Memory leak in Gadu-Gadu 7.20 allows remote attackers to cause a denial of service via multiple DCC packets with a code other than 2 and a large size field which allocates memory for the packet but does not free it after the packet has been dropped.


The installation of Trend Micro PC-Cillin Internet Security 2005 12.00 build 1244 and probably previous versions uses insecure default ACLs which allows local users to cause a denial of service (disabled service) and gain system privileges by modifying or moving critical program files.


Memory leak in the icmp_push_reply function in Linux 2.6 before 2.6.12.6 and 2.6.13 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted packets that cause the ip_append_data function to fail aka \DST leak in icmp_push_reply.\


The audit system in Linux kernel 2.6.6 and other versions before 2.6.13.4 when CONFIG_AUDITSYSCALL is enabled uses an incorrect function to free names_cache memory which prevents the memory from being tracked by AUDITSYSCALL code and leads to a memory leak that allows attackers to cause a denial of service (memory consumption).


Gadu-Gadu 7.20 allows remote attackers to cause a denial of service (crash and configuration loss) via a page with a large number of gg: URIs.


Macromedia Breeze Communication Server and Breeze Live Server does 5.1 and earlier not sufficiently validate certain RTMP data which allows attackers to cause a denial of service (instability or crash) as demonstrated using an alpha release build of Flash Player 8.5 (build 133).


httpAdapter.c in sblim-sfcb before 0.9.2 allows remote attackers to cause a denial of service via long HTTP headers.


The Internet Key Exchange version 1 (IKEv1) implementation in Stonesoft StoneGate Firewall before 2.6.1 allows remote attackers to cause a denial of service via certain crafted IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the Stonesoft advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


The IPv6 flow label handling code (ip6_flowlabel.c) in Linux kernels 2.4 up to 2.4.32 and 2.6 before 2.6.14 modifies the wrong variable in certain circumstances which allows local users to corrupt kernel memory or cause a denial of service (crash) by triggering a free of non-allocated memory.


Battle Carry .005 and earlier allows remote attackers to cause a denial of service (inaccessible port) via a large packet which triggers a socket error and terminates the socket that is listening on the server's UDP port.


Cisco PIX 6.3 and 7.0 allows remote attackers to cause a denial of service (blocked new connections) via spoofed TCP packets that cause the PIX to create embryonic connections that that would not produce a valid connection with the end system including (1) SYN packets with invalid checksums which do not result in a RST; or from an external interface (2) one byte of \meaningless data \ or (3) a TTL that is one less than needed to reach the internal destination.


Hitachi IP5000 VOIP WIFI Phone 1.5.6 does not allow the user to disable access to (1) SNMP or (2) TCP port 3390 which allows remote attackers to modify configuration using CVE-2005-3722 or access the Unidata Shell to obtain sensitive information or cause a denial of service.


Unspecified vulnerability in in.named in Solaris 9 allows attackers to cause a denial of service via unknown manipulations that cause in.named to \make unnecessary queries.\


Gadu-Gadu 7.20 allows remote attackers to cause a denial of service via multiple DCC packets with a code of 6 or 7 which triggers a large number of popup windows to the user and creates a large number of threads.


Xpdf as used in products such as gpdf kpdf pdftohtml poppler teTeX CUPS libextractor and others allows attackers to cause a denial of service (infinite loop) via streams that end prematurely as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams aka \Infinite CPU spins.\


Microsoft Internet Explorer 5.2.3 for Mac OS allows remote attackers to cause a denial of service (crash) via a web page with malformed attributes in a BGSOUND tag possibly involving double-quotes in an about: URI.


Unknown vulnerability in the login page for HP Systems Insight Manager (SIM) 4.0 and 4.1 when accessed by Microsoft Internet Explorer with the MS04-025 patch leads to a denial of service (browser hang). NOTE: although the advisory is vague this issue does not appear to involve an attacker at all. If not then this issue is not a vulnerability.


fs/exec.c in Linux 2.6 when one thread is tracing another thread that shares the same memory map might allow local users to cause a denial of service (deadlock) by forcing a core dump when the traced thread is in the TASK_TRACED state.


The FWDRV driver in Kerio Personal Firewall 4.2 and Server Firewall 1.1.1 allows local users to cause a denial of service (crash) by setting the PAGE_NOACCESS or PAGE_GUARD protection on the Page Environment Block (PEB) which triggers an exception aka the \PEB lockout vulnerability.\


Unspecified vulnerability in MyBulletinBoard (MyBB) before 1.0 PR2 Rev 686 allows attackers to cause a denial of service via unknown vectors.


The automatic update feature in Google Talk allows remote attackers to cause a denial of service (CPU and memory consumption) by poisoning a target's DNS cache and causing a large update file to be sent which consumes large amounts of CPU and memory during the signature verification aka BenjiBug.


db2fmp process in IBM DB2 Content Manager before 8.2 Fix Pack 10 allows local users to cause a denial of service (CPU consumption) by importing a corrupted Microsoft Excel file aka \CORRUPTED EXEL FILE WILL CAUSE TEXT SEARCH PROCESS LOOPING.\


Linux kernel before 2.6.15 allows local users to cause a denial of service (panic) via a set_mempolicy call with a 0 bitmask which causes a panic when a page fault occurs.


The IRC protocol dissector in Ethereal 0.10.13 allows remote attackers to cause a denial of service (infinite loop).


Unspecified vulnerability in Squid on SUSE Linux 9.0 allows remote attackers to cause a denial of service (crash) via HTTPs (SSL).


The network interface for Apple AirPort Express 6.x before Firmware Update 6.3 and AirPort Extreme 5.x before Firmware Update 5.7 allows remote attackers to cause a denial of service (unresponsive interface) via malformed packets.


Multiple unspecified vulnerabilities in the Internet Key Exchange version 1 (IKEv1) implementation in HP HP-UX B.11.00 B.11.11 and B.11.23 running IPSec HP Jetdirect 635n IPv6/IPsec Print Server and HP Tru64 UNIX 5.1B-3 and 5.1B-2/PK4 allow remote attackers to cause a denial of service via certain IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the HP advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


The time_out_leases function in locks.c for Linux kernel before 2.6.15-rc3 allows local users to cause a denial of service (kernel log message consumption) by causing a large number of broken leases which is recorded to the log using the printk function.


Zyxel P2000W Version 1 VOIP WIFI Phone Wj.00.10 uses hardcoded IP addresses for its DNS servers which could allow remote attackers to cause a denial of service or hijack Zyxel phones by attacking or spoofing the hardcoded DNS servers. NOTE: it could be argued that this issue reflects an inherent limitation of DNS itself so perhaps it should not be included in CVE.


The mq_open system call in Linux kernel 2.6.9 in certain situations can decrement a counter twice (\double decrement\) as a result of multiple calls to the mntput function when the dentry_open function call fails which allows local users to cause a denial of service (panic) via unspecified attack vectors.


Unspecified vulnerability in Unix File System (UFS) on Solaris 8 and 9 when logging is enabled allows local users to cause a denial of service (\soft hang\) via certain write operations to UFS.


Apple Safari 2.0.2 allows remote attackers to cause a denial of service (system slowdown) via a Javascript BODY onload event that calls the window function.


nsrd.exe in EMC Legato NetWorker 7.1.x before 7.1.4 and 7.2.x before 7.2.1.Build.314 and other products such as Sun Solstice Backup (SBU) 6.0 and 6.1 and StorEdge Enterprise Backup Software (EBS) 7.1 through 7.2L allows remote attackers to cause a denial of service (nsrd service crash) via a malformed RPC request to RPC program number 390109 which triggers a null dereference.


Memory leak in Avaya TN2602AP IP Media Resource 320 circuit pack before vintage 9 firmware allows remote attackers to cause a denial of service (memory consumption) via crafted VoIP packets.


Cisco IP Phone (VoIP) 7920 1.0(8) listens to UDP port 17185 to support a VxWorks debugger which allows remote attackers to obtain sensitive information and cause a denial of service.


Kadu 0.4.2 and 0.5.0pre allows remote attackers to cause a denial of service (crash or generated traffic) via a malformed message possibly with incomplete information.


The tnef_attachment function in tnef.c for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block.


The ptrace functionality (ptrace.c) in Linux kernel 2.6 before 2.6.14.2 using CLONE_THREAD does not use the thread group ID to check whether it is attaching to itself which allows local users to cause a denial of service (crash).


The apache2handler SAPI (sapi_apache2.c) in the Apache module (mod_php) for PHP 5.x before 5.1.0 final and 4.4 before 4.4.1 final allows attackers to cause a denial of service (segmentation fault) via the session.save_path option in a .htaccess file or VirtualHost.


The Internet Key Exchange version 1 (IKEv1) implementation in the libike library in Sun Solaris 9 and 10 allows remote attackers to cause a denial of service (in.iked crash) via certain crafted IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


The forms servlet (f90servlet) in Oracle Forms 4.5.10.22 allows remote attackers to cause a denial of service (TNS listener stop) via a userid parameter that contains a STOP command.


The HFS and HFS+ (hfsplus) modules in Linux 2.6 allow attackers to cause a denial of service (oops) by using hfsplus to mount a filesystem that is not hfsplus.


index.php in ActiveCampaign KnowledgeBuilder 2.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an invalid category parameter which causes a large number of SQL queries to be processed.


Multiple vulnerabilities in Linux kernel before 2.6.13.2 allow local users to cause a denial of service (kernel OOPS from null dereference) via (1) fput in a 32-bit ioctl on 64-bit x86 systems or (2) sockfd_put in the 32-bit routing_ioctl function on 64-bit systems.


Linux kernel 2.4 and 2.6 allows attackers to cause a denial of service (memory exhaustion and panic) by creating a large number of connected file descriptors or socketpairs and setting a large data transfer buffer then preventing Linux from being able to finish the transfer by causing the process to become a zombie or closing the file descriptor without closing an associated reference.


The rfc1738_do_escape function in ftp.c for Squid 2.5 STABLE11 and earlier allows remote FTP servers to cause a denial of service (segmentation fault) via certain \odd\ responses.


The handle_stop_signal function in signal.c in Linux kernel 2.6.11 up to other versions before 2.6.13 and 2.6.12.6 allows local users to cause a denial of service (deadlock) by sending a SIGKILL to a real-time threaded process while it is performing a core dump.


The mprotect code (mprotect.c) in Linux 2.6 on Itanium IA64 Montecito processors does not properly maintain cache coherency as required by the architecture which allows local users to cause a denial of service and possibly corrupt data by modifying PTE protections.


Exec in Linux kernel 2.6 does not properly clear posix-timers in multi-threaded environments which results in a resource leak and could allow a large number of multiple local users to cause a denial of service by using more posix-timers than specified by the quota for a single user.


Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.


(1) Java Runtime Environment (JRE) and (2) Software Development Kit (SDK) 1.4.2_08 1.4.2_09 and 1.5.0_05 and possibly other versions allow remote attackers to cause a denial of service (JVM unresponsive) via a crafted serialized object such as a font object as demonstrated on JBoss.


ip_conntrack_proto_icmp.c in ctnetlink in Linux kernel 2.6.14 up to 2.6.14.3 allows attackers to cause a denial of service (kernel oops) via a message without ICMP ID (ICMP_ID) information which leads to a null dereference.


The BER dissector in Ethereal 0.10.3 to 0.10.12 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.


Linux kernel before after 2.6.12 and before 2.6.13.1 might allow attackers to cause a denial of service (Oops) via certain IPSec packets that cause alignment problems in standard multi-block cipher processors. NOTE: it is not clear whether this issue can be triggered by an attacker.


The SynAttackProtect protection in Microsoft Windows 2003 before SP1 and Windows 2000 before SP4 with Update Roll-up uses a hash of predictable data which allows remote attackers to cause a denial of service (CPU consumption) via a flood of SYN packets that produce identical hash values which slows down the hash table lookups.


Unspecified vulnerability in \edit submission handling\ for MediaWiki 1.4.x before 1.4.10 and 1.3.x before 1.3.16 allows remote attackers to cause a denial of service (corruption of the previous submission) via a crafted URL.


Multi-Computer Control System (MCCS) 1.0 allows remote attackers to cause a denial of service via a malformed UDP packet.


Firefox 1.0.6 allows attackers to cause a denial of service (crash) via a Proxy Auto-Config (PAC) script that uses an eval statement. NOTE: it is not clear whether an untrusted party has any role in triggering this issue so it might not be a vulnerability.


Multiple vulnerabilities in Ethereal 0.10.12 and earlier allow remote attackers to cause a denial of service (memory consumption) via unspecified vectors in the (1) ISAKMP (2) FC-FCS (3) RSVP and (4) ISIS LSP dissector.


The nfattr_to_tcp function in ip_conntrack_proto_tcp.c in ctnetlink in Linux kernel 2.6.14 up to 2.6.14.3 allows attackers to cause a denial of service (kernel oops) via an update message without private protocol information which triggers a null dereference.


Hasbani Web Server (WindWeb) 2.0 allows remote attackers to cause a denial of service (infinite loop) via HTTP crafted GET requests.


Linux kernel 2.6.8 to 2.6.14-rc2 allows local users to cause a denial of service (kernel OOPS) via a userspace process that issues a USB Request Block (URB) to a USB device and terminates before the URB is finished which leads to a stale pointer reference.


Scrubber.py in Mailman 2.1.5-8 does not properly handle UTF8 character encodings in filenames of e-mail attachments which allows remote attackers to cause a denial of service (application crash).


centericq 4.20.0-r3 with \Enable peer-to-peer communications\ set allows remote attackers to cause a denial of service (segmentation fault and crash) via short zero-length packets and possibly packets of length 1 or 2 as demonstrated using Nessus.


Senao SI-680H Wireless VoIP Phone Firmware 0.03.0839 leaves the VxWorks debugger UDP port 17185 available without authentication which allows attackers to access the phone OS obtain sensitive information and cause a denial of service.


The Internet Key Exchange version 1 (IKEv1) implementation in Openswan 2 (openswan-2) before 2.4.4 and freeswan in SUSE LINUX 9.1 before 2.04_1.5.4-1.23 allow remote attackers to cause a denial of service via (1) a crafted packet using 3DES with an invalid key length or (2) unspecified inputs when Aggressive Mode is enabled and the PSK is known as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.


Scorched 3D 39.1 (bf) and earlier allows remote attackers to cause a denial of service (long loop and server hang) via a negative numplayers value that bypasses a signed check in ServerConnectHandler.cpp.


Zyxel P2000W Version 1 VOIP WIFI Phone Wj.00.10 allows remote attackers to obtain sensitive information and possibly cause a denial of service via a direct connection to UDP port 9090 which is undocumented and does not require authentication.


nuauth in NuFW 1.0.x before 1.0.16 and 1.1 allows authenticated users to cause a denial of service via malformed packets.


Multiple unspecified vulnerabilities in the Internet Key Exchange version 1 (IKEv1) implementation in multiple Cisco products allow remote attackers to cause a denial of service (device reset) via certain malformed IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the Cisco advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


A locking problem in POSIX timer cleanup handling on exit in Linux kernel 2.6.10 to 2.6.14 when running on SMP systems allows local users to cause a denial of service (deadlock) involving process CPU timers.


The cabd_find function in cabd.c of the libmspack library (mspack) for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted CAB file that causes cabd_find to be called with a zero length.


The exif_read_data function in the Exif module in PHP before 4.4.1 allows remote attackers to cause a denial of service (infinite loop) via a malformed JPEG image.


PNP_GetDeviceList (upnp_getdevicelist) in UPnP for Microsoft Windows 2000 SP4 and earlier and possibly Windows XP SP1 and earlier allows remote attackers to cause a denial of service (memory consumption) via a DCE RPC request that specifies a large output buffer size a variant of CVE-2006-6296 and a different vulnerability than CVE-2005-2120.


iSQL*Plus (isqlplus) for Oracle9i Database Server Release 2 9.0.2.4 allows remote attackers to cause a denial of service (TNS listener stop) via an HTTP request with an sid parameter that contains a STOP command.


The Transmission Control Protocol (TCP) allows remote attackers to cause a denial of service (bandwidth consumption) by sending ACK messages for packets that have not yet been received (optimistic ACKs) which can cause the sender to increase its transmission rate until it fills available bandwidth.


mm/ioremap.c in Linux 2.6 on 64-bit x86 systems allows local users to cause a denial of service or an information leak via an ioremap on a certain memory map that causes the iounmap to perform a lookup of a page that does not exist.


Memory leak in the seq_file implementation in the SCSI procfs interface (sg.c) in Linux kernel 2.6.13 and earlier allows local users to cause a denial of service (memory consumption) via certain repeated reads from the /proc/scsi/sg/devices file which is not properly handled when the next() iterator returns NULL or an error.


The find_target function in ptrace32.c in the Linux kernel 2.4.x before 2.4.29 does not properly handle a NULL return value from another function which allows local users to cause a denial of service (kernel crash/oops) by running a 32-bit ltrace program with the -i option on a 64-bit executable program.


The search_binary_handler function in exec.c in Linux 2.4 kernel on 64-bit x86 architectures does not check a return code for a particular function call when virtual memory is low which allows local users to cause a denial of service (panic) as demonstrated by running a process using the bash ulimit -v command.


OpenVPN before 2.0.1 when running with \verb 0\ and without TLS authentication does not properly flush the OpenSSL error queue when a client fails certificate authentication to the server and causes the error to be processed by the wrong client which allows remote attackers to cause a denial of service (client disconnection) via a large number of failed authentication attempts.


The KEYCTL_JOIN_SESSION_KEYRING operation in the Linux kernel before 2.6.12.5 contains an error path that does not properly release the session management semaphore which allows local users or remote attackers to cause a denial of service (semaphore hang) via a new session keyring (1) with an empty name string (2) with a long name string (3) with the key quota reached or (4) ENOMEM.


Soldier of Fortune II 1.02x and 1.03 allows remote attackers to cause a denial of service (server crash) via a large ID value in the ignore command which is used as an array index and causes an out-of-bounds operation.


Cisco ONS 15216 Optical Add/Drop Multiplexer (OADM) running firmware 2.2.2 and earlier allows remote attackers to cause a denial of service (management plane session loss) via crafted telnet data.


Net-SNMP 5.0.x before 5.0.10.2 5.2.x before 5.2.1.2 and 5.1.3 when net-snmp is using stream sockets such as TCP allows remote attackers to cause a denial of service (daemon hang and CPU consumption) via a TCP packet of length 1 which triggers an infinite loop.


libungif library before 4.1.0 allows attackers to cause a denial of service via a crafted GIF file that triggers a null dereference.


Research in Motion (RIM) BlackBerry Router allows remote attackers to cause a denial of service (communication disruption) via crafted Server Routing Protocol (SRP) packets.


The ipt_recent kernel module (ipt_recent.c) in Linux kernel before 2.6.12 when running on 64-bit processors such as AMD64 allows remote attackers to cause a denial of service (kernel panic) via certain attacks such as SSH brute force which leads to memset calls using a length based on the u_int32_t type acting on an array of unsigned long elements a different vulnerability than CVE-2005-2873.


The (1) clcs and (2) emuxki drivers in NetBSD 1.6 through 2.0.2 allow local users to cause a denial of service (kernel crash) by using the set-parameters ioctl on an audio device to change the block size and set the pause state to \unpaused\ in the same ioctl which causes a divide-by-zero error.


Memory leak in the worker MPM (worker.c) for Apache 2 in certain circumstances allows remote attackers to cause a denial of service (memory consumption) via aborted connections which prevents the memory for the transaction pool from being reused for other connections.


nss_ldap 181 to versions before 213 as used in Mandrake Corporate Server and Mandrake 10.0 and other operating systems does not properly handle a SIGPIPE signal when sending a search request to an LDAP directory server which might allow remote attackers to cause a denial of service (crond and other application crash) if they can cause an LDAP server to become unavailable. NOTE: it is not clear whether this attack scenario is sufficient to include this item in CVE.


Linksys WRT54G router allows remote attackers to cause a denial of service (CPU consumption and server hang) via an HTTP POST request with a negative Content-Length value.


The IMAP server in IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before 2.02 allows remote attackers to cause a denial of service (crash) via a long argument to the LIST command which causes IMail Server to reference invalid memory.


Cisco Security Agent (CSA) 4.5 allows remote attackers to cause a denial of service (system crash) via a crafted IP packet.


slocate before 2.7 does not properly process very long paths which allows local users to cause a denial of service (updatedb exit and incomplete slocate database) via a certain crafted directory structure.


The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.


io-xpm.c in the gdk-pixbuf XPM image rendering library in GTK+ before 2.8.7 allows attackers to cause a denial of service (infinite loop) via a crafted XPM image with a large number of colors.


FTPshell Server 3.38 allows remote authenticated users to cause a denial of service (application crash) by multiple connections and disconnections without using the QUIT command.


The rw_vm function in usercopy.c in the 4GB split patch for the Linux kernel in Red Hat Enterprise Linux 4 does not perform proper bounds checking which allows local users to cause a denial of service (crash).


Ventrilo 2.1.2 through 2.3.0 allows remote attackers to cause a denial of service (application crash) via a status packet that contains less data than specified in the packet header sent to UDP port 3784.


Research in Motion (RIM) BlackBerry Handheld web browser for BlackBerry Handheld before 4.0.2 allows remote attackers to cause a denial of service (hang) via a Java Application Description (JAD) file with a long application name and vendor string which prevents a browser dialog from being properly dismissed.


Squid 2.5.STABLE10 and earlier while performing NTLM authentication does not properly handle certain request sequences which allows attackers to cause a denial of service (daemon restart).


Wyse Winterm 1125SE running firmware 4.2.09f or 4.4.061f allows remote attackers to cause a denial of service (device crash) via a packet with a zero in the IP option length field.


Cisco CallManager (CCM) 3.2 and earlier 3.3 before 3.3(5) 4.0 before 4.0(2a)SR2b and 4.1 4.1 before 4.1(3)SR1 does not quickly time out Realtime Information Server Data Collection (RISDC) sockets which results in a \resource leak\ that allows remote attackers to cause a denial of service (memory and connection consumption) in RisDC.exe.


BisonFTP Server V4R1 allows remote authenticated users to cause a denial of service via an invalid command with a long argument.


The sslConnectTimeout function in ssl.c for Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service (segmentation fault) via certain crafted requests.


The sysctl functionality (sysctl.c) in Linux kernel before 2.6.14.1 allows local users to cause a denial of service (kernel oops) and possibly execute code by opening an interface file in /proc/sys/net/ipv4/conf/ waiting until the interface is unregistered then obtaining and modifying function pointers in memory that was used for the ctl_table.


Unknown vulnerability in CIFS.NLM in Novell Netware 6.5 SP2 and SP3 5.1 and 6.0 allows remote attackers to cause a denial of service (ABEND) via an incorrect password length as exploited by the \worm.rbot.ccc\ worm.


Microsoft Front Page allows attackers to cause a denial of service (crash) via a crafted style tag in a web page.


Unknown vulnerability several dissectors in Ethereal 0.9.0 through 0.10.11 allows remote attackers to cause a denial of service (application crash) by reassembling certain packets.


The Linux kernel before 2.6.12.5 does not properly destroy a keyring that is not instantiated properly which allows local users or remote attackers to cause a denial of service (kernel oops) via a keyring with a payload that is not empty which causes the creation to fail leading to a null dereference in the keyring destructor.


Multiple \endianness errors\ in libgadu in ekg before 1.6rc2 allow remote attackers to cause a denial of service (invalid behavior in applications) on big-endian systems.


The ClamAV Mail fILTER (clamav-milter) 0.84 through 0.85d when used in Sendmail using long timeouts allows remote attackers to cause a denial of service by keeping an open connection which prevents ClamAV from reloading.


Mozilla 1.7.8 Firefox 1.0.4 Camino 0.8.4 Netscape 8.0.2 and K-Meleon 0.9 and possibly other products that use the Gecko engine allow remote attackers to cause a denial of service (application crash) via JavaScript that repeatedly calls an empty function.


Quick 'n Easy FTP Server 3.0 allows remote attackers to cause a denial of service (application crash or CPU consumption) via a long USER command.


Microsoft MSN Messenger 9.0 and Internet Explorer 6.0 allows remote attackers to cause a denial of service (crash) via an image with an ICC Profile with a large Tag Count.


The AIM/ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) via a filename that contains invalid UTF-8 characters.


Microsoft MSN Messenger allows remote attackers to cause a denial of service via a plaintext message containing the \.pif\ string which is interpreted as a malicious file extension and causes users to be kicked from a group conversation. NOTE: it has been reported that Gaim is also affected so this may be an issue in the protocol or MSN servers.


Polygen before 1.0.6 generates precompiled grammar objects with world-writable permissions which allows local users to cause a denial of service (disk consumption) and possibly perform other unauthorized activities.


Multiple \memory alignment errors\ in libgadu as used in ekg before 1.6rc2 Gaim before 1.5.0 and other packages allows remote attackers to cause a denial of service (bus error) on certain architectures such as SPARC via an incoming message.


xpdf and kpdf do not properly validate the \loca\ table in PDF files which allows local users to cause a denial of service (disk consumption and hang) via a PDF file with a \broken\ loca table which causes a large temporary file to be created when xpdf attempts to reconstruct the information.


Unknown vulnerability in Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05 1.07 before Build 220_13 and 1.11 before Build 29_13 allows attackers to cause a denial of service via unknown vectors aka the \CAM TCP port vulnerability.\


Memory leak in inetinfo.exe in Cisco CallManager (CCM) 3.2 and earlier 3.3 before 3.3(5) 4.0 before 4.0(2a)SR2b and 4.1 4.1 before 4.1(3)SR1 when Multi Level Admin (MLA) is enabled allows remote attackers to cause a denial of service (memory consumption) via a large number of Admin Service Tool (AST) logins that fail.


PrivaShare 1.1b allows remote attackers to cause a denial of service (crash) via a malformed message.


The udp_v6_get_port function in udp.c in Linux 2.6 before 2.6.14-rc5 when running IPv6 allows local users to cause a denial of service (infinite loop and crash).


Domain Name Relay Daemon (DNRD) before 2.19.1 allows remote attackers to cause a denial of service (infinite recursion) via a DNS packet that uses message compression in the QNAME and two pointers that point to each other (circular buffer).


store.c in Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service (crash) via certain aborted requests that trigger an assert error related to STORE_PENDING.


WebEOC before 6.0.2 does not properly restrict the size of an uploaded file which allows remote authenticated users to cause a denial of service (system and database resource consumption) via a large file.


mshftp.dll in PlanetDNS PlanetFileServer 2.0.1.3 allows remote attackers to cause a denial of service (application crash) via a long request.


vlan_dev.c in the VLAN code for Linux kernel 2.6.8 allows remote attackers to cause a denial of service (kernel oops from null dereference) via certain UDP packets that lead to a function call with the wrong argument as demonstrated using snmpwalk on snmpd.


The LCF component (lcfd) in IBM Tivoli Management Framework Endpoint allows remote attackers to cause a denial of service (process exit and connection loss) by connecting to LCF and ending the connection without sending any data.


Mutt before 1.5.20 patch 7 allows an attacker to cause a denial of service via a series of requests to mutt temporary files.


Unknown vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265 332 and 340 420 through 490 and 535 through 555 allows remote attackers to cause a denial of service or read files via unknown vectors involving crafted HTTP requests.


OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server which allows remote authenticated attackers to cause a denial of service (client disconnection) via a large number of packets that can not be decrypted.


NDMP server in Veritas NetBackup 5.1 allows attackers to cause a denial of service via a CONFIG message with an out-of-range timestamp which triggers a null dereference.


libclamav/fsg.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to cause a denial of service (infinite loop) via a crafted FSG packed executable.


The raw_sendmsg function in the Linux kernel 2.6 before 2.6.13.1 allows local users to cause a denial of service (change hardware state) or read from arbitrary memory via crafted input.


Apple Safari 1.3 (132) on Mac OS X 1.3.9 allows remote attackers to cause a denial of service (crash) via certain Javascript possibly involving a function that defines a handler for itself within the function body.


libtiff up to 3.7.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image header with a zero \YCbCr subsampling\ value which causes a divide-by-zero error in (1) tif_strip.c and (2) tif_tile.c a different vulnerability than CVE-2004-0804.


The LDAP server (nldap.exe) in IBM Lotus Domino before 7.0.1 6.5.5 and 6.5.4 FP2 allows remote attackers to cause a denial of service (crash) via a long bind request which triggers a null dereference.


Unknown vulnerability in the (1) AgentX dissector (2) PER dissector (3) DOCSIS dissector (4) SCTP graphs (5) HTTP dissector (6) DCERPC (7) DHCP (8) RADIUS dissector (9) Telnet dissector (10) IS-IS LSP dissector or (11) NCP dissector in Ethereal 0.8.19 through 0.10.11 allows remote attackers to cause a denial of service (application crash or abort) via unknown attack vectors.


Vipul Razor Agents (razor-agents) before 2.70 allows remote attackers to cause a denial of service via (1) certain \unusual HTML messages\ or (2) \certain malformed headers\ such as Content-Type.


Zebedee 2.4.1 when \allowed redirection port\ is not set allows remote attackers to cause a denial of service (application crash) via a zero in the port number of the protocol option header which triggers an assert error in the makeConnection function in zebedee.c.


The driver for compressed ISO file systems (zisofs) in the Linux kernel before 2.6.12.5 allows local users and remote attackers to cause a denial of service (kernel crash) via a crafted compressed ISO file system.


client.cpp in BNBT EasyTracker 7.7r3.2004.10.27 and earlier allows remote attackers to cause a denial of service (application hang) via an HTTP header containing only a \:\ (colon) possibly leading to an integer signedness error due to a missing field name or value.


RPC portmapper (rpcbind) in SCO UnixWare 7.1.1 m5 7.1.3 mp5 and 7.1.4 mp2 allows remote attackers or local users to cause a denial of service (lack of response) via multiple invalid portmap requests.


The Quantum archive decompressor in Clam AntiVirus (ClamAV) before 0.86.1 allows remote attackers to cause a denial of service (application crash) via a crafted Quantum archive.


aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a crafted SOAP message to an RPC/Encoded method.


BFCommand & Control Server Manager BFCC 1.22_A and earlier and BFVCC 2.14_B and earlier allows remote attackers to cause a denial of service (refused new connections) via a series of connections and disconnections without sending the login command.


Grandstream BudgeTone 101 and 102 running firmware 1.0.6.7 and possibly earlier versions allows remote attackers to cause a denial of service (device hang or reboot) via a large UDP packet to port 5060.


Cisco CallManager (CCM) 3.2 and earlier 3.3 before 3.3(5) 4.0 before 4.0(2a)SR2b and 4.1 4.1 before 4.1(3)SR1 allows remote attackers to cause a denial of service (memory consumption and restart) via crafted packets to (1) the CTI Manager (ctimgr.exe) or (2) the CallManager (ccm.exe).


Apple QuickTime Player before 7.0.3 allows user-assisted attackers to cause a denial of service (crash) via a crafted file with a missing movie attribute which leads to a null dereference.


The is_path_absolute function in scheduler/client.c for the daemon in CUPS before 1.1.23 allows remote attackers to cause a denial of service (CPU consumption by tight loop) via a \..\\..\ URL in an HTTP request.


Mentor ADSL-FR4II router running firmware 2.00.0111 allows remote attackers to cause a denial of service (active TCP connections state table consumption) via a large number of connections such as a port scan.


The Outlook Express Address Book control when using Internet Explorer 6 allows remote attackers to cause a denial of service (NULL dereference and browser crash) by creating the OutlookExpress.AddressBook COM object which is not intended for use within Internet Explorer.


Unspecified vulnerability in Report Application Server (Crystalras.exe) before 11.0.0.1370 as used in Business Objects Crystal Reports XI Crystal Reports Server XI and BusinessObjects Enterprise XI allows remote attackers to cause a denial of service (application hang) via certain network traffic possibly involving multiple simultaneous TCP connections.


Westell Versalink 327W allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports and with the SYN flag set (aka LanD). NOTE: the provenance of this issue is unknown; the details are obtained solely from third party information.


Unspecified vulnerability in Hitachi Cosminexus Collaboration Portal 06-00 through 06-10-/B Groupmax Collaboration Portal 07-00 through 07-10-/B and Groupmax Collaboration Web Client 07-00 through 07-10-/A allow remote attackers to cause a denial of service of unspecified impact via repeated invalid requests to the Schedule component.


BZFlag server 2.0.4 and earlier allows remote attackers to cause a denial of service (application crash) via a callsign that is not followed by a NULL (\\0) character.


Cisco IP Phones 7902/7905/7912 ATA 186/188 Unity Express ACNS and Subscriber Edge Services Manager (SESM) allows remote attackers to cause a denial of service (crash or instability) via a compressed DNS packet with a label length byte with an incorrect offset.


The CLSID_ApprenticeICW control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID which is not intended for use within Internet Explorer.


Unspecified vulnerability in the VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(22)EA3 on Catalyst 2950T switches allows remote attackers to cause a denial of service (device reboot) via a crafted Subset-Advert message packet a different issue than CVE-2006-4774 CVE-2006-4775 and CVE-2006-4776.


HP-UX B.11.00 B.11.04 B.11.11 and B.11.23 allows remote attackers to cause a denial of service via a \Rose Attack\ that involves sending a subset of small IP fragments that do not form a complete larger packet.


Unspecified vulnerability in the SQL logging facility in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors probably involving the pam_mysql_sql_log function when being used in vsftpd which does not include the IP address argument to an sprintf call.


NWFTPD.nlm before 5.06.04 in the FTP server in Novell NetWare allows remote attackers to cause a denial of service (excessive stale connections) by establishing many FTP sessions which persist in the Not-Logged-In state after each session is completed.


The m_join function in channel.c for PTnet ircd 1.5 and 1.6 allows remote attackers to cause a denial of service (memory exhaustion that triggers a daemon restart) via a large number of requests to join a \charmed channel\ such as PTnet #PTnoticias and #*.log which causes ircd to open the channel even though it does not have any valid users.


Linksys WRT54GS and BEFW11S4 allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports and with the SYN flag set (aka LAND). NOTE: the provenance of this issue is unknown; the details are obtained solely from the BID.


Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a Windows 2000 SP4 Windows XP SP1 Windows XP SP2 and Windows Server 2003 SP1 allows remote attackers to cause a denial of service (client crash) via a certain combination of a malformed HTML file and a CSS file that triggers a null dereference probably related to rendering of a DIV element that contains a malformed IMG tag as demonstrated by IEcrash.htm and IEcrash.rar.


AppServ Open Project 2.5.3 allows remote attackers to cause a denial of service via a large HTTP request.


D-Link DI-524 Wireless Router DI-624 Wireless Router and DI-784 allow remote attackers to cause a denial of service (device reboot) via a series of crafted fragmented UDP packets possibly involving a missing fragment.


Unspecified vulnerability in WBEM Services A.01.x before A.01.05.12 and A.02.x before A.02.00.08 on HP-UX B.11.00 through B.11.23 allows remote attackers to cause an unspecified denial of service via unknown attack vectors.


fetchmail before 6.3.1 and before 6.2.5.5 when configured for multidrop mode allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.


Drivers for certain display adapters including (1) an unspecified ATI driver and (2) an unspecified Intel driver might allow remote attackers to cause a denial of service (system crash) via a large JPEG image as demonstrated in Internet Explorer using stoopid.jpg with a width and height of 9999999.


Hitachi TP1/Server Base and TP1/NET/Library 2 on IBM AIX allow remote attackers to (1) cause a denial of service (OpenTP1 system outage) via invalid data to a port used by a system-server process and (2) cause a denial of service (process failure) via invalid data to a port used by any of certain other processes.


The Internet Key Exchange version 1 (IKEv1) implementation in ADTRAN NetVanta before 10.03.03.E might allow remote attackers to cause a denial of service via crafted IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.


snmp_api.c in snmpd in Net-SNMP 5.2.x before 5.2.2 5.1.x before 5.1.3 and 5.0.x before 5.0.10.2 when running in master agentx mode allows remote attackers to cause a denial of service (crash) by causing a particular TCP disconnect which triggers a free of an incorrect variable a different vulnerability than CVE-2005-2177.


NetBSD 2.0 before 20050316 and NetBSD-current before 20050112 allow local users to cause a denial of service (infinite loop and system hang) by calling the F_CLOSEM fcntl with a parameter value of 0.


The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID which is not intended for use within Internet Explorer.


Motorola SB5100E Cable Modem allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports and with the SYN flag set (aka LAND).


The SISCO OSI stack for Windows as used by MMS-EASE 7.10 and earlier AX-S4 MMS 5.01 and earlier AX-S4 ICCP 3.0103 and earlier and the ICCP Toolkit for MMS-EASE 4.10 and earlier allows remote attackers to cause a denial of service (process crash) via certain network traffic as demonstrated using a Nessus scan.


The nl_fib_input function in fib_frontend.c in the Linux kernel before 2.6.15 does not check for valid lengths of the header and payload which allows remote attackers to cause a denial of service (invalid memory reference) via malformed fib_lookup netlink messages.


Shared memory sections and events in IBM DB2 8.1 have default permissions of read and write for the Everyone group which allows local users to gain unauthorized access gain sensitive information such as cleartext passwords and cause a denial of service.


The Internet Key Exchange version 1 (IKEv1) implementations in Fortinet FortiOS 2.50 2.80 and 3.0 FortiClient 2.0 ; and FortiManager 2.80 and 3.0 allow remote attackers to cause a denial of service (termination of a process that is automatically restarted) via IKE packets with invalid values of certain IPSec attributes as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the vendor advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


Netgear RP114 and possibly other versions and devices allows remote attackers to cause a denial of service via a SYN flood attack between one system on the internal interface and another on the external interface which temporarily stops routing between the interfaces as demonstrated using nmap.


The Java Plug-in 1.4.2_03 and 1.4.2_04 controls and the 1.4.2_03 and 1.4.2_04 <applet> redirector controls allow remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID which is not intended for use within Internet Explorer.


Gaim-Encryption 2.38-1 on Debian Linux allows remote attackers to cause a denial of service (crash) via a crafted message from an ICQ buddy possibly involving the GE_received_key function in keys.c.


BEA WebLogic Server and WebLogic Express 9.0 8.1 and 7.0 lock out the admin user account after multiple incorrect password guesses which allows remote attackers who know or guess the admin account name to cause a denial of service (blocked admin logins).


Ingate Firewall before 4.3.4 and SIParator before 4.3.4 allows remote attackers to cause a denial of service (kernel deadlock) by sending a SYN packet for a TCP stream which requires an RST packet in response.


MD5 Neighbor Authentication in Extended Interior Gateway Routing Protocol (EIGRP) 1.2 as implemented in Cisco IOS 11.3 and later does not include the Message Authentication Code (MAC) in the checksum which allows remote attackers to sniff message hashes and (1) replay EIGRP HELLO messages or (2) cause a denial of service by sending a large number of spoofed EIGRP neighbor announcements which results in an ARP storm on the local network.


IBM DB2 Universal Database (UDB) 820 before version 8 FixPak 10 (s050811) allows remote authenticated users to cause a denial of service (application crash) by using a table function for an instance of snapshot_tbreorg which triggers a trap in sqlnr_EStoE_action.


LogiSphere 0.9.9j does not restrict the number of messages that can be sent which allows remote attackers to cause a denial of service by sending a large number of messages via the msg command. NOTE: due to lack of appropriate details by the original researcher it is unclear whether this description accurately reflects the discloser's claim and is distinct from the XSS issue.


The khtml::RenderTableSection::ensureRows function in KHTMLParser in Apple Mac OS X 10.4.3 and earlier as used by Safari and TextEdit allows remote attackers to cause a denial of service (memory consumption and application crash) via HTML files with a large ROWSPAN attribute in a TD tag.


eZ publish 3.5 before 3.5.7 3.6 before 3.6.5 3.7 before 3.7.3 and 3.8 before 20051128 allows remote authenticated users to cause a denial of service (Apache httpd segmentation fault) via a request to content/advancedsearch.php with an empty SearchContentClassID parameter reportedly related to a \memory addressing error\.


upload.exe in eFileGo 3.01 allows remote attackers to cause a denial of service (CPU consumption) via an argument with an invalid directory name.


The SmartConnect Class control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID which is not intended for use within Internet Explorer.


Scientific Atlanta DPX2100 Cable Modem allows remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports and with the SYN flag set (aka LanD) as demonstrated using hping2. NOTE: the provenance of this issue is unknown; the details are obtained solely from third party information.


Microsoft Internet Explorer 7.0 Beta3 and earlier allows remote attackers to cause a denial of service (crash) via a \text/html\ HTML Content-type header sent in response to an XMLHttpRequest (AJAX).


Symantec Brightmail AntiSpam 6.0 build 1 and 2 allows remote attackers to cause a denial of service (bmserver component termination) via malformed MIME messages.


Opera 8.02 and earlier allows remote attackers to cause a denial of service (client crash) via (1) a crafted HTML file with a \content: url(0);\ style attribute a \bodyA\ tag a long string and a \u\ tag with a long attribute as demonstrated by opera.html; and (2) a BGSOUND element with a \margin:-99;\ STYLE attribute.


Unspecified Cisco Catalyst Switches allow remote attackers to cause a denial of service (device crash) via an IP packet with the same source and destination IPs and ports and with the SYN flag set (aka LanD). NOTE: the provenance of this issue is unknown; the details are obtained solely from the BID.


Juniper NetScreen-Security Manager (NSM) 2004 FP2 and FP3 allow remote attackers to cause a denial of service (crash or hang of server components that are automatically restarted) via a long crafted string on (1) port 7800 (the GUI Server port) or (2) port 7801 (the Device Server port).


Unspecified vulnerability in Mambo 4.5 (1.0.0) through 4.5 (1.0.9) with magic_quotes_gpc disabled allows remote attackers to read arbitrary files and possibly cause a denial of service via a query string that ends with a NULL character.


mshtml.dll in Microsoft Windows XP Server 2003 and Internet Explorer 6.0 SP1 allows attackers to cause a denial of service (access violation) by causing mshtml.dll to process button-focus events at the same time that a document is reloading as seen in Microsoft Office InfoPath 2003 by repeatedly clicking the \Delete\ button in a repeating section in a form. NOTE: the normal operation of InfoPath appears to involve a local user without any privilege boundaries so this might not be a vulnerability in InfoPath. If no realistic scenarios exist for this problem in other products then perhaps it should be excluded from CVE.


IBM DB2 Universal Database (UDB) 810 before 8.1 FP10 allows remote authenticated users to cause a denial of service (application crash) via (1) certain equality predicates that trigger self-removal aka IY70808; and (2) a query with more than 32000 elements in the IN-list aka LI70817.


Hitachi Groupmax Mail SMTP 06-50 through 06-52-/A and 07-00 through 07-20 allows remote attackers to cause a denial of service (service stop) via an e-mail message with an \invalid format.\


The System Monitor Source Properties control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of the class associated with the control's CLSID which is not intended for use within Internet Explorer.


The Administration Service (FMSAdmin.exe) in Macromedia Flash Media Server 2.0 r1145 allows remote attackers to cause a denial of service (application crash) via a malformed request with a single character to port 1111.


Mailman 2.1.4 through 2.1.6 allows remote attackers to cause a denial of service via a message that causes the server to \fail with an Overflow on bad date data in a processed message \ a different vulnerability than CVE-2005-3573.


Unspecified vulnerability in Business Objects WebIntelligence 6.5x allows remote attackers to cause a denial of service (user account lock out) via unknown attack vectors related to \authentication mechanisms\ and \form input.\


The hugepage code (hugetlb.c) in Linux kernel 2.6 possibly 2.6.12 and 2.6.13 in certain configurations allows local users to cause a denial of service (crash) by triggering an mmap error before a prefault which causes an error in the unmap_hugepage_area function.


SMC Wireless Router model SMC7904WBRA allows remote attackers to cause a denial of service (reboot) by flooding the router with traffic.


The Internet Key Exchange version 1 (IKEv1) implementation in Apani Networks EpiForce 1.9 and earlier running IPSec allow remote attackers to cause a denial of service (crash) via certain IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


tftpd in Philippe Jounin Tftpd32 2.74 and earlier as used in Wyse Simple Imager (WSI) and other products allows remote attackers to cause a denial of service (daemon crash) via a long filename in a TFTP read (aka RRQ or get) request a different vulnerability than CVE-2002-2226.


POP3 service in Avaya Modular Messaging Message Storage Server (MSS) 2.0 SP 4 and earlier allows remote attackers to cause a denial of service (infinite loop) via crafted packets.


Joomla! 1.03 does not restrict the number of \Search\ Mambots which allows remote attackers to cause a denial of service (resource consumption) via a large number of Search Mambots.


The selinux_parse_skb_ipv6 function in security/selinux/hooks.c in the Linux kernel before 2.6.12-rc4 allows remote attackers to cause a denial of service (OOPS) via vectors associated with an incorrect call to the ipv6_skip_exthdr function.


Mozilla Firefox 1.0.7 and earlier on Linux allows remote attackers to cause a denial of service (client crash) via an IFRAME element with a large value of the WIDTH attribute which triggers a problem related to representation of floating-point numbers leading to an infinite loop of widget resizes and a corresponding large number of function calls on the stack.


Extended Interior Gateway Routing Protocol (EIGRP) 1.2 as implemented in Cisco IOS after 12.3(2) 12.3(3)B and 12.3(2)T and other products allows remote attackers to cause a denial of service by sending a \spoofed neighbor announcement\ with (1) mismatched k values or (2) \goodbye message\ Type-Length-Value (TLV).


The configuration of VMware ESX Server 2.x 2.0.x 2.1.x and 2.5.x allows local users to cause a denial of service (shutdown) via the (1) halt (2) poweroff and (3) reboot scripts executed at the service console.


Fwmon before 1.0.10 allows remote attackers to cause a denial of service (crash) by causing the kernel to return a large packet.


ICQ 2001a and 2002b allows remote attackers to cause a denial of service (memory consumption and hang) via a contact message with a large contacts number.


Active Directory in Windows 2000 when supporting Kerberos V authentication and GSSAPI allows remote attackers to cause a denial of service (hang) via an LDAP client that sets the page length to zero during a large request.


RFC-NETBIOS in HP Advanced Server/9000 B.04.05 through B.04.09 when running HP-UX 11.00 or 11.11 allows remote attackers to cause a denial of service (panic) via a malformed UDP packet on port 139.


NWFTPD.nlm before 5.03b in the FTP server in Novell NetWare allows remote authenticated users to cause a denial of service (abend) via a crafted ABOR command.


The recvn and sendn functions in nylon 0.2 do not check when the recv function call returns 0 which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) by closing the connection while recv is executing.


Compaq Tru64 4.0 d allows remote attackers to cause a denial of service in (1) telnet (2) FTP (3) ypbind (4) rpc.lockd (5) snmp (6) ttdbserverd and possibly other services via a TCP SYN scan as demonstrated using nmap.


Floositek FTGate PRO 1.05 allows remote attackers to cause a denial of service (memory and CPU consumption) via a large number of RCPT TO: messages during an SMTP session.


cgitest.exe in Savant Web Server 3.1 and earlier allows remote attackers to cause a denial of service (crash) via a long HTTP request.


Akfingerd 0.5 and earlier versions allow local users to cause a denial of service (crash) via a .plan with a symlink to /dev/urandom or other device then disconnecting while data is being transferred which causes a SIGPIPE error that Akfingerd cannot handle.


The POP3 mail client in Mozilla 1.0 and earlier and Netscape Communicator 4.7 and earlier allows remote attackers to cause a denial of service (no new mail) via a mail message containing a dot (.) at a newline which is interpreted as the end of the message.


php.exe in PHP 3.0 through 4.2.2 when running on Apache does not terminate properly which allows remote attackers to cause a denial of service via a direct request without arguments.


Cisco IOS 11.2.x and 12.0.x does not limit the size of its redirect table which allows remote attackers to cause a denial of service (memory consumption) via spoofed ICMP redirect packets to the router.


isakmpd/message.c in isakmpd in FreeBSD before isakmpd-20020403_1 and in OpenBSD 3.1 allows remote attackers to cause a denial of service (crash) by sending Internet Key Exchange (IKE) payloads out of sequence.


mosix-protocol-stack in Multicomputer Operating System for UnIX (MOSIX) 1.5.7 allows remote attackers to cause a denial of service via malformed packets.


Moby NetSuite allows remote attackers to cause a denial of service (crash) via an HTTP POST request with a (1) large integer or (2) non-numeric value in the Content-Length header which causes an access violation after a failed atoi function call.


Netscape Communicator 6.2.1 allows remote attackers to cause a denial of service in client browsers via a webpage containing a recursive META refresh tag where the content tag is blank and the URL tag references itself.


The c-client library in Internet Message Access Protocol (IMAP) dated before 2002 RC2 as used by Pine 4.20 through 4.44 allows remote attackers to cause a denial of service (client crash) via a MIME-encoded email with Content-Type header containing an empty boundary field.


The RCA Digital Cable Modems DCM225 and DCM225E allow remote attackers to cause a denial of service (modem device reset) by connecting to port 80 on the 10.0.0.0/8 device.


Serv-U FTP server 3.0 3.1 and 4.0.0.4 does not accept new connections while validating user folder access rights which allows remote attackers to cause a denial of service (no new connections) via a series of MKD commands.


Unspecified vulnerability in Internet Group Management Protocol (IGMP) of HP Tru64 4.0F through 5.1A allows remote attackers to cause a denial of service via unknown attack vectors. NOTE: this might be the same issue as CVE-2002-2185 but there are insufficient details to be certain.


The POP3 proxy service (POPROXY.EXE) in Norton AntiVirus 2001 allows local users to cause a denial of service (CPU consumption and crash) via a long username with multiple /localhost entries.


ICQ client 2001b 2002a and 2002b allows remote attackers to cause a denial of service (CPU consumption or crash) via a message with a large number of emoticons.


Unspecified vulnerability in NWFTPD.nlm before 5.03b in the FTP server in Novell NetWare allows remote attackers to cause a denial of service (abend) via a crafted username.


Allied Telesyn AT-8024 1.3.1 and Rapier 24 switches allow remote authenticated users to cause a denial of service in the management interface via a stream of zero (null) bytes sent via UDP to a running service.


InfBlocks.java in JCraft JZlib before 0.0.7 allow remote attackers to cause a denial of service (NullPointerException) via an invalid block of deflated data.


The compression code in MaraDNS before 0.9.01 allows remote attackers to cause a denial of service via crafted DNS packets.


SWS web server 0.0.4 0.0.3 and 0.1.0 allows remote attackers to cause a denial of service (crash) via a URL request that does not end with a newline.


The php_if_imap_mime_header_decode function in the IMAP functionality in PHP before 4.2.2 allows remote attackers to cause a denial of service (crash) via an e-mail header with a long \To\ header.


portmapper in Compaq Tru64 4.0G and 5.0A allows remote attackers to cause a denial of service via a flood of packets.


Tomcat 4.0 through 4.1.12 using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27 allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.


The Cisco Optical Service Module (OSM) for the Catalyst 6500 and 7600 series running Cisco IOS 12.1(8)E through 12.1(13.4)E allows remote attackers to cause a denial of service (hang) via a malformed packet.


The design of the Hot Standby Routing Protocol (HSRP) as implemented on Cisco IOS 12.1 when using IRPAS allows remote attackers to cause a denial of service (CPU consumption) via a router with the same IP address as the interface on which HSRP is running which causes a loop.


Extended Interior Gateway Routing Protocol (EIGRP) as implemented in Cisco IOS 11.3 through 12.2 and other products allows remote attackers to cause a denial of service (flood) by sending a large number of spoofed EIGRP neighbor announcements which results in an ARP storm on the local network.


NWFTPD.nlm before 5.02i in the FTP server in Novell NetWare does not properly listen for data connections which allows remote attackers to cause a denial of service (abend) via multiple FTP sessions.


NetScreen ScreenOS 2.8 through 4.0 when forwarding H.323 or Netmeeting traffic allows remote attackers to cause a denial of service (firewall session table consumption) by establishing multiple half-open H.323 sessions which are not cleaned up on garbage removal and do not time out for 36 hours.


GoAhead WebServer before 2.1.1 allows remote attackers to cause a denial of service (CPU consumption) by performing a socket disconnect to terminate a request before it has been fully processed by the server.


The Internet Group Management Protocol (IGMP) allows local users to cause a denial of service via an IGMP membership report to a target's Ethernet address instead of the Multicast group address which causes the target to stop sending reports to the router and effectively disconnect the group from the network.


Sharman Networks KaZaA Media Desktop 1.7.1 allows remote attackers to cause a denial of service (CPU consumption) by sending several large messages.


Unspecified vulnerability in xntpd of HP-UX 10.20 through 11.11 allows remote attackers to cause a denial of service (hang) via unknown attack vectors.


Netgear RM-356 and RT-338 series SOHO routers allow remote attackers to cause a denial of service (crash) via a UDP port scan as demonstrated using nmap.


java.security.AccessController in Sun Java Virtual Machine (JVM) in JRE 1.2.2 and 1.3.1 allows remote attackers to cause a denial of service (JVM crash) via a Java program that calls the doPrivileged method with a null argument.


The Telnet proxy of 602Pro LAN SUITE 2002 does not restrict the number of outstanding connections to the local host which allows remote attackers to create a denial of service (memory consumption) via a large number of connections.


Direct connect text client (DCTC) client 0.83.3 allows remote attackers to cause a denial of service (crash) via a string ending with a NULL byte character.


** DISPUTED ** Cisco AS5350 IOS 12.2(11)T with access control lists (ACLs) applied and possibly with ssh running allows remote attackers to cause a denial of service (crash) via a port scan possibly due to an ssh bug. NOTE: this issue could not be reproduced by the vendor.


Microsoft Windows XP allows remote attackers to cause a denial of service (CPU consumption) by flooding UDP port 500 (ISAKMP).


Next Generation POSIX Threading (NGPT) 1.9.0 uses a filesystem-based shared memory entry which allows local users to cause a denial of service or in threaded processes or spoof files via unknown methods.


Netgear FM114P firmware 1.3 wireless firewall allows remote attackers to cause a denial of service (crash or hang) via a large number of TCP connection requests.


webs.c in GoAhead WebServer before 2.1.4 allows remote attackers to cause a denial of service (daemon crash) via an HTTP POST request that contains a negative integer in the Content-Length header.


Opera 6.0.3 when using Squid 2.4 for HTTPS proxying does not properly handle when accepting a non-global certificate authority (CA) certificate from a site and establishing a subsequent HTTPS connection which allows remote attackers to cause a denial of service (crash).


The dynamic initialization feature of the ClearPath MCP environment allows remote attackers to cause a denial of service (crash) via a TCP port scan using a tool such as nmap.


Linksys WET11 firmware 1.31 and 1.32 allows remote attackers to cause a denial of service (crash) via a packet containing the device's hardware address as the source MAC address in the DLC header.


The imap_header function in the IMAP functionality for PHP before 4.3.0 allows remote attackers to cause a denial of service via an e-mail message with a large number of \To\ addresses which triggers an error in the rfc822_write_address function.


Kerio Personal Firewall (KPF) 2.1.4 and earlier allows remote attackers to cause a denial of service (hang and CPU consumption) via a SYN packet flood.


The parse-get function in utils.c for apt-www-proxy 0.1 allows remote attackers to cause a denial of service (crash) via an empty HTTP request which causes a null dereference.


OpenBSD before 3.2 allows local users to cause a denial of service (kernel crash) via a call to getrlimit(2) with invalid arguments possibly due to an integer signedness error.


Cisco 2611 router running IOS 12.1(6.5) possibly an interim release allows remote attackers to cause a denial of service via port scans such as (1) scanning all ports on a single host and (2) scanning a network of hosts for a single open port through the router. NOTE: the vendor could not reproduce this issue saying that the original reporter was using an interim release of the software.


schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop as demonstrated by krb_pingpong.nasl a related issue to CVE-1999-0103.


Microsoft Internet Explorer 6.0 and earlier allows local users to cause a denial of service via an infinite loop for modeless dialogs showModelessDialog which causes CPU usage while the focus for the dialog is not released.


Microsoft SQL Server 2000 allows remote attackers to cause a denial of service via a malformed 0x08 packet that is missing a colon separator.


Alcatel Speed Touch Home ADSL Modem allows remote attackers to cause a denial of service (reboot) via a network scan with unusual packets such as nmap with OS detection.


The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed by modifying the parent.pid and parent.last_rtime segments in the scoreboard.


Kmail 1.2 on KDE 2.1.1 allows remote attackers to cause a denial of service (crash) via an email message whose body is approximately 55 K long.


ScriptEase MiniWeb Server 0.95 allows remote attackers to cause a denial of service (crash) via certain HTTP GET requests containing (1) a %2e%2e (encoded dot-dot) (2) several /../ (dot dot) sequences (3) a missing URI or (4) several ../ in a URI that does not begin with a / (slash) character.


OpenBSD 2.9 through 3.1 allows local users to cause a denial of service (resource exhaustion) and gain root privileges by filling the kernel's file descriptor table and closing file descriptors 0 1 or 2 before executing a privileged process which is not properly handled when OpenBSD fails to open an alternate descriptor.


Snapgear Lite+ firewall 1.5.4 and 1.5.3 allows remote attackers to cause a denial of service (crash) via a large number of connections to (1) the HTTP web management port or (2) the PPTP port.


The administration module for Oracle Web Cache in Oracle9iAS (9i Application Suite) 9.0.2 allows remote attackers to cause a denial of service (crash) via (1) an HTTP GET request containing a \..\ (dot dot) sequence or (2) a malformed HTTP GET request with a chunked Transfer-Encoding with missing data.


Web server for Shambala 4.5 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request.


The kqueue mechanism in FreeBSD 4.3 through 4.6 STABLE allows local users to cause a denial of service (kernel panic) via a pipe call in which one end is terminated and an EVFILT_WRITE filter is registered for the other end.


Menasoft SPHERE server 0.99x and 0.5x allows remote attackers to cause a denial of service by establishing a large number of connections to the server without providing login credentials which prevents other users from being able to log in.


ICQ 2001b Build 3659 allows remote attackers to cause a denial of service (crash) via a malformed picture that contains large height and width values which causes the crash when viewed in Userdetails.


Half-Life Server 1.1.1.0 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via multiple responses to the initial challenge with different cd_key values which reaches the player limit and prevents other players from connecting until the original responses have timed out.


The SYN cache (syncache) and SYN cookie (syncookie) mechanism in FreeBSD 4.5 and earlier allows remote attackers to cause a denial of service (crash) (1) via a SYN packet that is accepted using syncookies that causes a null pointer to be referenced for the socket's TCP options or (2) by killing and restarting a process that listens on the same socket which does not properly clear the old inpcb pointer on restart.


CGI handler in John Roy Pi3Web for Windows 2.0 beta 1 and 2 allows remote attackers to cause a denial of service (crash) via a series of requests whose physical path is exactly 260 characters long and ends in a series of . (dot) characters.


Linksys EtherFast BEFN2PS4 BEFSR41 and BEFSR81 Routers and possibly other products allow remote attackers to gain sensitive information and cause a denial of service via an SNMP query for the default community string \public \ which causes the router to change its configuration and send SNMP trap information back to the system that initiated the query.


The Java Server Pages (JSP) engine in JRun allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null null).


The ASN1 library in OpenSSL 0.9.6d and earlier and 0.9.7-beta2 and earlier allows remote attackers to cause a denial of service via invalid encodings.


PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allows remote attackers to cause a denial of service (crash) via an HTTP Authorization header without an authentication type.


Preboot eXecution Environment (PXE) server allows remote attackers to cause a denial of service (crash) via certain DHCP packets from Voice-Over-IP (VOIP) phones.


Vulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via (1) GetRequest (2) GetNextRequest and (3) SetRequest messages as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available.


Bitvise WinSSHD before 2002-03-16 allows remote attackers to cause a denial of service (resource exhaustion) via a large number of incomplete connections that are not properly terminated which are not properly freed by SSHd.


The kernel in HP-UX 11.11 does not properly provide arguments for setrlimit which could allow local attackers to cause a denial of service (kernel panic) and possibly gain privileges.


LANMAN service on Microsoft Windows 2000 allows remote attackers to cause a denial of service (CPU/memory exhaustion) via a stream of malformed data to microsoft-ds port 445.


Memory leak in SNMP in Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service.


Network File System (NFS) in FreeBSD 4.6.1 RELEASE-p7 and earlier NetBSD 1.5.3 and earlier and possibly other operating systems allows remote attackers to cause a denial of service (hang) via an RPC message with a zero length payload which causes NFS to reference a previous payload and enter an infinite loop.


Unknown vulnerability in Cluster Interconnect for HP TruCluster Server 5.0A 5.1 and 5.1A may allow local and remote attackers to cause a denial of service.


Qpopper (aka in.qpopper or popper) 4.0.3 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a very large string which causes an infinite loop.


The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null null).


Novell BorderManager 3.5 with PAT (Port-Address Translate) enabled allows remote attackers to cause a denial of service by filling the connection table with a large number of connection requests to hosts that do not have a specific route which may be forwarded to the public interface.


/dev/ipfilter on SGI IRIX 6.5 is installed by /dev/MAKEDEV with insecure default permissions (644) which could allow a local user to cause a denial of service (traffic disruption).


FreeRADIUS RADIUS server allows remote attackers to cause a denial of service (CPU consumption) via a flood of Access-Request packets.


The ASN.1 parser in Ethereal 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a certain malformed packet which causes Ethereal to allocate memory incorrectly possibly due to zero-length fields.


Xerver Free Web Server 2.10 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request that contains many \C:/\ sequences.


DNS dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (CPU consumption) via a malformed packet that causes Ethereal to enter an infinite loop.


The web interface for Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 allows administrators to cause a denial of service by modifying the SIP_AUTHENTICATE_SCHEME value to force authentication of incoming calls which does not notify the user when an authentication failure occurs.


SQL*NET listener for Oracle Net Oracle9i 9.0.x and 9.2 allows remote attackers to cause a denial of service (crash) via certain debug requests that are not properly handled by the debugging feature.


Memory leak in the Call Telephony Integration (CTI) Framework authentication for Cisco CallManager 3.0 and 3.1 before 3.1(3) allows remote attackers to cause a denial of service (crash and reload) via a series of authentication failures e.g. via incorrect passwords.


Internet Explorer 5.01 through 6 allows remote attackers to cause a denial of service (application crash) via Javascript in a web page that calls location.replace on itself causing a loop.


Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available.


The web proxy component in Symantec Enterprise Firewall (SEF) 6.5.2 through 7.0 Raptor Firewall 6.5 and 6.5.3 VelociRaptor and Symantec Gateway Security allow remote attackers to cause a denial of service (connection resource exhaustion) via multiple connection requests to domains whose DNS server is unresponsive or does not exist which generates a long timeout.


PostBoard 2.0.1 and earlier with BBcode allows remote attackers to cause a denial of service (CPU consumption) and corrupt the database via null \\0 characters within code tags.


Microsoft Virtual Machine (VM) up to and including build 5.0.3805 allows remote attackers to cause a denial of service (crash) in Internet Explorer via invalid handle data in a Java applet aka \Handle Validation Flaw.\


The web server for Cisco IP Phone (VoIP) models 7910 7940 and 7960 allows remote attackers to cause a denial of service (reset) and possibly read sensitive memory via a large integer value in (1) the stream ID of the StreamingStatistics script or (2) the port ID of the PortInformation script.


Yahoo! Messenger 5.0 allows remote attackers to spoof other users by modifying the username and using the spoofed username for social engineering or denial of service (flooding) attacks.


SMTP service in Microsoft Windows 2000 Windows XP Professional and Exchange 2000 allows remote attackers to cause a denial of service via a command with a malformed data transfer (BDAT) request.


Transparent Network Substrate (TNS) Listener in Oracle 9i 9.0.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a single malformed TCP packet to port 1521.


KICQ 2.0.0b1 allows remote attackers to cause a denial of service (crash) via a malformed message.


Netopia Timbuktu Pro 6.0.1 and earlier allows remote attackers to cause a denial of service (crash) via a series of connections to one of the ports (1417 - 1420).


Snapgear Lite+ firewall 1.5.3 allows remote attackers to cause a denial of service (IPSEC crash) via a zero length packet to UDP port 500.


Cisco DSL CPE devices running CBOS 2.4.4 and earlier allows remote attackers to cause a denial of service (hang or memory consumption) via (1) a large packet to the DHCP port (2) a large packet to the Telnet port or (3) a flood of large packets to the CPE which causes the TCP/IP stack to consume large amounts of memory.


Vulnerability in passwd for HP-UX 11.00 and 11.11 allows local users to corrupt the password file and cause a denial of service.


The keep-alive mechanism for Microsoft SQL Server 2000 allows remote attackers to cause a denial of service (bandwidth consumption) via a \ping\ style packet to the Resolution Service (UDP port 1434) with a spoofed IP address of another SQL Server system which causes the two servers to exchange packets in an infinite loop.


Vulnerability in swinstall for HP-UX 11.00 and 11.11 allows local users to view obtain data views for files that cannot be directly read by the user which reportedly can be used to cause a denial of service.


CIPE VPN package before 1.3.0-3 allows remote attackers to cause a denial of service (crash) via a short malformed packet.


The HTTP server for SouthWest Talker server 1.0.0 allows remote attackers to cause a denial of service (server crash) via a malformed URL to port 5002.


IP/IPX gateway for Novell BorderManager 3.6 SP 1a allows remote attackers to cause a denial of service via a connection to port 8225 with a large amount of random data which causes ipipxgw.nlm to ABEND.


Netgear RP114 Cable/DSL Web Safe Router Firmware 3.26 when configured to block traffic below port 1024 allows remote attackers to cause a denial of service (hang) via a port scan of the WAN port.


NewAtlanta

ServletExec

ISAPI

allows

remote

attackers

to

cause

a

denial

of

service

(crash)

via

a

request

for

a

long

.jsp

file

or

a

long

URL

sent

directly

to

com.newatlanta.servletexec.JSP10Servlet.


Cisco ONS15454 optical transport platform running ONS 3.1.0 to 3.2.0 allows remote attackers to cause a denial of service (reset) by sending IP packets with non-zero Type of Service (TOS) bits to the Timing Control Card (TCC) LAN interface.


Palm OS 3.5h and possibly other versions as used in Handspring Visor and Xircom products allows remote attackers to cause a denial of service via a TCP connect scan e.g. from nmap.


The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0 5.0 and 5.1 does not properly handle the error condition when a long URL is provided which allows remote attackers to cause a denial of service (crash) when the URL parser accesses a null pointer.


Unknown vulnerability in IPV6 functionality for DCE daemons (1) dced or (2) rpcd on HP-UX 11.11 allows attackers to cause a denial of service (crash) via an attack that modifies internal data.


Vulnerability in HP MPE/iX 6.0 through 7.0 allows attackers to cause a denial of service (system failure with \SA1457 out of i_port_timeout.fix_up_message_frame\) via malformed IP packets.


Network Product Identification (PID) Checker in Microsoft Office v. X for Mac allows remote attackers to cause a denial of service (crash) via a malformed product announcement.


Oracle9iAS Web Cache 2.0.0.x allows remote attackers to cause a denial of service via (1) a request to TCP ports 1100 4000 4001 and 4002 with a large number of null characters and (2) a request to TCP port 4000 with a large number of \.\ characters.


The Store Service in Microsoft Exchange 2000 allows remote attackers to cause a denial of service (CPU consumption) via a mail message with a malformed RFC message attribute aka \Malformed Mail Attribute can Cause Exchange 2000 to Exhaust CPU Resources.\


Cisco

IP

Phone

(VoIP)

models

and

allow

remote

attackers

to

cause

a

denial

of

service

(crash)

via

malformed

packets

as

demonstrated

by

\jolt\

\raped\

\bloop\

\bubonic\

\mutant\

\trash\

and


LabVIEW Web Server 5.1.1 through 6.1 allows remote attackers to cause a denial of service (crash) via an HTTP GET request that ends in two newline characters instead of the expected carriage return/newline combinations.


xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd which could allow those services to cause a denial of service via the pipe.


FTP proxy server for Novell BorderManager 3.6 SP 1a allows remote attackers to cause a denial of service (network connectivity loss) via a connection to port 21 with a large amount of random data.


ISS RealSecure Network Sensor 5.x through 6.5 allows remote attackers to cause a denial of service (crash) via malformed DHCP packets that cause RealSecure to dereference a null pointer.


The Telnet service for Polycom ViewStation before 7.2.4 allows remote attackers to cause a denial of service (crash) via long or malformed ICMP packets.


Vulnerability in the MIT-SHM extension of the X server on Linux (XFree86) 4.2.1 and earlier allows local users to read and write arbitrary shared memory possibly to cause a denial of service or gain privileges.


Windows XP with port 445 open allows remote attackers to cause a denial of service (CPU consumption) via a flood of TCP SYN packets containing possibly malformed data.


The accept_filter mechanism in FreeBSD 4 through 4.5 does not properly remove entries from the incomplete listen queue when adding a syncache which allows remote attackers to cause a denial of service (network service availability) via a large number of connection attempts which fills the queue.


ZyXEL ZyWALL 10 before 3.50 allows remote attackers to cause a denial of service via an ARP packet with the firewall's IP address and an incorrect MAC address which causes the firewall to disable the LAN interface.


Etype Eserv 2.97 allows remote attackers to cause a denial of service (resource exhaustion) via a large number of PASV commands that consume ports 1024 through 5000 which prevents the server from accepting valid PASV.


Snapgear Lite+ firewall 1.5.3 and 1.5.4 allows remote attackers to cause a denial of service (crash) via a large number of packets with malformed IP options.


IPSEC implementations including (1) FreeS/WAN and (2) KAME do not properly calculate the length of authentication data which allows remote attackers to cause a denial of service (kernel panic) via spoofed short Encapsulating Security Payload (ESP) packets which result in integer signedness errors.


Double Precision Courier e-mail MTA allows remote attackers to cause a denial of service (CPU consumption) via a message with an extremely large or negative value for the year which causes a tight loop.


Novell Netware FTP server NWFTPD before 5.02r allows remote attackers to cause a denial of service (CPU consumption) via a connection to the server followed by a carriage return and possibly other invalid commands with improper syntax or length.


The MSDTC (Microsoft Distributed Transaction Service Coordinator) for Microsoft Windows 2000 Microsoft IIS 5.0 and SQL Server 6.5 through SQL 2000 0.0 allows remote attackers to cause a denial of service (crash or hang) via malformed (random) input.


Microsoft Internet Explorer 5.5 on Windows 98 allows remote web pages to cause a denial of service (hang) via extremely long values for form fields such as INPUT and TEXTAREA which can be automatically filled via Javascript.


Cisco Aironet before 11.21 with Telnet enabled allows remote attackers to cause a denial of service (reboot) via a series of login attempts with invalid usernames and passwords.


Memory leak in FreeBSD 4.5 and earlier allows remote attackers to cause a denial of service (memory exhaustion) via ICMP echo packets that trigger a bug in ip_output() in which the reference count for a routing table entry is not decremented which prevents the entry from being removed.


CVS before 1.10.8 does not properly initialize a global variable which allows remote attackers to cause a denial of service (server crash) via the diff capability.


Unknown vulnerability in ndd for HP-UX 11.11 with certain TRANSPORT patches allows attackers to cause a denial of service.


The Telnet service for Polycom ViewStation before 7.2.4 allows remote attackers to cause a denial of service (crash) via multiple connections to the server.


Watchguard SOHO firewall before 5.0.35 allows remote attackers to cause a denial of service (crash and reboot) when SOHO forwards a packet with bad IP options.


The web interface (WebUI) of NetScreen ScreenOS before 2.6.1r8 and certain 2.8.x and 3.0.x versions before 3.0.3r1 allows remote attackers to cause a denial of service (crash) via a long user name.


The telnet port in Arescom NetDSL 1000 router allows remote attackers to cause a denial of service via a series of connections with long strings which causes a large number of login failures and causes the telnet service to stop.


The default configuration of BlackICE Agent 3.1.eal and 3.1.ebh has a high tcp.maxconnections setting which could allow remote attackers to cause a denial of service (memory consumption) via a large number of connections to the BlackICE system that consumes more resources than intended by the user.


Vulnerability in GIOP dissector in Ethereal before 0.9.3 allows remote attackers to cause a denial of service (memory consumption).


Siemens 3568i WAP mobile phones allows remote attackers to cause a denial of service (crash) via an SMS message containing unusual characters.


phpBB 1.4.4 and earlier with BBcode allows remote attackers to cause a denial of service (CPU consumption) and corrupt the database via null \\0 characters within code tags.


NetScreen ScreenOS before 2.6.1 does not support a maximum number of concurrent sessions for a system which allows an attacker on the trusted network to cause a denial of service (resource exhaustion) via a port scan to an external network which consumes all available connections.


HP Procurve Switch 4000M running firmware C.08.22 and C.09.09 allows remote attackers to cause a denial of service via a port scan of the management IP address which disables the telnet service.


RTSP proxy for Novell BorderManager 3.6 SP 1a allows remote attackers to cause a denial of service via a GET request to port 9090 followed by a series of carriage returns which causes proxy.nlm to ABEND.


Vulnerability in the XFS file system for SGI IRIX before 6.5.12 allows local users to cause a denial of service (hang) by creating a file that is not properly processed by XFS.


Vulnerability in the cache-limiting function of the unified name service daemon (nsd) in IRIX 6.5.4 through 6.5.11 allows remote attackers to cause a denial of service by forcing the cache to fill the disk.


bigsam_guestbook.php for Big Sam (Built-In Guestbook Stand-Alone Module) 1.1.08 and earlier allows remote attackers to cause a denial of service (CPU consumption) or obtain the absolute path of the web server via a displayBegin parameter with a very large number which leaks the web path in an error message when PHP safe_mode is enabled or consumes resources when safe_mode is not enabled.


The Remote Data Protocol (RDP) version 5.1 in Microsoft Windows XP allows remote attackers to cause a denial of service (crash) when Remote Desktop is enabled via a PDU Confirm Active data packet that does not set the Pattern BLT command aka \Denial of Service in Remote Desktop.\


The Microsoft Java implementation as used in Internet Explorer allows remote attackers to cause a denial of service (crash) and possibly conduct other unauthorized activities via applet tags in HTML that bypass Java class restrictions (such as private constructors) by providing the class name in the code parameter aka \Incomplete Java Object Instantiation Vulnerability.\


The MPS functionality in Enterasys SSR8000 (Smart Switch Router) before firmware 8.3.0.10 allows remote attackers to cause a denial of service (crash) via multiple port scans to ports 15077 and 15078.


advserver.exe in Advanced Web Server (AdvServer) Professional 1.030000 allows remote attackers to cause a denial of service via multiple HTTP requests containing a single carriage return/line feed (CRLF) sequence.


Savant Webserver 3.1 allows remote attackers to cause a denial of service (crash) via an HTTP GET request with a negative Content-Length value.


TelCondex SimpleWebServer 2.06.20817 allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.


Ultrafunk Popcorn 1.20 allows remote attackers to cause a denial of service (crash) via a malformed Date field that is converted into a year greater than 2037.


Microsoft Outlook 2002 allows remote attackers to cause a denial of service (repeated failure) via an email message with a certain invalid header field that is accessed using POP3 IMAP or WebDAV aka \E-mail Header Processing Flaw Could Cause Outlook 2002 to Fail.\


Cisco SN 5420 Storage Router 1.1(5) and earlier allows remote attackers to cause a denial of service (router crash) via an HTTP request with large headers.


BadBlue server allows remote attackers to cause a denial of service (crash) via an HTTP GET request without a URI.


The HTTP administration interface for HP Procurve 4000M Switch firmware before C.09.16 with stacking features and remote administration enabled does not authenticate requests to reset the device which allows remote attackers to cause a denial of service via a direct request to the device_reset CGI program.


The default configuration of BizDesign ImageFolio 2.23 through 2.26 does not control access to (1) admin/setup.cgi which allows remote attackers to create an administrative account or (2) admin/nph-build.cgi which allows remote attackers to cause a denial of service (CPU consumption).


The IRC component of Trillian 0.73 and 0.74 allows remote malicious IRC servers to cause a denial of service (crash) via a PART message with (1) a missing channel or (2) a channel that the Trillian user is not in.


Microsoft

Internet

Explorer

through

on

Windows

or

Windows

XP

allows

remote

attackers

to

cause

a

denial

of

service

(crash)

via

an

OBJECT

tag

that

contains

a

crafted

CLASSID

(CLSID)

value

of

\CLSID:00022613-0000-0000-C000-000000000046\.


TNS Listener in Oracle Net Services for Oracle 9i 9.2.x and 9.0.x and Oracle 8i 8.1.x allows remote attackers to cause a denial of service (hang or crash) via a SERVICE_CURLOAD command.


Microsoft Exchange 2000 when used with Microsoft Remote Procedure Call (MSRPC) allows remote attackers to cause a denial of service (crash or memory consumption) via malformed MSRPC calls.


The Google toolbar 1.1.60 when running on Internet Explorer 5.5 and 6.0 allows remote attackers to cause a denial of service (crash with an exception in oleaut32.dll) via malicious HTML possibly related to small width and height parameters or an incorrect call to the Google.Search() function.


Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and socket operations which could allow a remote attacker to cause a denial of service (resource exhaustion) by causing file descriptors to be assigned and not released as demonstrated by fanta.


Cisco VPN 3000 Concentrator before 2.5.2(F) with encryption enabled allows remote attackers to cause a denial of service (reload) via a Windows-based PPTP client with the \No Encryption\ option set.


Belkin F5D6130 Wireless Network Access Point running firmware AP14G8 allows remote attackers to cause a denial of service (connection loss) by sending several SNMP GetNextRequest requests.


Motorola Surfboard 4200 cable modem allows remote attackers to cause a denial of service (crash) by performing a SYN scan using a tool such as nmap.


Solaris 2.5.1 through 9 allows local users to cause a denial of service (kernel panic) by setting the sd_struiowrq variable in the struioget function to null which triggers a null dereference.


Microsoft Internet Explorer 5.5 through 6.0 allows remote attackers to cause a denial of service (crash) via a Cascading Style Sheet (CSS) with the p{cssText} element declared and a bold font weight.


The leafnode server in leafnode 1.9.20 to 1.9.29 allows remote attackers to cause a denial of service (infinite loop) when leafnode requests a cross-posted article to one group whose name is a prefix of another group.


Magic Notebook 1.0b and 1.1b allows remote attackers to cause a denial of service (crash) via an invalid username during login.


The Web Publishing feature in Netscape Enterprise Server 3.x and iPlanet Web Server 4.x allows remote attackers to cause a denial of service (crash) via a wp-html-rend request.


HTTP Server mod_ssl module running on HP-UX 11.04 with Virtualvault OS (VVOS) 4.5 through 4.6 closes the connection when the Apache server times out during an SSL request which may allow attackers to cause a denial of service.


Unknown vulnerability or vulnerabilities in TCP/IP component for HP Tru64 UNIX 4.0f 4.0g and 5.0a allows remote attackers to cause a denial of service.


Signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.23.x before 3.23.54 allows remote attackers to cause a denial of service (crash or hang) in mysqld by causing large negative integers to be provided to a memcpy call.


The AIM component of Trillian 0.73 and 0.74 allows remote attackers to cause a denial of service (crash) via certain strings such as \P > O < C\.


Trolltech Qt Assistant 1.0 in Trolltech Qt 3.0.3 when loaded from the Designer opens port 7358 for interprocess communication which allows remote attackers to open arbitrary HTML pages and cause a denial of service.


Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests which consumes all of the licenses that are granted to Exchange by IIS.


SkyStream EMR5000 1.16 through 1.18 does not drop packets or disable the Ethernet interface when the buffers are full which allows remote attackers to cause a denial of service (null pointer exception and kernel panic) via a large number of packets.


The libthread library (libthread.so.1) for Solaris 2.5.1 through 8 allows local users to cause a denial of service (hang) of an application that uses libthread by causing the application to wait for a certain mutex.


Memory leak in RealSecure Event Collector 6.5 allows attackers to cause a denial of service (memory consumption and crash).


Netscreen running ScreenOS 4.0.0r6 and earlier allows remote attackers to cause a denial of service via a malformed SSH packet to the Secure Command Shell (SCS) management interface as demonstrated via certain CRC32 exploits a different vulnerability than CVE-2001-0144.


savesettings.php in phpGB 1.20 and earlier does not require authentication which allows remote attackers to cause a denial of service or execute arbitrary PHP code by using savesettings.php to modify config.php.


The Microsoft Java implementation as used in Internet Explorer can provide HTML object references to applets via Javascript which allows remote attackers to cause a denial of service (crash due to illegal memory accesses) and possibly conduct other unauthorized activities via an applet that uses those references to access proprietary Microsoft methods.


The Linux kernel 2.4.20 and earlier and 2.5.x when running on x86 systems allows local users to cause a denial of service (hang) via the emulation mode which does not properly clear TF and NT EFLAGs.


The remote management web server for Linksys BEFSR41 EtherFast Cable/DSL Router before firmware 1.42.7 allows remote attackers to cause a denial of service (crash) via an HTTP request to Gozila.cgi without any arguments.


procfs on FreeBSD before 4.5 allows local users to cause a denial of service (kernel panic) by removing a file that the fstatfs function refers to.


mod_dav in Apache before 2.0.42 does not properly handle versioning hooks which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module.


SmartMail Server 2.0 allows remote attackers to cause a denial of service (crash) by sending data and closing the connection before all the data has been sent.


The Sun RPC functionality in multiple libc implementations does not provide a time-out mechanism when reading data from TCP connections which allows remote attackers to cause a denial of service (hang).


IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (crash) via malformed WebDAV requests that cause a large amount of memory to be assigned.