka DST) in some situations involving transmission of an ICMP Host Unreachable message which allows remote attackers to cause a denial of service (connectivity outage) by sending a large series of packets to many destination IP addresses within this REJECT route related to an \rt_cache leak.\


Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2 as used in Firefox 3.1beta OpenJDK and GIMP allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file.


The NFSv4 Server module in the kernel in Sun Solaris 10 and OpenSolaris before snv_111 allow local users to cause a denial of service (infinite loop and system hang) by accessing an hsfs filesystem that is shared through NFSv4 related to the rfs4_op_readdir function.