The gyroscope on Xiaomi Mi 5s devices allows attackers to cause a denial of service (resonance and false data) via a 20.4 kHz audio signal aka a MEMS ultrasound attack.


The demangle_template function in cplus-dem.c in GNU libiberty as distributed in GNU Binutils 2.31.1 has a memory leak via a crafted string leading to a denial of service (memory consumption) as demonstrated by cxxfilt a related issue to CVE-2018-12698.


A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon causing the heartbeat between lmgrd and the vendor daemon to stop and the vendor daemon to shut down.


The SingleDocParser::HandleFlowMap function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.


Go Ethereum (aka geth) 1.8.19 allows attackers to cause a denial of service (memory consumption) by rewriting the length of a dynamic array in memory and then writing data to a single memory location with a large index number as demonstrated by use of \assembly { mstore }\ followed by a \c0xC800000 = 0xFF\ assignment.


Division-by-zero vulnerabilities in the functions pi_next_pcrl pi_next_cprl and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).


murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database which allows remote attackers to cause a denial of service (daemon hang or crash) via a message flood.


A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.10; v3.6 versions prior to 3.6.13.


Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value related to daemon/daemon_unix.go pkg/parsers/parsers.go and pkg/sysinfo/sysinfo.go.


There is an attempted excessive memory allocation at libxsmm_sparse_csc_reader in generator_spgemm_csc_reader.c in LIBXSMM 1.10 that will cause a denial of service.


There is a Segmentation fault triggered by illegal address access at liblas::SpatialReference::GetGTIF() (spatialreference.cpp) in libLAS 1.8.1 that will cause a denial of service.


PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 allows remote attackers to cause a denial of service (unrecoverable blank profile) via crafted JavaScript code in the First Name and Last Name field.


Mishandling of an empty string on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service (crash and reboot) via the ONVIF GetStreamUri method and GetVideoEncoderConfigurationOptions method.


wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long name. NOTE: this is not a Microsoft product.


A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon causing the heartbeat between lmgrd and the vendor daemon to stop and the vendor daemon to shut down.


The Scanner::EnsureTokensInQueue function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.


Mishandling of '>' on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service (crash and reboot) via certain ONVIF methods such as CreateUsers SetImagingSettings GetStreamUri and so on.


Out-of-bounds accesses in the functions pi_next_lrcp pi_next_rlcp pi_next_rpcl pi_next_pcrl pi_next_rpcl and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).


The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.31 has a memory leak via a crafted ELF file leading to a denial of service (memory consumption) as demonstrated by nm.


A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.


ABB Relion 630 devices 1.1 before 1.1.0.C0 1.2 before 1.2.0.B3 and 1.3 before 1.3.0.A6 allow remote attackers to cause a denial of service (reboot) via a reboot command in an SPA message.


An

issue

where

a

provided

address

with

is

not

checked

was

discovered

in

in

in

the

Linux

kernel

through

A

local

attacker

can

craft

a

malicious

IOCTL

function

call

to

overwrite

arbitrary

kernel

memory

resulting

in

a

Denial

of

Service

or

privilege

escalation.


There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.


A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which perform an $elemMatch This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.5; v3.6 versions prior to 3.6.10. This issue affects: MongoDB Inc. MongoDB Server 3.6 versions prior to 3.6.10; 4.0 versions prior to 4.0.5.


The server in Core FTP 2.0 build 653 on 32-bit platforms allows remote attackers to cause a denial of service (daemon crash) via a crafted XRMD command.


wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long second argument. NOTE: this is not a Microsoft product.


** DISPUTED ** There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any real-world application.


The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via a crafted file a different vulnerability than CVE-2017-2897.


The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian plugin xml files in an uploaded JAR.


SQLite 3.25.2 when queries are run on a table with a malformed PRIMARY KEY allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).


In Windows Master (aka Windows Optimization Master) 7.99.13.604 the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002833.


In Windows Master (aka Windows Optimization Master) 7.99.13.604 the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002021.


In ih264d_video_decode of ih264d_api.c there is a possible resource exhaustion due to an infinite loop. This could lead to remote temporary device denial of service (remote hang or reboot) with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android ID: A-63521984.


In ipSecSetEncapSocketOwner of XfrmController.cpp there is a possible failure to initialize a security feature due to uninitialized data. This could lead to local denial of service of IPsec on sockets with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9.0 Android ID: A-111650288


JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.


The xz_decomp function in xzlib.c in libxml2 2.9.8 if --with-lzma is used allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR as demonstrated by xmllint a different vulnerability than CVE-2015-8035.


In processMessagePart of InboundSmsHandler.java there is a possible remote denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-72298611.


In Windows Master (aka Windows Optimization Master) 7.99.13.604 the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002849.


In sdpu_extract_attr_seq of sdp_utils.cc there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-78136677.


In Windows Master (aka Windows Optimization Master) 7.99.13.604 the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf100282c.


In Windows Master (aka Windows Optimization Master) 7.99.13.604 the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf100202d.


In Windows Master (aka Windows Optimization Master) 7.99.13.604 the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf100284c.


libqpdf.a in QPDF through 8.0.2 mishandles certain \expected dictionary key but found non-name object\ cases allowing remote attackers to cause a denial of service (stack exhaustion) related to the QPDFObjectHandle and QPDF_Dictionary classes because nesting in direct objects is not restricted.


JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in libjasper/jpc/jpc_enc.c.


An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving side to include in the HMAC computation exactly 64K bytes of data following the record buffer aka an over-read. The MAC comparison will subsequently fail and the connection will be closed. This could be used for denial of service. No information leak occurs.


In Windows Master (aka Windows Optimization Master) 7.99.13.604 the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf100282d.


Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14 8.2.x before 8.2R11 and 8.3.x before 8.3R5 do not properly process nested XML entities which allows remote attackers to cause a denial of service (memory consumption and memory errors) via a crafted XML document.


There is a reachable abort in the function jpc_dec_process_sot in libjasper/jpc/jpc_dec.c of JasPer 2.0.14 that will lead to a remote denial of service attack by triggering an unexpected jas_alloc2 return value a different vulnerability than CVE-2017-13745.


In Windows Master (aka Windows Optimization Master) 7.99.13.604 the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf100283c.


windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file a different vulnerability than CVE-2018-8821.


The export function in libavfilter/vf_signature.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a long filename.


When a device connects only over WiFi VPN the device may not receive security updates due to some incorrect checks. This could lead to a local denial of service of security updates with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.1 Android ID: A-78644887.


In Windows Master (aka Windows Optimization Master) 7.99.13.604 the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf10026cc.


ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c) which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tiff file.


In getOffsetForHorizontal of Layout.java there is a possible application hang due to a slow width calculation. This could lead to remote denial of service if a contact with many hidden unicode characters were sent to the device and used by a local app with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-78464361


An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause a Denial of Service.


In Windows Master (aka Windows Optimization Master) 7.99.13.604 the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002841.


Improper memory handling in Intel QuickAssist Technology for Linux (all versions) may allow an authenticated user to potentially enable a denial of service via local access.


The get_count function in cplus-dem.c in GNU libiberty as distributed in GNU Binutils 2.31 allows remote attackers to cause a denial of service (malloc called with the result of an integer-overflowing calculation) or possibly have unspecified other impact via a crafted string as demonstrated by c++filt.


In QPDF 8.2.1 in libqpdf/QPDFWriter.cc QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive calls for a long time which allows remote attackers to cause a denial of service via a crafted PDF file.


The ProcessMimeEntity function in util-decode-mime.c in Suricata 4.x before 4.0.6 allows remote attackers to cause a denial of service (segfault and daemon crash) via crafted input to the SMTP parser as exploited in the wild in November 2018.


arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of insufficient restrictions on userspace access to the core register file and because PSTATE.M validation does not prevent unintended execution modes.


Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).


The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.


There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.27-RC1. A crafted input will lead to a remote denial of service attack.


snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet resulting in Denial of Service.


Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader hence causing the loop.


An issue was discovered in libpg_query 10-1.0.2. There is a memory leak in pg_query_raw_parse in pg_query_parse.c which might lead to a denial of service.


An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.


An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file as demonstrated by consider_notes.


Use after free in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059) 10.18.x.5057 (aka 15.36.x.5057) 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 may allow an unprivileged user to potentially enable a denial of service via local access.


An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.31. An invalid memory address dereference was discovered in read_reloc in reloc.c. The vulnerability causes a segmentation fault and application crash which leads to denial of service as demonstrated by objdump because of missing _bfd_clear_contents bounds checking.


Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file as demonstrated by eu-ranlib because a zero sh_entsize is mishandled.


In Network Security Services (NSS) before 3.36.7 and before 3.41.1 a malformed signature can cause a crash due to a null dereference resulting in a Denial of Service.


_set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet resulting in Denial of Service.


Out of bounds read in igdkm64.sys in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059) 10.18.x.5057 (aka 15.36.x.5057) 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 may allow an authenticated user to potentially enable denial of service via local access.


An issue was discovered in Xpdf 4.00. catalog->getNumPages() in AcroForm.cc allows attackers to launch a denial of service (hang caused by large loop) via a specific pdf file as demonstrated by pdftohtml. This is mainly caused by a large number after the /Count field in the file.


Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of a field composed of many decimal digits.


The ping feature in the Diagnostic functionality on TP-LINK WR840N v2 Firmware 3.16.9 Build 150701 Rel.51516n devices allows remote attackers to cause a denial of service (HTTP service termination) by modifying the packet size to be higher than the UI limit of 1472.


An exploitable permanent denial of service vulnerability exists in Insteon Hub running firmware version 1013. The firmware upgrade functionality triggered via PubNub retrieves signed firmware binaries using plain HTTP requests. The device doesn't check the kind of firmware image that is going to be installed and thus allows for flashing any signed firmware into any MCU. Since the device contains different and incompatible MCUs flashing one firmware to the wrong MCU will result in a permanent brick condition. To trigger this vulnerability an attacker needs to impersonate the remote server \cache.insteon.com\ and serve a signed firmware image.


An exploitable denial of service vulnerability exists in the Ocularis Recorder functionality of Ocularis 5.5.0.242. A specially crafted TCP packet can cause a process to terminate resulting in denial of service. An attacker can send a crafted TCP packet to trigger this vulnerability.


AESM daemon in Intel Software Guard Extensions Platform Software Component for Linux before 2.1.102 can effectively be disabled by a local attacker creating a denial of services like remote attestation provided by the AESM.


An exploitable code execution vulnerability exists in the UDP network functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can allocate unlimited memory resulting in denial of service. An attacker can send a set of packets to trigger this vulnerability.


An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can cause a settings change resulting in denial of service. An attacker can send a set of packets to trigger this vulnerability.


Bounds check vulnerability in User Mode Driver in Intel Graphics Driver 15.40.x.4 and 21.20.x.x allows unprivileged user to cause a denial of service via local access.


Parameter corruption in NDIS filter driver in Intel Online Connect Access 1.9.22.0 allows an attacker to cause a denial of service via local access.


Multiple pointer dereferences in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059) 10.18.x.5057 (aka 15.36.x.5057) 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 potentially enables an unprivileged user to cause a denial of service via local access.


The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip value. The vulnerable remote node would be crashed by such an attack immediately aka the EPoD (Ethereum Packet of Death) issue.


The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters (\\\f\).


BIRD Internet Routing Daemon before 1.6.4 allows local users to cause a denial of service (stack consumption and daemon crash) via BGP mask expressions in birdc.


ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.


md_build_attribute in md4c.c in md4c 0.2.6 allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact via a crafted file.


Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access.


ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem.


Archive.java in Junrar before 1.0.1 as used in Apache Tika and other products is affected by a denial of service vulnerability due to an infinite loop when handling corrupt RAR files.


ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-after-free read and possibly cause a denial of service (kernel oops or panic) via a crafted ntfs filesystem.


In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2 when nested virtualization is used local attackers could cause L1 KVM guests to VMEXIT potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL.


Denial of Service in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056) 10.18.x.5057 (aka 15.36.x.5057) and 20.19.x.5058 (aka 15.40.x.5058) may allow an unprivileged user to potentially create an infinite loop and crash an application via local access.


An XXE vulnerability in the OPC UA Java and .NET Legacy Stack can allow remote attackers to trigger a denial of service.


In Eclipse Jetty version 9.3.x and 9.4.x the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.


PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact because the attacker controls the pCreatePen->ihPen array index.


An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no filter which is an N=0 case when it expected at least one line to have been read thus making the N-1 index invalid. This allows attackers to cause a denial of service (slab out-of-bounds write) or possibly have unspecified other impact via crafted perf_event_open and mmap system calls.


Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.


An issue was discovered in Xen through 4.10.x. One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with debug exceptions. Unfortunately due to an oversight at least one of these safety checks can be triggered by a guest. A malicious PV guest can crash Xen leading to a Denial of Service. All Xen systems which have applied the XSA-260 fix are vulnerable. Only x86 systems are vulnerable. ARM systems are not vulnerable. Only x86 PV guests can exploit the vulnerability. x86 HVM and PVH guests cannot exploit the vulnerability. An attacker needs to be able to control hardware debugging facilities to exploit the vulnerability but such permissions are typically available to unprivileged users.


Firmware update routine in bootloader for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a privileged user to potentially enable a denial of service via local access.


An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4 leading to a denial of service.


Insufficient write protection in firmware for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a privileged user to potentially enable a denial of service via local access.


An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4 leading to a denial of service.


The Serialize.deserialize() method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions leading to a denial of service in applications that use this library (e.g. the standard CoAP server CoAP client example collect CoAP server and client) when they receive crafted CoAP messages.


Denial of Service in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056) 10.18.x.5057 (aka 15.36.x.5057) and 20.19.x.5058 (aka 15.40.x.5058) may allow an unprivileged user from a virtual machine guest to potentially crash the host system via local access.


TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote attackers to cause a denial of service (reboot) via data/reboot.json.


The Serialize.deserialize() method in CoAPthon 3.1 4.0.0 4.0.1 and 4.0.2 mishandles certain exceptions leading to a denial of service in applications that use this library (e.g. the standard CoAP server CoAP client CoAP reverse proxy example collect CoAP server and client) when they receive crafted CoAP messages.


An issue was discovered in Dropbox Lepton 1.2.1. The validateAndCompress function in validation.cc allows remote attackers to cause a denial of service (SIGFPE and application crash) via a malformed file.


Improper configuration of hardware access in Intel QuickAssist Technology for Linux (all versions) may allow an authenticated user to potentially enable a denial of service via local access.


libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write calls.


Node.js: All versions prior to Node.js 6.15.0 8.14.0 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection) and carefully timed completion of the headers it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.


The doPayouts() function of the smart contract implementation for MegaCryptoPolis an Ethereum game has a Denial of Service vulnerability. If a smart contract that has a fallback function always causing exceptions buys a land users cannot buy lands near that contract's land because those purchase attempts will not be completed unless the doPayouts() function successfully sends Ether to certain neighbors.


The Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.30 allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm.


In libavcodec in FFmpeg 4.0.1 improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4 leading to a denial of service related to error_resilience.c h263dec.c and mpeg4videodec.c.


An issue was discovered in fs/f2fs/inline.c in the Linux kernel through 4.4. A denial of service (out-of-bounds memory access and BUG) can occur for a modified f2fs filesystem image in which an inline inode contains an invalid reserved blkaddr.


RealOne Player 2.0 Build 6.0.11.872 allows remote attackers to cause a denial of service (array out-of-bounds access and application crash) via a crafted .aiff file.


There exists a partial Denial of Service vulnerability in Wanscam HW0021 IP Cameras. An attacker could craft a malicious POST request to crash the ONVIF service on such a device.


The

application

for

Android

is

affected

by

a

Denial

Of

Service

vulnerability.

By

starting

the

activity

com.agilebits.onepassword.filling.openyolo.OpenYoloDeleteActivity

or

com.agilebits.onepassword.filling.openyolo.OpenYoloRetrieveActivity

from

an

external

application

(since

they

are

exported)

it

is

possible

to

crash

the

instance.


** DISPUTED ** Info-ZIP Zip 3.0 when the -T and -TT command-line options are used allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value given that the entire purpose of -TT is execution of arbitrary commands.


An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of-bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted f2fs image.


There

is

a

memory

leak

in

util/parser.c

in

libming

which

will

lead

to

a

denial

of

service

via

or


In FFmpeg 4.0.1 improper handling of frame types (other than EAC3_FRAME_TYPE_INDEPENDENT) that have multiple independent substreams in the handle_eac3 function in libavformat/movenc.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4 leading to a denial of service or possibly unspecified other impact.


Windows 8.1 and RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allow a denial of service vulnerability due to the way objects are handled in memory aka \Windows IPSec Denial of Service Vulnerability\.


An error handling vulnerability in Routing Protocols Daemon (RPD) of Juniper Networks Junos OS allows an attacker to cause RPD to crash. Continued receipt of this malformed MPLS RSVP packet will cause a sustained Denial of Service condition. Affected releases are Juniper Networks Junos OS: 14.1 versions prior to 14.1R8-S5 14.1R9; 14.1X53 versions prior to 14.1X53-D48 on QFX Switching; 14.2 versions prior to 14.1X53-D130 on QFabric System; 14.2 versions prior to 14.2R4. This issue does not affect versions of Junos OS before 14.1R1. Junos OS RSVP only supports IPv4. IPv6 is not affected by this issue. This issue require it to be received on an interface configured to receive this type of traffic.


A denial of service vulnerability in the telnetd service on Junos OS allows remote unauthenticated users to cause high CPU usage which may affect system performance. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D81 on SRX Series; 12.3 versions prior to 12.3R12-S11; 12.3X48 versions prior to 12.3X48-D80 on SRX Series; 15.1 versions prior to 15.1R7; 15.1X49 versions prior to 15.1X49-D150 15.1X49-D160 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400 Series; 15.1X53 versions prior to 15.1X53-D68 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D235 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D495 on NFX Series; 16.1 versions prior to 16.1R4-S12 16.1R6-S6 16.1R7; 16.2 versions prior to 16.2R2-S7 16.2R3; 17.1 versions prior to 17.1R2-S9 17.1R3; 17.2 versions prior to 17.2R2-S6 17.2R3; 17.2X75 versions prior to 17.2X75-D100; 17.3 versions prior to 17.3R2-S4 17.3R3; 17.4 versions prior to 17.4R1-S5 17.4R2; 18.2X75 versions prior to 18.2X75-D5.


A specially crafted MPLS packet received or processed by the system on an interface configured with MPLS will store information in the system memory. Subsequently if this stored information is accessed this may result in a kernel crash leading to a denial of service. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D71; 12.3 versions prior to 12.3R12-S7; 12.3X48 versions prior to 12.3X48-D55; 14.1 versions prior to 14.1R8-S5 14.1R9; 14.1X53 versions prior to 14.1X53-D45 14.1X53-D107; 14.2 versions prior to 14.2R7-S7 14.2R8; 15.1 versions prior to 15.1F5-S8 15.1F6-S8 15.1R5-S6 15.1R6-S3 15.1R7; 15.1X49 versions prior to 15.1X49-D100; 15.1X53 versions prior to 15.1X53-D65 15.1X53-D231; 16.1 versions prior to 16.1R3-S6 16.1R4-S6 16.1R5; 16.1X65 versions prior to 16.1X65-D45; 16.2 versions prior to 16.2R2-S1 16.2R3; 17.1 versions prior to 17.1R2-S2 17.1R3; 17.2 versions prior to 17.2R1-S3 17.2R2; 17.2X75 versions prior to 17.2X75-D50. No other Juniper Networks products or platforms are affected by this issue.


The receipt of a crafted BGP UPDATE can lead to a routing process daemon (RPD) crash and restart. Repeated receipt of the same crafted BGP UPDATE can result in an extended denial of service condition for the device. This issue only affects the specific versions of Junos OS listed within this advisory. Earlier releases are unaffected by this vulnerability. This crafted BGP UPDATE does not propagate to other BGP peers. Affected releases are Juniper Networks Junos OS: 16.1X65 versions prior to 16.1X65-D47; 17.2X75 versions prior to 17.2X75-D91 17.2X75-D110; 17.3 versions prior to 17.3R1-S4 17.3R2; 17.4 versions prior to 17.4R1-S3 17.4R2.


Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to cause a denial of service via unspecified vectors.


Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).


A vulnerability in the Network Address Translation - Protocol Translation (NAT-PT) feature of Junos OS on SRX series devices may allow a certain valid IPv6 packet to crash the flowd daemon. Repeated crashes of the flowd daemon can result in an extended denial of service condition for the SRX device. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D72; 12.3X48 versions prior to 12.3X48-D55; 15.1X49 versions prior to 15.1X49-D90.


Receipt of a specially crafted DHCPv6 message destined to a Junos OS device configured as a DHCP server in a Broadband Edge (BBE) environment may result in a jdhcpd daemon crash. The daemon automatically restarts without intervention but a continuous receipt of crafted DHCPv6 packets could leaded to an extended denial of service condition. This issue only affects Junos OS 15.1 and later. Earlier releases are unaffected by this issue. Devices are only vulnerable to the specially crafted DHCPv6 message if DHCP services are configured. Devices not configured to act as a DHCP server are not vulnerable to this issue. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S2; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D235 15.1X53-D495; 16.1 versions prior to 16.1R4-S11 16.1R6-S6 16.1R7-S2; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S9; 17.2 versions prior to 17.2R2-S6; 17.3 versions prior to 17.3R3-S1; 17.4 versions prior to 17.4R1-S5; 18.1 versions prior to 18.1R2-S3; 18.2 versions prior to 18.2R1-S2; 18.2X75 versions prior to 18.2X75-D20.


A high rate of VLAN authentication attempts sent from an adjacent host on the local broadcast domain can trigger high memory utilization by the BBE subscriber management daemon (bbe-smgd) and lead to a denial of service condition. The issue was caused by attempting to process an unbounded number of pending VLAN authentication requests leading to excessive memory allocation. This issue only affects devices configured for DHCPv4/v6 over AE auto-sensed VLANs utilized in Broadband Edge (BBE) deployments. Other configurations are unaffected by this issue. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1R6-S2 15.1R7; 16.1 versions prior to 16.1R5-S1 16.1R6; 16.2 versions prior to 16.2R2-S2 16.2R3; 17.1 versions prior to 17.1R2-S5 17.1R3; 17.2 versions prior to 17.2R2.


A Denial of Service vulnerability in the SIP application layer gateway (ALG) component of Junos OS based platforms allows an attacker to crash MS-PIC MS-MIC MS-MPC MS-DPC or SRX flow daemon (flowd) process. This issue affects Junos OS devices with NAT or stateful firewall configuration in combination with the SIP ALG enabled. SIP ALG is enabled by default on SRX Series devices except for SRX-HE devices. SRX-HE devices have SIP ALG disabled by default. The status of ALGs in SRX device can be obtained by executing the command: show security alg status Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77; 12.3X48 versions prior to 12.3X48-D70; 15.1X49 versions prior to 15.1X49-D140; 15.1 versions prior to 15.1R4-S9 15.1R7-S1; 15.1F6; 16.1 versions prior to 16.1R4-S9 16.1R6-S1 16.1R7; 16.2 versions prior to 16.2R2-S7 16.2R3; 17.1 versions prior to 17.1R2-S7 17.1R3; 17.2 versions prior to 17.2R1-S6 17.2R2-S4 17.2R3; 17.3 versions prior to 17.3R1-S5 17.3R2-S2 17.3R3; 17.4 versions prior to 17.4R2. No other Juniper Networks products or platforms are affected by this issue.


An improper input validation weakness in the device control daemon process (dcd) of Juniper Networks Junos OS allows an attacker to cause a Denial of Service to the dcd process and interfaces and connected clients when the Junos device is requesting an IP address for itself. Junos devices are not vulnerable to this issue when not configured to use DHCP. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D40 on SRX Series; 12.3X48 versions prior to 12.3X48-D20 on SRX Series; 14.1X53 versions prior to 14.1X53-D40 on EX2200/VC EX3200 EX3300/VC EX4200 EX4300 EX4550/VC EX4600 EX6200 EX8200/VC (XRE) QFX3500 QFX3600 QFX5100; 15.1X49 versions prior to 15.1X49-D20 on SRX Series; 15.1X53 versions prior to 15.1X53-D68 on QFX10000 Series; 15.1X53 versions prior to 15.1X53-D235 on QFX5200/QFX5110; 15.1X53 versions prior to 15.1X53-D495 on NFX150 NFX250; 15.1X53 versions prior to 15.1X53-D590 on EX2300/EX3400; 15.1 versions prior to 15.1R7-S2.


A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2.0 requests aka \HTTP.sys Denial of Service Vulnerability.\ This affects Windows Server 2016 Windows 10 Windows 10 Servers.


A denial of service vulnerability exists in the way that Windows SNMP Service handles malformed SNMP traps aka \Windows SNMP Service Denial of Service Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).


A

sustained

sequence

of

different

types

of

normal

transit

traffic

can

trigger

a

high

CPU

consumption

denial

of

service

condition

in

the

Junos

OS

register

and

schedule

software

interrupt

handler

subsystem

when

a

specific

command

is

issued

to

the

device.

This

affects

one

or

more

threads

and

conversely

one

or

more

running

processes

running

on

the

system.

Once

this

occurs

the

high

CPU

event(s)

affects

either

or

both

the

forwarding

and

control

plane.

As

a

result

of

this

condition

the

device

can

become

inaccessible

in

either

or

both

the

control

and

forwarding

plane

and

stops

forwarding

traffic

until

the

device

is

rebooted.

The

issue

will

reoccur

after

reboot

upon

receiving

further

transit

traffic.

Score:

MEDIUM

(CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

For

network

designs

utilizing

layer

forwarding

agents

or

other

ARP

through

layer

technologies

the

score

is

slightly

higher.

Score:

MEDIUM

(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

If

the

following

entry

exists

in

the

RE

message

logs

then

this

may

indicate

the

issue

is

present.

This

entry

may

or

may

not

appear

when

this

issue

occurs.

/kernel:

Expensive

function:

Affected

releases

are

Juniper

Networks

Junos

OS:

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

No

other

Juniper

Networks

products

or

platforms

are

affected

by

this

issue.


A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents aka \.NET and .NET Core Denial of Service Vulnerability.\ This affects Microsoft .NET Framework 2.0 Microsoft .NET Framework 3.0 Microsoft .NET Framework 4.7.1 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.7/4.7.1 Microsoft .NET Framework 4.6 Microsoft .NET Framework 3.5 Microsoft .NET Framework 3.5.1 Microsoft .NET Framework 4.6/4.6.1/4.6.2 Microsoft .NET Framework 4.6.2/4.7/4.7.1 .NET Core 2.0 Microsoft .NET Framework 4.7.2.


A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregation Services Router (ASR) 5700 Series devices and Virtualized Packet Core (VPC) System Software could allow an unauthenticated remote attacker to cause an interface on the device to cease forwarding packets. The device may need to be manually reloaded to clear this Interface Forwarding Denial of Service condition. The vulnerability is due to the failure to properly check that the length of a packet to transmit does not exceed the maximum supported length of the network interface card (NIC). An attacker could exploit this vulnerability by sending a crafted IP packet or a series of crafted IP fragments through an interface on the targeted device. A successful exploit could allow the attacker to cause the network interface to cease forwarding packets. This vulnerability could be triggered by either IPv4 or IPv6 network traffic. This vulnerability affects the following Cisco products when they are running the StarOS operating system and a virtual interface card is installed on the device: Aggregation Services Router (ASR) 5700 Series Virtualized Packet Core-Distributed Instance (VPC-DI) System Software Virtualized Packet Core-Single Instance (VPC-SI) System Software. Cisco Bug IDs: CSCvf32385.


A Denial of Service vulnerability in J-Web service may allow a remote unauthenticated user to cause Denial of Service which may prevent other users to authenticate or to perform J-Web operations. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D60 on SRX Series; 15.1 versions prior to 15.1R7; 15.1F6; 15.1X49 versions prior to 15.1X49-D120 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400 Series; 15.1X53 versions prior to 15.1X53-D67 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D234 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D470 15.1X53-D495 on NFX Series; 16.1 versions prior to 16.1R6; 16.2 versions prior to 16.2R2-S6 16.2R3; 17.1 versions prior to 17.1R2-S6 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R2. No other Juniper Networks products or platforms are affected by this issue.


.NET Core 1.0 .NET Core 1.1 NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled aka \.NET Core Denial of Service Vulnerability\.


Receipt of specially crafted UDP/IP packets over MPLS may be able to bypass a stateless firewall filter. The crafted UDP packets must be encapsulated and meet a very specific packet format to be classified in a way that bypasses IP firewall filter rules. The packets themselves do not cause a service interruption (e.g. RPD crash) but receipt of a high rate of UDP packets may be able to contribute to a denial of service attack. This issue only affects processing of transit UDP/IP packets over MPLS received on an interface with MPLS enabled. TCP packet processing and non-MPLS encapsulated UDP packet processing are unaffected by this issue. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D76; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D66 12.3X48-D70; 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1F6-S10 15.1R4-S9 15.1R6-S6 15.1R7; 15.1X49 versions prior to 15.1X49-D131 15.1X49-D140; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400; 15.1X53 versions prior to 15.1X53-D67 on QFX10K; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110; 15.1X53 versions prior to 15.1X53-D471 15.1X53-D490 on NFX; 16.1 versions prior to 16.1R3-S8 16.1R4-S9 16.1R5-S4 16.1R6-S3 16.1R7; 16.2 versions prior to 16.2R1-S6 16.2R2-S5 16.2R3; 17.1 versions prior to 17.1R1-S7 17.1R2-S7 17.1R3; 17.2 versions prior to 17.2R1-S6 17.2R2-S4 17.2R3; 17.2X75 versions prior to 17.2X75-D100; 17.3 versions prior to 17.3R1-S4 17.3R2-S2 17.3R3; 17.4 versions prior to 17.4R1-S3 17.4R2; 18.1 versions prior to 18.1R2; 18.2X75 versions prior to 18.2X75-D5.


A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests aka \Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


A Denial of Service vulnerability exists in the Juniper Networks Junos OS JDHCPD daemon which allows an attacker to core the JDHCPD daemon by sending a crafted IPv6 packet to the system. This issue is limited to systems which receives IPv6 DHCP packets on a system configured for DHCP processing using the JDHCPD daemon. This issue does not affect IPv4 DHCP packet processing. Affected releases are Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S10 on EX Series; 12.3X48 versions prior to 12.3X48-D70 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on EX2200/VC EX3200 EX3300/VC EX4200 EX4300 EX4550/VC EX4600 EX6200 EX8200/VC (XRE) QFX3500 QFX3600 QFX5100; 14.1X53 versions prior to 14.1X53-D130 on QFabric; 15.1 versions prior to 15.1R4-S9 15.1R6-S6 15.1R7; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D67 on QFX10000 Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5110 QFX5200; 15.1X53 versions prior to 15.1X53-D471 on NFX 150 NFX 250; 16.1 versions prior to 16.1R3-S9 16.1R4-S8 16.1R5-S4 16.1R6-S3 16.1R7; 16.2 versions prior to 16.2R2-S5 16.2R3; 17.1 versions prior to 17.1R1-S7 17.1R2-S7 17.1R3; 17.2 versions prior to 17.2R1-S6 17.2R2-S4 17.2R3; 17.3 versions prior to 17.3R1-S4 17.3R2-S2 17.3R3; 17.4 versions prior to 17.4R1-S3 17.4R2.


Microsoft

.NET

Framework

and

and

.NET

Core

and

allow

a

denial

of

service

vulnerability

due

to

the

way

XML

documents

are

processed

aka

\.NET

and

.NET

Core

Denial

Of

Service

Vulnerability\.

This

CVE

is

unique

from


The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows a denial of service vulnerability due to how input from a privileged user on a guest operating system is validated aka \Hyper-V Denial of Service Vulnerability\.


Receipt

of

a

specific

MPLS

packet

may

cause

line

cards

or

to

crash

and

restart.

By

continuously

sending

specific

MPLS

packets

an

attacker

can

repeatedly

crash

the

line

cards

or

causing

a

sustained

Denial

of

Service.

Affected

releases

are

Juniper

Networks

Junos

OS

with

or

installed

and

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

Refer

to

for

more

information

about

PFE

line

cards.


The Microsoft Server Message Block 2.0 and 3.0 (SMBv2/SMBv3) client in Windows 8.1 and RT 8.1 and Windows Server 2012 R2 allows a denial of service vulnerability due to how specially crafted requests are handled aka \SMBv2/SMBv3 Null Dereference Denial of Service Vulnerability\.


Junos OS may be impacted by the receipt of a malformed BGP UPDATE which can lead to a routing process daemon (rpd) crash and restart. Receipt of a repeated malformed BGP UPDATEs can result in an extended denial of service condition for the device. This malformed BGP UPDATE does not propagate to other BGP peers. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1F6-S10 15.1R4-S9 15.1R6-S6 15.1R7; 15.1X49 versions prior to 15.1X49-D130 on SRX; 15.1X53 versions prior to 15.1X53-D66 on QFX10K; 15.1X53 versions prior to 15.1X53-D58 on EX2300/EX3400; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110; 15.1X53 versions prior to 15.1X53-D471 on NFX; 16.1 versions prior to 16.1R3-S8 16.1R4-S9 16.1R5-S3 16.1R6-S3 16.1R7; 16.1X65 versions prior to 16.1X65-D47; 16.2 versions prior to 16.2R1-S6 16.2R2-S5 16.2R3; 17.1 versions prior to 17.1R2-S3 17.1R3; 17.2 versions prior to 17.2R1-S3 17.2R2-S1 17.2R3; 17.2X75 versions prior to 17.2X75-D70; 13.2 versions above and including 13.2R1. Versions prior to 13.2R1 are not affected. Juniper SIRT is not aware of any malicious exploitation of this vulnerability. No other Juniper Networks products or platforms are affected by this issue.


The DCTStream::readHuffSym function in Stream.cc in the DCT decoder in xpdf before 4.00 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JPEG data.


An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.


In Apache Tika 1.19 (CVE-2018-11761) we added an entity expansion limit for XML parsing. However Tika reuses SAXParsers and calls reset() after each parse which for Xerces2 parsers as per the documentation removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.


The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file because of an uninitialized variable in the CPSE handler in libr/anal/p/anal_avr.c.


The decompileSETTARGET function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.


DISPUTED

The

libfsntfs_security_descriptor_values_free

function

in

in

libfsntfs

through

allows

remote

attackers

to

cause

a

denial

of

service

(double-free)

via

a

crafted

ntfs

file.

NOTE:

the

vendor

has

disputed

this

as

described

in

libyal/libfsntfs

issue

on

GitHub.


The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.


The decompileJUMP function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.


A stack exhaustion vulnerability in the search function of dtSearch 7.90.8538.1 and prior allows remote attackers to cause a denial of service condition by sending a specially crafted HTTP request.


ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL as demonstrated by a crafted window.open call.


Windscribe 1.81 creates a named pipe with a NULL DACL that allows Everyone users to gain privileges or cause a denial of service via \\\\.\\pipe\\WindscribeService.


An issue was discovered in CppCMS before 1.2.1. There is a denial of service in the JSON parser module.


A division by zero was discovered in H5D__btree_decode_key in H5Dbtree.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.


The

function

in

in

the

Linux

kernel

before

allows

attackers

to

cause

a

denial

of

service

(panic)

because

a

parameter

is

incorrectly

used

as

a

local

variable.


The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects which allows attackers to cause a denial of service (mrb_hash_keys uninitialized pointer and application crash) or possibly have unspecified other impact.


An issue was discovered in PoDoFo 0.9.5. There is an Excessive Recursion in the PdfPagesTree::GetPageNode() function of PdfPagesTree.cpp. Remote attackers could leverage this vulnerability to cause a denial of service through a crafted pdf file a related issue to CVE-2017-8054.


The newVar_N function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.


Cloud Foundry Garden-runC release versions prior to 1.16.1 prevents deletion of some app environments based on file attributes. A remote authenticated malicious user may create and delete apps with crafted file attributes to cause a denial of service for new app instances or scaling up of existing apps.


A division by zero was discovered in H5D__chunk_init in H5Dchunk.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack.


soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted AMS file because of an invalid write near address 0 in an out-of-memory situation.


Improper

input

validation

in

trustzone

can

lead

to

denial

of

service

in

snapdragon

automobile

snapdragon

mobile

and

snapdragon

wear

in

versions

SD

SD

SD

SD

SD

SD

SD

SD


An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.


Dell EMC Data Protection Advisor versions 6.2 6 3 6.4 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0 2.1 contain a XML External Entity (XXE) Injection vulnerability in the REST API. An authenticated remote malicious user could potentially exploit this vulnerability to read certain system files in the server or cause denial of service by supplying specially crafted Document Type Definitions (DTDs) in an XML request.


The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.


jpegoptim.c in jpegoptim 1.4.5 (fixed in 1.4.6) has an invalid use of realloc() and free() which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


The getString function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.


In ImageMagick 7.0.7-20 Q16 x86_64 a memory leak vulnerability was found in the function GetImagePixelCache in MagickCore/cache.c which allows attackers to cause a denial of service via a crafted CALS image file.


When parsing a JSON payload with deeply nested JSON structures the parser in Apache Mesos versions pre-1.4.x 1.4.0 to 1.4.2 1.5.0 to 1.5.1 1.6.0 to 1.6.1 and 1.7.0 might overflow the stack due to unbounded recursion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.


jbig2_add_page in jbig2enc.cc in libjbig2enc.a in jbig2enc 0.29 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted file.


An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.


The vlc_demux_chained_Delete function in input/demux_chained.c in VideoLAN VLC media player 3.0.1 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted .swf file.


RSA BSAFE Micro Edition Suite prior to 4.1.6.1 (in 4.1.x) and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 (in 4.0.x) contain an Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data that would exhaust the stack potentially causing a Denial Of Service.


An issue was discovered in Libav 12.3. A read access violation in the in_table_init16 function in libavcodec/aacsbr.c allows remote attackers to cause a denial of service (application crash) as demonstrated by avconv.


PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free) limit the ability of a malware scanner to operate on the entire original data or possibly have unspecified other impact via a crafted file.


In Apache Tika 0.1 to 1.18 the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.


An issue was discovered in Libav 12.3. A read access violation in the mov_probe function in libavformat/mov.c allows remote attackers to cause a denial of service (application crash) as demonstrated by avconv.


The dcputs function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.


In ImageMagick 7.0.7-20 Q16 x86_64 a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c which allows attackers to cause a denial of service via a crafted DCM image file.


An issue was discovered in libjpeg 9a. The get_text_rgb_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.


ASUS HG100 devices allow denial of service via an IPv4 packet flood.


When reading a specially crafted ZIP archive the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream which can be used to mount a denial of service attack against services that use Compress' zip package.


An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (unexpectedly high interrupt number array overrun and hypervisor crash) or possibly gain hypervisor privileges by setting up an HPET timer to deliver interrupts in IO-APIC mode aka vHPET interrupt injection.


The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash) related to a memory allocation failure as demonstrated by mp2aac.


Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service.


** DISPUTED ** drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the relevance of this report because the failure can only occur for physically proximate attackers who unplug SAS Host Bus Adapter cables.


windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a 0x953827bf DeviceIoControl call.


The TIFFWriteDirectorySec() function in tif_dirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service (assertion failure and application crash) via a crafted file a different vulnerability than CVE-2017-13726.


The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13 when an unspecified architecture and compiler is used might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value.


An issue was discovered in GEGL through 0.3.32. The gegl_tile_backend_swap_constructed function in buffer/gegl-tile-backend-swap.c allows remote attackers to cause a denial of service (write access violation) or possibly have unspecified other impact via a malformed PNG file that is mishandled during a call to the babl_format_get_bytes_per_pixel function in babl-format.c in babl 0.1.46.


An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide an existing but invalid XML file which would be opened and never closed possibly producing a Denial of Service.


SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server which may cause denial of service via 100% CPU utilization. Restart of the application is required.


Read access violation in the isiin_keyword function in isiin.c in libbibutils.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash) as demonstrated by isi2xml.


PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6 and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9 are vulnerable to a memory leak while parsing malformed records that can lead to remote denial of service.


An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation leading to a denial of service (application crash) upon allocation failure.


Pexip Infinity before 18 allows remote Denial of Service (XML parsing).


The decode_init function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via an AVI file.


It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time causing a denial of service condition that could potentially impact other users of the host.


LiteCart before 2.1.2 allows remote attackers to cause a denial of service (memory consumption) via URIs that do not exist because public_html/logs/not_found.log grows without bound and is loaded into memory for each request.


The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.


SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser which may allow disclosure and retrieval of arbitrary data arbitrary code execution (in certain situations on specific platforms) and denial of service attacks.


Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable related to federation/federation_base.py and handlers/message.py as exploited in the wild in April 2018.


Read access violation in the III_dequantize_sample function in mpglibDBL/layer3.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact a different vulnerability than CVE-2017-9872 and CVE-2017-14409.


It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of service. If gluster multiplexing is enabled this will result in a crash of multiple bricks and gluster volumes.


The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a crafted xfs image.


It has been discovered that redhat-certification does not properly limit the number of recursive definitions of entities in XML documents while parsing the status of a host. A remote attacker could use this vulnerability to consume all the memory of the server and cause a Denial of Service. This flaw affects redhat-certification version 7.


In MicroWorld eScan Internet Security Suite (ISS) for Business 14.0.1400.2029 the driver econceal.sys allows a non-privileged user to send a 0x830020E0 IOCTL request to \\\\.\\econceal to cause a denial of service (BSOD).


windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a 0x953826DB DeviceIoControl call.


The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13 when an unspecified architecture and compiler is used might allow local users to cause a denial of service via an INT_MIN argument.


The getbits function in mpglibDBL/common.c in mp3gain through 1.5.2-r2 allows remote attackers to cause a denial of service (segmentation fault and application crash) or possibly have unspecified other impact.


In fuse before versions 2.9.8 and 3.x before 3.2.5 fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system accessible by other users and trick them into accessing files on that file system possibly causing Denial of Service or other unspecified effects.


The tEXtToDataBuf function in pngimage.cpp in Exiv2 through 0.26 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.


An issue was discovered in GEGL through 0.3.32. The render_rectangle function in process/gegl-processor.c has unbounded memory allocation leading to a denial of service (application crash) upon allocation failure.


keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.


An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (host OS infinite loop) in situations where a QEMU device model attempts to make invalid transitions between states of a request.


sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.


The Owned smart contract implementation for Aurora DAO (AURA) an Ethereum ERC20 token allows attackers to acquire contract ownership because the setOwner function is declared as public. An attacker can then conduct a lockBalances() denial of service attack.


An input validation flaw exists in ttembed. With a crafted input file an attacker may be able to trigger a denial of service condition due to ttembed trusting attacker controlled values.


An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing because of an incorrect fix for CVE-2017-5754.


An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of service (SIGABRT) by triggering an incorrect Safe::add call.


An issue was discovered in Free Lossless Image Format (FLIF) 0.3. The Plane function in image/image.hpp allows remote attackers to cause a denial of service (attempted excessive memory allocation) via a crafted file.


In 2345 Security Guard 3.7 the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x00222040. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-8873.


LogMeIn LastPass through 4.15.0 allows remote attackers to cause a denial of service (browser hang) via an HTML document because the resource consumption of onloadwff.js grows with the number of INPUT elements.


Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow the creation of new connections to one or more IOAs without closing them properly which may cause a denial of service within the industrial process control channel.


strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable.


An issue was discovered in GEGL through 0.3.32. The gegl_buffer_iterate_read_simple function in buffer/gegl-buffer-access.c allows remote attackers to cause a denial of service (write access violation) or possibly have unspecified other impact via a malformed PPM file related to improper restrictions on memory allocation in the ppm_load_read_header function in operations/external/ppm-load.c.


Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP).


Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.


An issue was discovered in Alps Pointing-device Driver 10.1.101.207. ApMsgFwd.exe allows the current user to map and write to the \ApMsgFwd File Mapping Object\ section. ApMsgFwd.exe uses the data written to this section as arguments to functions. This causes a denial of service condition when invalid pointers are written to the mapped section. This driver has been used with Dell ThinkPad and VAIO devices.


The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.


NULL pointer deference in the addsn function in serialno.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial of service (application crash) as demonstrated by copac2xml.


IBM Business Automation Workflow and Business Process Manager 18.0.0.0 18.0.0.1 and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.


IBM QRadar Incident Forensics 7.2 and 7.3 does not properly restrict the size or amount of resources requested which could allow an unauthenticated user to cause a denial of service. IBM X-Force ID: 144650.


A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw to cause a denial of service against a samba server used as a Active Directory Domain Controller. All versions of Samba from 4.8.0 onwards are vulnerable


A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used mod_cache_disk is not concerned by this vulnerability.


IBM SAN Volume Controller IBM Storwize IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1 6.2 6.3 6.4 7.1 7.2 7.3 7.4 7.5 7.6 7.6.1 7.7 7.7.1 7.8 7.8.1 8.1 and 8.1.1) could allow an authenticated user to access system files they should not have access to including deleting files or causing a denial of service. IBM X-Force ID: 140363.


An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7 8.5.0 to 8.5.30 8.0.0.RC1 to 8.0.51 and 7.0.28 to 7.0.86.


IBM DataPower Gateways 7.1 7.2 7.5 7.5.1 7.5.2 7.6 and 7.7 and IBM MQ Appliance are vulnerable to a denial of service caused by the improper handling of full file system. A local attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 145171.


IBM Spectrum Protect 7.1 and 8.1 could allow a local user to corrupt or delete highly sensitive information that would cause a denial of service to other users. IBM X-Force ID: 142696.


By specially crafting HTTP/2 requests workers would be allocated 60 seconds longer than necessary leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30 2.4.33).


Spring Framework versions 5.0.x prior to 5.0.6 versions 4.3.x prior to 4.3.17 and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression denial of service attack.


IBM WebSphere MQ 8.0 and 9.0 when configured to use a PAM module for authentication could allow a user to cause a deadlock in the IBM MQ PAM code which could result in a denial of service. IBM X-Force ID: 138949.


IBM API Connect 2018.1 through 2018.3.7 could allow an unauthenticated attacker to cause a denial of service due to not setting limits on JSON payload size. IBM X-Force ID: 148802.


IBM DB2 for Linux UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability. A remote authenticated DB2 user could exploit this vulnerability by issuing a specially-crafted SELECT statement with TRUNCATE function. IBM X-Force ID: 154032.


RSA Authentication Manager Security Console version 8.3 and earlier contains a XML External Entity (XXE) vulnerability. This could potentially allow admin users to cause a denial of service or extract server data via injecting a maliciously crafted DTD in an XML file submitted to the application.


In cf-deployment before 1.14.0 and routing-release before 0.172.0 the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial of service.


IBM DataPower Gateway 7.1.0.0 through 7.1.0.19 7.2.0.0 through 7.2.0.16 7.5.0.0 through 7.5.0.10 7.5.1.0 through 7.5.1.9 7.5.2.0 through 7.5.2.9 and 7.6.0.0 through 7.6.0.2 and IBM MQ Appliance 8.0.0.0 through 8.0.0.8 and 9.0.1 through 9.0.5 could allow a local user to cause a denial of service through unknown vectors. IBM X-Force ID: 144724.


IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can cause a denial of service attack. IBM X-Force ID: 145456.


IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes incorrectly accumulate TCP/IP sockets in a CLOSE_WAIT state. This can cause TCP/IP resource leakage and may result in a denial of service. IBM X-Force ID: 148871.


routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which can cause an entire shard to be brought down. A malicious user can use this vulnerability to cause a Denial of Service attack for other users of the router shard.


Spring Data Commons versions 1.13 to 1.13.10 2.0 to 2.0.5 and older unsupported versions contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).


Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for more information. The fix to upgrade the activemq-client library to 5.15.3 was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.


In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5 a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path leading to a denial of service.


python before versions 2.7.15 3.4.9 3.5.6rc1 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.


libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.


An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters affecting all versions including 1.4.x. A remote unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request thus resulting in denial of service.


IBM GSKit (IBM DB2 for Linux UNIX and Windows 9.7 10.1 10.5 and 11.1) contains several environment variables that a local attacker could overflow and cause a denial of service. IBM X-Force ID: 139072.


A problem within the IBM MQ 9.0.2 9.0.3 9.0.4 9.0.5 and 9.1.0.0 Console REST API Could allow attackers to execute a denial of service attack preventing users from logging into the MQ Console REST API. IBM X-Force ID: 151969.


Cloud Foundry Loggregator versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2 does not handle errors thrown while constructing certain http requests. A remote authenticated user may construct malicious requests to cause the traffic controller to leave dangling TCP connections which could cause denial of service.


A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.


python before versions 2.7.15 3.4.9 3.5.6rc1 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.


A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8 0-9 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated attacker to crash the broker instance. AMQP 1.0 and HTTP connections are not affected. An authentication of incoming AMQP connections in Apache Qpid Broker-J is performed by special entities called \Authentication Providers\. Each Authentication Provider can support several SASL mechanisms which are offered to the connecting clients as part of SASL negotiation process. The client chooses the most appropriate SASL mechanism for authentication. Authentication Providers of following types supports PLAIN SASL mechanism: Plain PlainPasswordFile SimpleLDAP Base64MD5PasswordFile MD5 SCRAM-SHA-256 SCRAM-SHA-1. XOAUTH2 SASL mechanism is supported by Authentication Providers of type OAuth2. If an AMQP port is configured with any of these Authentication Providers the Broker may be vulnerable.


All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.


IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which could cause a denial of service. IBM X-Force ID: 141148.


A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings) an attacker can cause utilities from psutils or procps (such as ps w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).


When parsing a malformed JSON payload libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.


A denial of service vulnerability exists in the way that the Windows Code Integrity Module performs hashing aka \Windows Code Integrity Module Denial of Service Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


runelite version <= runelite-parent-1.4.23 contains a XML External Entity (XXE) vulnerability in Man in the middle runscape services call that can result in Disclosure of confidential data denial of service SSRF port scanning.


OpenCart-Overclocked version <=1.11.1 contains a Cross Site Scripting (XSS) vulnerability in User input entered unsanitised within JS function in the template that can result in Unauthorised actions and access to data stealing session information denial of service. This attack appear to be exploitable via Malicious input passed in GET parameter.


XR3Player version <= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser that can result in Disclosure of confidential data denial of service SSRF port scanning.


Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data denial of service server side request forgery port scanning. This attack appear to be exploitable via Specially crafted RDF file.


FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update that can result in Disclosure of confidential data denial of service SSRF port scanning. This attack appear to be exploitable via Man in the middle the call to update the software.


neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data denial of service SSRF port scanning. This vulnerability appears to have been fixed in after commit 45bc09c.


Minio

Inc.

Minio

server

version

prior

to

contains

a

Allocation

of

Memory

Without

Limits

or

Throttling

(similar

to

vulnerability

in

write-to-RAM

that

can

result

in

Denial

of

Service.

This

attack

appear

to

be

exploitable

via

Sending

requests

with

large

bodies

This

vulnerability

appears

to

have

been

fixed

in

after

commit


autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data denial of service SSRF port scanning. This attack appear to be exploitable via Specially crafted CaseMetadata.


In MuPDF 1.12.0 and earlier multiple reachable assertions in the PDF parser allow an attacker to cause a denial of service (assert crash) via a crafted file.


FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Disclosure of confidential data denial of service SSRF port scanning. This attack appear to be exploitable via Freecol file.


textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file.


Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data denial of service server side request forgery port scanning. This attack appear to be exploitable via Specially crafted XML file.


MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files that can result in Disclosure of confidential data denial of service SSRF port scanning. This attack appear to be exploitable via Specially crafted SMathStudio files. This vulnerability appears to have been fixed in after commit 5c05ac8.


Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.


WP Image Zoom version 1.23 contains a Incorrect Access Control vulnerability in AJAX settings that can result in allows anybody to cause denial of service. This attack appear to be exploitable via Can be triggered intentionally (or unintentionally via CSRF) by any logged in user. This vulnerability appears to have been fixed in 1.24.


An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java CloudSelectorParameter.java ConvertToTemplate.java ConvertToVm.java Delete.java DeleteSnapshot.java Deploy.java ExposeGuestInfo.java FolderVSphereCloudProperty.java PowerOff.java PowerOn.java Reconfigure.java Rename.java RenameSnapshot.java RevertToSnapshot.java SuspendVm.java TakeSnapshot.java VSphereBuildStepContainer.java vSphereCloudProvisionedSlave.java vSphereCloudSlave.java vSphereCloudSlaveTemplate.java VSphereConnectionConfig.java vSphereStep.java that allows attackers to perform form validation related actions including sending numerous requests to the configured vSphere server potentially resulting in denial of service or send credentials stored in Jenkins with known ID to an attacker-specified server (\test connection\).


In MuPDF 1.12.0 and earlier multiple memory leaks in the PDF parser allow an attacker to cause a denial of service (memory leak) via a crafted file.


KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can result in Disclosure of confidential data denial of service SSRF port scanning.


Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50 000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.


In MuPDF 1.12.0 and earlier multiple use of uninitialized value bugs in the PDF parser could allow an attacker to cause a denial of service (crash) or influence program flow via a crafted file.


aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appear to be exploitable via Sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in 5.


K9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of confidential data denial of service SSRF port scanning. This attack appear to be exploitable via malicious WebDAV server or intercept the reponse of a valid WebDAV server.


Anyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man in the middle on map API call that can result in Disclosure of confidential data denial of service SSRF port scanning. This vulnerability appears to have been fixed in after commit 80359b4.


A

denial

of

service

vulnerability

exists

in

Jenkins

and

earlier

LTS

and

earlier

in

that

allows

attackers

without

Overall/Read

permission

to

access

a

specific

URL

on

instances

using

the

built-in

Jenkins

user

database

security

realm

that

results

in

the

creation

of

an

ephemeral

user

record

in

memory.


exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data denial of service SSRF port scanning.


UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data denial of service SSRF port scanning. This attack appear to be exploitable via malicious plugins.xml file.


LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Deletion vulnerability in Import template that can result in Denial of service. This attack appear to be exploitable via User controlled parameter.


The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.


bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data denial of service SSRF port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.


ONOS ONOS Controller version 1.13.1 and earlier contains a Denial of Service (Service crash) vulnerability in OVSDB component in ONOS that can result in An adversary can remotely crash OVSDB service ONOS controller via a normal switch.. This attack appear to be exploitable via the attacker should be able to control or forge a switch in the network..


nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.


Battelle V2I Hub 2.5.1 is vulnerable to a denial of service caused by the failure to restrict access to a sensitive functionality. By visiting http://V2I_HUB/UI/powerdown.php a remote attacker could exploit this vulnerability to shut down the system.


Umlet version < 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can result in disclosure of confidential data denial of service server side request forgery. This attack appear to be exploitable via Specially crafted UXF file. This vulnerability appears to have been fixed in 14.3.


OpenFlow version 1.0 onwards contains a Denial of Service and Improper authorization vulnerability in OpenFlow handshake: The DPID (DataPath IDentifier) in the features_reply message are inherently trusted by the controller. that can result in Denial of Service Unauthorized Access Network Instability. This attack appear to be exploitable via Network connectivity: the attacker must first establish a transport connection with the OpenFlow controller and then initiate the OpenFlow handshake.


Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted XML file. This vulnerability appears to have been fixed in after commit 4974a26.