Cisco Intrusion Prevention System (IPS) Software in ASA 5500-X IPS-SSP software modules before 7.1(7)sp1E4 allows remote attackers to cause a denial of service (Analysis Engine process hang or device reload) via fragmented (1) IPv4 or (2) IPv6 packets aka Bug ID CSCue51272.


TMSSNMPService.exe in TelePresence Manager in Cisco TelePresence Management Suite (TMS) on 64-bit platforms allows remote attackers to cause a denial of service (process crash) via SNMP traps aka Bug ID CSCue00028.


Memory leak in Cisco IOS 12.2 12.4 15.0 and 15.1 when Zone-Based Policy Firewall SIP application layer gateway inspection is enabled allows remote attackers to cause a denial of service (memory consumption or device reload) via malformed SIP messages aka Bug ID CSCtl99174.


Cisco Tivoli Business Service Manager (TBSM) in Hosted Collaboration Mediation (HCM) in Cisco Hosted Collaboration Solution allows remote attackers to cause a denial of service (temporary service hang) by sending many TCP packets to certain ports aka Bug ID CSCue03703.


The Active Record component in Ruby on Rails 2.3.x before 2.3.18 3.1.x before 3.1.12 and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols which allows remote attackers to cause a denial of service via crafted input to a where method.


Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X allows remote attackers to cause a denial of service (incorrect memory access) or possibly have unspecified other impact via a large number of SVG parameters.


upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network.


The server process in IBM Cognos TM1 10.1.x before 10.1.1 FP1 allows remote attackers to cause a denial of service (daemon crash) via an undocumented API call that triggers the transmission of unexpected data.


libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function which allows remote attackers to cause a denial of service (resource consumption) send HTTP requests to intranet servers or read arbitrary files via a crafted XML document aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion the responsibility for resolving this issue lies with application developers; according to this argument this entry should be REJECTed and each affected application would need its own CVE.


The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption.


The AMD IOMMU support in Xen 4.2.x 4.1.x 3.3 and other versions when using AMD-Vi for PCI passthrough uses the same interrupt remapping table for the host and all guests which allows guests to cause a denial of service by injecting an interrupt into other guests.


The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses which allows remote attackers to cause a denial of service (excessive retries and address-generation outage) and consequently obtain sensitive information via ICMPv6 Router Advertisement (RA) messages.


OpenStack Keystone Grizzly before 2013.1 Folsom and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request as demonstrated by a long tenant_name when requesting a token.


The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service (guest crash or hang) via a SPICE connection that prevents other threads from obtaining the qemu_mutex mutex. NOTE: some of these details are obtained from third party information.


Pacemaker 1.1.10 when remote Cluster Information Base (CIB) configuration or resource management is enabled does not limit the duration of connections to the blocking sockets which allows remote attackers to cause a denial of service (connection blocking).


The traditional scheduler in the client in IBM Tivoli Storage Manager (TSM) before 6.2.5.0 6.3 before 6.3.1.0 and 6.4 before 6.4.0.1 when Prompted mode is enabled allows remote attackers to cause a denial of service (scheduling outage) via unspecified vectors.


Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.


multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.


The PDF functionality in Google Chrome before 24.0.1312.52 does not properly perform a cast of an unspecified variable during processing of the root of the structure tree which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.


IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to cause a denial of service (daemon outage) via a crafted authentication request.


The Arecont Vision AV1355DN MegaDome camera allows remote attackers to cause a denial of service (video-capture outage) via a packet to UDP port 69.


Unspecified vulnerability in the IBM WebSphere Cast Iron physical and virtual appliance 6.0 and 6.1 before 6.1.0.15 and 6.3 before 6.3.0.1 when LDAP authentication is enabled allows remote attackers to obtain sensitive information modify data or cause a denial of service via unknown vectors.


Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X does not properly manage memory during message handling for plug-ins which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


The HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted HTTP request.


The WebCLI component in Wind River VxWorks 5.5 through 6.9 allows remote authenticated users to cause a denial of service (CLI session crash) via a crafted command string.


Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3 2010 SP1 and SP2 and 2013 do not properly process unassigned workflows which allows remote attackers to cause a denial of service (W3WP process hang) via a crafted URL aka \SharePoint Denial of Service Vulnerability.\


The TCP/IP implementation in Microsoft Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 Windows Server 2012 and Windows RT allows remote attackers to cause a denial of service (reboot) via a crafted packet that terminates a TCP connection aka \TCP FIN WAIT Vulnerability.\


The NVIDIA driver before 307.78 and Release 310 before 311.00 in the NVIDIA Display Driver service on Windows does not properly handle exceptions which allows local users to gain privileges or cause a denial of service (memory overwrite) via a crafted application.


IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.2.0 does not properly handle device files that are created with the NFS protocol but accessed with a non-NFS protocol which allows remote authenticated users to obtain sensitive information modify programs or files or cause a denial of service (device crash) via a (1) CIFS (2) HTTPS (3) SCP or (4) SFTP operation.


The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key which allows remote attackers to cause a denial of service (crash) via a crafted packet.


The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.


The Galil RIO-47100 Pocket PLC allows remote attackers to cause a denial of service via a session that includes \repeated requests.\


Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions.


libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity aka \internal entity expansion\ with linear complexity.


Siemens SIMATIC S7-1200 PLCs 2.x and 3.x allow remote attackers to cause a denial of service (defect-mode transition and control outage) via crafted packets to TCP port 102 (aka the ISO-TSAP port).


Memory leak in Xen 4.2 and unstable allows local HVM guests to cause a denial of service (host memory consumption) by performing nested virtualization in a way that triggers errors that are not properly handled.


arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2 when transparent huge pages are used does not properly support PROT_NONE memory regions which allows local users to cause a denial of service (system crash) via a crafted application.


Disk Management in Apple Mac OS X before 10.8.4 does not properly authenticate attempts to disable FileVault which allows local users to cause a denial of service (loss of encryption functionality) via an unspecified command line.


The JSON gem before 1.5.5 1.6.x before 1.6.8 and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects as demonstrated by conducting a SQL injection attack against Ruby on Rails aka \Unsafe Object Creation Vulnerability.\


The Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3 6.2.1 through FP4 6.2.2 through FP9 and 6.2.3 before FP3 as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before 1.2.1.0-TIV-IAMSB-FP0004 and other products allows remote attackers to cause a denial of service (abend) via a crafted URL.


The

avast!

Mobile

Security

application

before

for

Android

allows

attackers

to

cause

a

denial

of

service

(application

crash)

via

a

crafted

application

that

sends

an

intent

to

com.avast.android.mobilesecurity.app.scanner.DeleteFileActivity

with

zero

arguments.


IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted packet.


Dnsmasq before 2.66test2 when used with certain libvirt configurations replies to queries from prohibited interfaces which allows remote attackers to cause a denial of service (traffic amplification) via spoofed TCP based DNS queries. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3411.


Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5 1.2.x before 1.2.7 1.3.x before 1.3.9 and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to \symbolized arbitrary strings.\


The DataSim and DataPid demonstration clients in Cogent Real-Time Systems Cogent DataHub before 7.3.0 OPC DataHub before 6.4.22 Cascade DataHub before 6.4.22 on Windows and DataHub QuickTrend before 7.3.0 allow remote servers to cause a denial of service (incorrect pointer access and client crash) via malformed data in a formatted text command.


Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of extension tabs.


The

function

in

in

the

directory

server

(dirsrv)

in

FreeIPA

before

allows

remote

attackers

to

cause

a

denial

of

service

(crash)

via

a

connection

request

without

a

username/dn

related

to

the

directory

server.


Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X allows remote attackers to cause a denial of service (incorrect read operation) via crafted data in the Matroska container format.


The xen_failsafe_callback function in Xen for the Linux kernel 2.6.23 and other versions when running a 32-bit PVOPS guest allows local users to cause a denial of service (guest crash) by triggering an iret fault leading to use of an incorrect stack pointer and stack corruption.


The configuration utility in MatrikonOPC Security Gateway 1.0 allows remote attackers to cause a denial of service (unhandled exception and application crash) via a TCP RST packet.


oxenstored in Xen 4.1.x Xen 4.2.x and xen-unstable does not properly consider the state of the Xenstore ring during read operations which allows guest OS users to cause a denial of service (daemon crash and host-control outage or memory consumption) or obtain sensitive control-plane data by leveraging guest administrative access.


expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function which allows remote attackers to cause a denial of service (resource consumption) send HTTP requests to intranet servers or read arbitrary files via a crafted XML document aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion the responsibility for resolving this issue lies with application developers; according to this argument this entry should be REJECTed and each affected application would need its own CVE.


The WCF Replace function in the Open Data (aka OData) protocol implementation in Microsoft .NET Framework 3.5 3.5 SP1 3.5.1 and 4 and the Management OData IIS Extension on Windows Server 2012 allows remote attackers to cause a denial of service (resource consumption and daemon restart) via crafted values in HTTP requests aka \Replace Denial of Service Vulnerability.\


The try_parse_v4_netmask function in hostmask.c in IRCD-Hybrid before 8.0.6 does not properly validate masks which allows remote attackers to cause a denial of service (crash) via a mask that causes a negative number to be parsed.


The get_page_type function in xen/arch/x86/mm.c in Xen 4.2 when debugging is enabled allows local PV or HVM guest administrators to cause a denial of service (assertion failure and hypervisor crash) via unspecified vectors related to a hypercall.


OpenStack Keystone Essex 2012.1.3 and earlier Folsom 2012.2.3 and earlier and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of service (disk consumption) via many invalid token requests that trigger excessive generation of log entries.


The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3 IOS-XE 2.x through 3.9.xS ASA and PIX 7.x through 9.1 FWSM NX-OS and StarOS before 14.0.50488 does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a (1) unicast or (2) multicast packet aka Bug IDs CSCug34485 CSCug34469 CSCug39762 CSCug63304 and CSCug39795.


389 Directory Server before 1.3.0.4 allows remote attackers to cause a denial of service (crash) via a zero length LDAP control sequence.


The GPU process in Google Chrome OS before 25.0.1364.173 allows attackers to cause a denial of service or possibly have unspecified other impact via vectors related to an \overflow.\


The do_hvm_op function in xen/arch/x86/hvm/hvm.c in Xen 4.2.x on the x86_32 platform does not prevent HVM_PARAM_NESTEDHVM (aka nested virtualization) operations which allows guest OS users to cause a denial of service (long-duration page mappings and host OS crash) by leveraging administrative access to an HVM guest in a domain with a large number of VCPUs.


cachemgr.cgi in Squid 3.1.x and 3.2.x possibly 3.1.22 3.2.4 and other versions allows remote attackers to cause a denial of service (resource consumption) via a crafted request. NOTE: this issue is due to an incorrect fix for CVE-2012-5643 possibly involving an incorrect order of arguments or incorrect comparison.


The Image module in Drupal 7.x before 7.20 allows remote attackers to cause a denial of service (CPU and disk space consumption) via a large number of new derivative requests.


The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause a denial of service or write to arbitrary files via a symlink attack on /tmp/fedora-business-cards-buffer.svg.


Invensys Wonderware Information Server (WIS) 4.0 SP1SP1 4.5- Portal and 5.0- Portal allows remote attackers to read arbitrary files send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains which allows remote authenticated storage admins to cause a denial of service (free space consumption of other storage domains) via unspecified vectors.


IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted pty request.


The form library in Django 1.3.x before 1.3.6 1.4.x before 1.4.4 and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.


Google V8 before 3.14.5.3 as used in Google Chrome before 24.0.1312.52 does not properly implement garbage collection which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code.


The

function

in

the

PCI

backend

driver

(drivers/xen/pciback/conf_space_capability_msi.c)

in

Xen

for

the

Linux

kernel

and

allows

guest

OS

users

with

PCI

device

access

to

cause

a

denial

of

service

via

a

large

number

of

kernel

log

messages.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


The AMPQ dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


Use-after-free vulnerability in the DOM implementation in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper tracking of which document owns an Attr object.


Use-after-free vulnerability in Blink as used in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to inline-block rendering for bidirectional Unicode text in an element isolated from its siblings.


Triangle MicroWorks SCADA Data Gateway 2.50.0309 through 3.00.0616 DNP3 .NET Protocol components 3.06.0.171 through 3.15.0.369 and DNP3 C libraries 3.06.0000 through 3.15.0000 allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line.


Use-after-free vulnerability in the XSLStyleSheet::compileStyleSheet function in core/xml/XSLStyleSheetLibxslt.cpp in Blink as used in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of post-failure recompilation in unspecified libxslt versions.


Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the (1) compareBase64StringToRaw (2) DSIGAlgorithmHandlerDefault or (3) DSIGAlgorithmHandlerDefault::verify functions.


NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow physically proximate attackers to cause a denial of service (driver crash and process restart) via crafted input over a serial line.


The DNP3 component in Cooper Power Systems SMP 4 4/DP and 16 gateways allows remote attackers to cause a denial of service (reboot or link outage) via a crafted DNP3 TCP packet.


The DNP3 Slave service in SUBNET Solutions SubSTATION Server 2.7.0033 and 2.8.0106 allows remote attackers to cause a denial of service (unhandled exception and process crash) via unspecified vectors.


The Schneider Electric M340 BMXNOE01xx and BMXP3420xx PLC modules allow remote authenticated users to cause a denial of service (module crash) via crafted FTP traffic as demonstrated by the FileZilla FTP client.


The dissect_diagnosticrequest function in epan/dissectors/packet-reload.c in the REsource LOcation And Discovery (aka RELOAD) dissector in Wireshark 1.8.x before 1.8.6 uses an incorrect integer data type which allows remote attackers to cause a denial of service (infinite loop) via crafted integer values in a packet.


The avcodec_decode_audio4 function in utils.c in libavcodec in FFmpeg before 1.1.3 does not verify the decoding state before proceeding with certain skip operations which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted audio data.


Cisco IOS XE 3.4 before 3.4.5S and 3.5 through 3.7 before 3.7.1S on 1000 series Aggregation Services Routers (ASR) does not properly implement the Cisco Multicast Leaf Recycle Elimination (MLRE) feature which allows remote attackers to cause a denial of service (card reload) via fragmented IPv6 MVPN (aka MVPNv6) packets aka Bug ID CSCub34945 a different vulnerability than CVE-2013-1164.


The CSN.1 dissector in Wireshark 1.8.x before 1.8.6 does not properly manage function pointers which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


Use-after-free vulnerability in International Components for Unicode (ICU) as used in Google Chrome before 30.0.1599.66 and other products allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


The master-station DNP3 driver before driver19.exe and Beta2041.exe in IOServer allows remote attackers to cause a denial of service (infinite loop) via crafted DNP3 packets to TCP port 20000.


The streaming XML parser in Apache CXF 2.5.x before 2.5.10 2.6.x before 2.6.7 and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements (2) attributes (3) nested constructs and possibly other vectors.


The (1) GetDatabase and (2) _XimParseStringFile functions in X.org libX11 1.5.99.901 (1.6 RC1) and earlier do not restrict the recursion depth when processing directives to include files which allows X servers to cause a denial of service (stack consumption) via a crafted file.


drivers/hid/hid-lenovo-tpkbd.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 when CONFIG_HID_LENOVO_TPKBD is enabled allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.


Double free vulnerability in the virConnectListAllInterfaces method in interface/interface_backend_netcf.c in libvirt 1.0.6 allows remote attackers to cause a denial of service (libvirtd crash) via a filtering flag that causes an interface to be skipped as demonstrated by the \virsh iface-list --inactive\ command.


Triangle Research International (aka Tri) Nano-10 PLC devices with firmware before r81 use an incorrect algorithm for bounds checking of data in Modbus/TCP packets which allows remote attackers to cause a denial of service (networking outage) via a crafted packet to TCP port 502.


Google Chrome before 27.0.1453.110 on Windows provides an incorrect handle to a renderer process in unspecified circumstances which allows remote attackers to cause a denial of service or possibly have other impact via unknown vectors.


The CTransaction::FetchInputs method in bitcoind and Bitcoin-Qt before 0.8.0rc1 copies transactions from disk to memory without incrementally checking for spent prevouts which allows remote attackers to cause a denial of service (disk I/O consumption) via a Bitcoin transaction with many inputs corresponding to many different parts of the stored block chain.


The Search component in IBM WebSphere Commerce 7.0 FP4 through FP6 in certain search-term association configurations allows remote attackers to cause a denial of service via a crafted query.


pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.


The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a connection.


main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2 10.x before 10.12.2 and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values which allows remote attackers to conduct stack-consumption attacks and cause a denial of service (daemon crash) via a crafted HTTP POST request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-5976.


drivers/hid/hid-sony.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 when CONFIG_HID_SONY is enabled allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.


The msrle_decode_8_16_24_32 function in msrledec.c in libavcodec in FFmpeg through 1.1.3 does not properly determine certain end pointers which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted Microsoft RLE data.


libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2 9.8.5 before 9.8.5b2 9.9.x before 9.9.2-P2 and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression as demonstrated by a memory-exhaustion attack against a machine running a named process.


The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26 1.6.x before 1.6.12 and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.


Schweitzer Engineering Laboratories (SEL) SEL-2241 SEL-3505 and SEL-3530 RTAC master devices allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line.


Siemens SIMATIC S7-1200 PLCs 2.x and 3.x allow remote attackers to cause a denial of service (defect-mode transition and control outage) via crafted packets to UDP port 161 (aka the SNMP port).


OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple long requests.


The Hook_Terminate function in chrome_frame/protocol_sink_wrap.cc in the Google Chrome Frame plugin before 26.0.1410.28 for Internet Explorer does not properly handle attach tab requests which allows user-assisted remote attackers to cause a denial of service (application crash) via an _blank value for the target attribute of an A element.


Mambo CMS 4.6.5 allows remote attackers to cause a denial of service (memory and bandwidth consumption) by uploading a crafted file.


Use-after-free

vulnerability

in

the

RenderBlock::collapseAnonymousBlockChild

function

in

in

the

DOM

implementation

in

Blink

as

used

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

by

leveraging

incorrect

handling

of

parent-child

relationships

for

anonymous

blocks.


bitcoind and Bitcoin-Qt 0.8.0 and earlier allow remote attackers to cause a denial of service (electricity consumption) by mining a block to create a nonstandard Bitcoin transaction containing multiple OP_CHECKSIG script opcodes.


HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19 when configured to use hdr_ip or other \hdr_*\ functions with a negative occurrence count allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values related to the MAX_HDR_HISTORY variable.


The qemu driver (qemu/qemu_driver.c) in libvirt before 1.1.1 allows remote authenticated users to cause a denial of service (daemon crash) via unspecified vectors involving \multiple events registration.\


Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions for the target storage domain which allows attackers to cause a denial of service (disk space consumption) by cloning a VM from a snapshot.


Use-after-free vulnerability in the O3D plug-in in Google Chrome OS before 26.0.1410.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper management of ownership relationships involving Elements and DrawElements.


drivers/hid/hid-steelseries.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 when CONFIG_HID_STEELSERIES is enabled allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.


drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 when CONFIG_HID_ZEROPLUS is enabled allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.


The dispatch_discard_io function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation in the Linux kernel before 3.10.5 allows guest OS users to cause a denial of service (data loss) via filesystem write operations on a read-only disk that supports the (1) BLKIF_OP_DISCARD (aka discard or TRIM) or (2) SCSI UNMAP feature.


Use-after-free vulnerability in the Document::finishedParsing function in core/dom/Document.cpp in Blink as used in Google Chrome before 29.0.1547.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via an onload event that changes an IFRAME element so that its src attribute is no longer an XML document leading to unintended garbage collection of this document.


The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journal filesystems which allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media as demonstrated by the e2fsprogs tests/f_orphan_extents_inode/image.gz test.


The DNP3 component in Cooper Power Systems SMP 4 4/DP and 16 gateways allows physically proximate attackers to cause a denial of service (reboot or link outage) via crafted input over a serial line.


The acn_add_dmp_data function in epan/dissectors/packet-acn.c in the ACN dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via an invalid count value in ACN_DMP_ADT_D_RE DMP data.


Use-after-free vulnerability in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to not properly considering focus during the processing of JavaScript events in the presence of a multiple-fields input type.


Double free vulnerability in the ResourceFetcher::didLoadResource function in core/fetch/ResourceFetcher.cpp in the resource loader in Blink as used in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering certain callback processing during the reporting of a resource entry.


Use-after-free

vulnerability

in

in

the

Web

Audio

implementation

in

Blink

as

used

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

unknown

vectors.


The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k as used in DNPDrv.exe (aka the DNP master station server) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line.


The Kepware DNP Master Driver for the KEPServerEX Communications Platform before 5.12.140.0 allows remote attackers to cause a denial of service (master-station infinite loop) via crafted DNP3 packets to TCP port 20000 and allows physically proximate attackers to cause a denial of service (master-station infinite loop) via crafted input over a serial line.


The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 1.1.3 does not validate the relationship between luma depth and chroma depth which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted H.264 data.


in

the

REsource

LOcation

And

Discovery

(aka

RELOAD)

dissector

in

Wireshark

before

uses

incorrect

integer

data

types

which

allows

remote

attackers

to

cause

a

denial

of

service

(infinite

loop)

via

crafted

integer

values

in

a

packet

related

to

the

and

functions

a

different

vulnerability

than


Use-after-free vulnerability in the color-chooser dialog in Google Chrome before 30.0.1599.66 on Windows allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to color_chooser_dialog.cc and color_chooser_win.cc in browser/ui/views/.


OpenStack Compute (Nova) Folsom Grizzly and Havana does not verify the virtual size of a QCOW2 image which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount of data.


A certain Red Hat patch for the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 allows local users to cause a denial of service (invalid free operation and system crash) or possibly gain privileges via a sendmsg system call with the IP_RETOPTS option as demonstrated by hemlock.c. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-3552.


A certain Red Hat patch to the do_filp_open function in fs/namei.c in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle failure to obtain write permissions which allows local users to cause a denial of service (system crash) by leveraging access to a filesystem that is mounted read-only.


Use-after-free vulnerability in core/xml/XMLHttpRequest.cpp in Blink as used in Google Chrome before 30.0.1599.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger multiple conflicting uses of the same XMLHttpRequest object.


MatrikonOPC SCADA DNP3 OPC Server 1.2.0 allows remote attackers to cause a denial of service (master-station daemon crash) via a malformed DNP3 TCP packet from the IP address of an outstation.


The dissect_hartip function in epan/dissectors/packet-hartip.c in the HART/IP dissector in Wireshark 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (infinite loop) via a packet with a header that is too short.


The DNP Master Driver in Software Toolbox TOP Server before 5.12.140.0 allows remote attackers to cause a denial of service (master-station infinite loop) via crafted DNP3 packets to TCP port 20000 and allows physically proximate attackers to cause a denial of service (master-station infinite loop) via crafted input over a serial line.


The ip6_sk_dst_check function in net/ipv6/ip6_output.c in the Linux kernel before 3.10 allows local users to cause a denial of service (system crash) by using an AF_INET6 socket for a connection to an IPv4 interface.


The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before 3.7.4 does not properly support a certain non-streaming option which allows local users to cause a denial of service (system crash) by sending a large amount of network traffic through a USB/Ethernet adapter.


Use-after-free vulnerability in the XSLT ProcessingInstruction implementation in Blink as used in Google Chrome before 29.0.1547.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to an applyXSLTransform call involving (1) an HTML document or (2) an xsl:processing-instruction element that is still in the process of loading.


arch/x86/kernel/cpu/perf_event_intel.c in the Linux kernel before 3.8.9 when the Performance Events Subsystem is enabled specifies an incorrect bitmask which allows local users to cause a denial of service (general protection fault and system crash) by attempting to set a reserved bit.


The Human Interface Device (HID) subsystem in the Linux kernel through 3.11 when CONFIG_LOGITECH_FF CONFIG_LOGIG940_FF or CONFIG_LOGIWHEELS_FF is enabled allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device related to (1) drivers/hid/hid-lgff.c (2) drivers/hid/hid-lg3ff.c and (3) drivers/hid/hid-lg4ff.c.


The

deepGetOrCreateNode

function

in

in

org.apache.sling.servlets.post.bundle

and

in

Apache

Sling

does

not

properly

handle

a

value

that

returned

when

the

session

does

not

have

permissions

to

the

root

node

which

allows

remote

attackers

to

cause

a

denial

of

service

(infinite

loop)

via

unspecified

vectors.


The IMAP functionality in Dovecot before 2.2.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via invalid APPEND parameters.


MatrikonOPC SCADA DNP3 OPC Server 1.2.2.0 and earlier allows remote attackers to cause a denial of service (infinite loop) via a malformed DNP3 packet.


The DNP Master Driver in Alstom e-terracontrol 3.5 3.6 and 3.7 allows physically proximate attackers to cause a denial of service (infinite loop and DNP3 service disruption) via crafted input over a serial line.


The DNP3 driver in IOServer drivers 1.0.19.0 allows remote attackers to cause a denial of service (infinite loop) or obtain unspecified control via crafted data to TCP port 20000.


wp-includes/class-phpass.php in WordPress 3.5.1 when a password-protected post exists allows remote attackers to cause a denial of service (CPU consumption) via a crafted value of a certain wp-postpass cookie.


The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion which allows remote attackers to cause a denial of service (system crash) by leveraging lack of skb consumption in conjunction with a double-free error.


Integer signedness error in the dissect_mount_dirpath_call function in epan/dissectors/packet-mount.c in the Mount dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 when nfs_file_name_snooping is enabled allows remote attackers to cause a denial of service (application crash) via a negative length value.


Cooper Power Systems Cybectec DNP3 Master OPC Server allows remote attackers to cause a denial of service (unhandled exception and process crash) via unspecified vectors.


The DNP3 service in the Outstation component on Elecsys Director Gateway devices with kernel 2.6.32.11ael1 and earlier allows remote attackers to cause a denial of service (CPU consumption and communication outage) via crafted input.


An unspecified buffer-read method in IBM Sterling Control Center (SCC) 5.2 before 5.2.0.9 5.3 before 5.3.0.4 and 5.4 through 5.4.0.1 allows remote authenticated users to cause a denial of service via a large file that lacks end-of-line characters.


Use-after-free

vulnerability

in

the

PepperInProcessRouter::SendToHost

function

in

in

the

Pepper

Plug-in

API

(PPAPI)

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

involving

a

resource-destruction

message.


NovaTech Orion Substation Automation Platform OrionLX DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier and Orion5/Orion5r DNP Master 1.27.38 and DNP Slave 1.23.10 and earlier allow remote attackers to cause a denial of service (driver crash and process restart) via a crafted DNP3 TCP packet.


The FCSP dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


Google Chrome before 27.0.1453.93 does not properly perform a cast of an unspecified variable during handling of clipboard data which allows remote attackers to cause a denial of service or possibly have other impact via unknown vectors.


Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \config\ file in a directory with a predictable name in /tmp/ before it is used by the gem.


Use-after-free vulnerability in the HTMLFormElement::prepareForSubmission function in core/html/HTMLFormElement.cpp in Blink as used in Google Chrome before 30.0.1599.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to submission for FORM elements.


Triangle MicroWorks SCADA Data Gateway 2.50.0309 through 3.00.0616 DNP3 .NET Protocol components 3.06.0.171 through 3.15.0.369 and DNP3 C libraries 3.06.0000 through 3.15.0000 allow remote attackers to cause a denial of service (infinite loop) via a crafted DNP3 TCP packet.


The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.


Monkey HTTP Daemon (monkeyd) before 1.2.2 allows remote attackers to cause a denial of service (infinite loop) via an offset equal to the file size in the Range HTTP header.


The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal when using the login delay option allows remote attackers to cause a denial of service (CPU consumption) via a large number of failed login attempts.


The RTPS and RTPS2 dissectors in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 allow remote attackers to cause a denial of service (application crash) via a malformed packet.


Schneider Electric StruxureWare SCADA Expert Vijeo Citect 7.40 Vijeo Citect 7.20 through 7.30SP1 CitectSCADA 7.20 through 7.30SP1 StruxureWare PowerSCADA Expert 7.30 through 7.30SR1 and PowerLogic SCADA 7.20 through 7.20SR1 do not properly handle exceptions which allows remote attackers to cause a denial of service via a crafted packet.


Use-after-free vulnerability in core/html/HTMLTemplateElement.cpp in Blink as used in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that operates on a TEMPLATE element.


Schneider Electric Vijeo Citect 7.20 and earlier CitectSCADA 7.20 and earlier and PowerLogic SCADA 7.20 and earlier allow remote attackers to read arbitrary files send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


The vmx_set_uc_mode function in Xen 3.3 through 4.3 when disabling caches allows local HVM guests with access to memory mapped I/O regions to cause a denial of service (CPU consumption and possibly hypervisor or guest kernel panic) via a crafted GFN range.


Use-after-free vulnerability in the XMLDocumentParser::append function in core/xml/parser/XMLDocumentParser.cpp in Blink as used in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving an XML document.


** DISPUTED ** The Schneider Electric M340 PLC modules allow remote attackers to cause a denial of service (resource consumption) via unspecified vectors. NOTE: the vendor reportedly disputes this issue because it \could not be duplicated\ and \an attacker could not remotely exploit this observed behavior to deny PLC control functions.\


The CIMD dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (application crash) via a malformed packet.


The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k as used in DNPDrv.exe (aka the DNP master station server) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX allow remote attackers to cause a denial of service (infinite loop) via a crafted DNP3 TCP packet.


HP Smart Zero Core 4.3 and 4.3.1 on the t410 All-in-One Smart Zero Client t410 Smart Zero Client t510 Flexible Thin Client t5565z Smart Client t610 Flexible Thin Client and t610 PLUS Flexible Thin Client allows local users to obtain sensitive information modify data or cause a denial of service via unknown vectors.


The TCP dissector in Wireshark 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (application crash) via a malformed packet.


The DNP Master Driver in the OSIsoft PI Interface before 3.1.2.54 for DNP3 allows remote attackers to cause a denial of service (interface shutdown) via a crafted TCP packet.


Use-after-free

vulnerability

in

the

IndentOutdentCommand::tryIndentingAsListItem

function

in

in

Blink

as

used

in

Google

Chrome

before

allows

user-assisted

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

related

to

list

elements.


Schweitzer Engineering Laboratories (SEL) SEL-2241 SEL-3505 and SEL-3530 RTAC master devices allow remote attackers to cause a denial of service (infinite loop) via a crafted DNP3 TCP packet.


The dissect_mpls_echo_tlv_dd_map function in epan/dissectors/packet-mpls-echo.c in the MPLS Echo dissector in Wireshark 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (infinite loop) via invalid Sub-tlv data.


OpenSMTPD before 5.3.2 does not properly handle SSL sessions which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.


Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x 3.3.x and earlier and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate.


http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0 when proxy_pass is used with untrusted HTTP servers allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response a similar vulnerability to CVE-2013-2028.


The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment offset before invoking the reassembly state machine which allows remote attackers to cause a denial of service (application crash) via a large offset value that triggers write access to an invalid memory location.


Use-after-free vulnerability in the HTMLMediaElement::didMoveToNewDocument function in core/html/HTMLMediaElement.cpp in Blink as used in Google Chrome before 29.0.1547.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving moving a (1) AUDIO or (2) VIDEO element between documents.


drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 when CONFIG_HID_PANTHERLORD is enabled allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.


The OSIsoft PI Interface for IEEE C37.118 before 1.0.6.158 allows remote attackers to cause a denial of service (instance shutdown and data-collection outage) via crafted C37.118 configuration packets that trigger an invalid read operation.


libdns in ISC DHCP 4.2.x before 4.2.5-P1 allows remote name servers to cause a denial of service (memory consumption) via vectors involving a regular expression as demonstrated by a memory-exhaustion attack against a machine running a dhcpd process a related issue to CVE-2013-2266.


The DNP Master Driver in the OSIsoft PI Interface before 3.1.2.54 for DNP3 allows physically proximate attackers to cause a denial of service (interface shutdown) via crafted input over a serial line.


The protocol-inspection feature on Cisco Adaptive Security Appliances (ASA) devices does not properly implement the idle timeout which allows remote attackers to cause a denial of service (connection-table exhaustion) via crafted requests that use an inspected protocol aka Bug ID CSCuh13899.


The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted GIF data.


resolver.c in ISC BIND 9.8.5 before 9.8.5-P1 9.9.3 before 9.9.3-P1 and 9.6-ESV-R9 before 9.6-ESV-R9-P1 when a recursive resolver is configured allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a record in a malformed zone.


Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.x before 9.2(1) allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets to port (1) 61615 or (2) 61616 aka Bug ID CSCtz90114.


Microsoft .NET Framework 2.0 SP2 3.5 3.5 SP1 3.5.1 4 and 4.5 allows remote attackers to cause a denial of service (application crash or hang) via crafted character sequences in JSON data aka \JSON Parsing Vulnerability.\


The Lookout Mobile Security application before 8.17-8a39d3f for Android allows attackers to cause a denial of service (application crash) via a crafted application that sends an intent to com.lookout.security.ScanTell with zero arguments.


A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.


Memory leak in the CLI component on Cisco Unified Computing System (UCS) 6100 Fabric Interconnect devices in certain situations that lack a SPAN session allows local users to cause a denial of service (memory consumption and device reset) via a (1) \show monitor session all\ or (2) \show monitor session\ command aka Bug ID CSCug20103.


The HTTPSTK service in the novell-nrm package before 2.0.2-297.305.302.3 in Novell Open Enterprise Server 2 (OES 2) Linux and OES 11 Linux Gold and SP1 does not make the intended SSL_free and SSL_shutdown calls for the close of a TCP connection which allows remote attackers to cause a denial of service (service crash) by establishing many TCP connections to port 8009.


A SQL stored procedure in the Universal Cache component in IBM solidDB 6.0.x before 6.0.1070 6.3.x before 6.3.0.56 6.5.x before 6.5.0.12 and 7.0.x before 7.0.0.4 allows remote authenticated users to cause a denial of service (uninitialized-memory access and daemon crash) via a call that includes named arguments and default parameter values but does not include all of the expected arguments.


The IDSM-2 drivers in Cisco Intrusion Prevention System (IPS) Software on Cisco Catalyst 6500 devices with an IDSM-2 module allow remote attackers to cause a denial of service (device hang) via malformed IPv4 TCP packets aka Bug ID CSCuh27460.


The management GUI in the web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013 7.5 before 7.5.0-838 and 7.7 before 7.7.0-602; Email Security Appliance devices before 7.1.5-106 and 7.3 7.5 and 7.6 before 7.6.3-019; and Content Security Management Appliance devices before 7.9.1-102 and 8.0 before 8.0.0-404 allows remote attackers to cause a denial of service (system hang) via a series of (1) HTTP or (2) HTTPS requests to a management interface aka Bug IDs CSCzv58669 CSCzv63329 and CSCzv78669.


The

TrustGo

Antivirus

Mobile

Security

application

before

for

Android

allows

attackers

to

cause

a

denial

of

service

(application

crash)

via

a

crafted

application

that

sends

an

intent

to

com.trustgo.mobile.security.USSDScannerActivity

with

zero

arguments.


The dissect_ccp_bsdcomp_opt function in epan/dissectors/packet-ppp.c in the PPP CCP dissector in Wireshark 1.8.x before 1.8.7 does not terminate a bit-field list which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote attackers to cause a denial of service (WebPlayer Firefox extension crash) via a crafted Audio Visual (AV) session.


socat 1.2.0.0 before 1.7.2.2 and 2.0.0-b1 before 2.0.0-b6 when used for a listen type address and the fork option is enabled allows remote attackers to cause a denial of service (file descriptor consumption) via multiple request that are refused based on the (1) sourceport (2) lowport (3) range or (4) tcpwrap restrictions.


Cisco Adaptive Security Appliance (ASA) Software 8.4.x before 8.4(3) and 8.6.x before 8.6(1.3) does not properly manage memory upon an AnyConnect SSL VPN client disconnection which allows remote attackers to cause a denial of service (memory consumption and forwarding outage or system hang) via packets to the disconnected machine's IP address aka Bug ID CSCtt36737.


Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allow remote attackers to cause a denial of service (daemon hang) via a web-service request containing a crafted X.509 certificate that is not properly handled during validation aka \Digital Signatures Vulnerability.\


Cisco Hosted Collaboration Mediation allows remote attackers to cause a denial of service (CPU consumption) via a flood of malformed UDP packets on port 162 aka Bug ID CSCug85756.


bitcoind and Bitcoin-Qt before 0.4.9rc2 0.5.x before 0.5.8rc2 0.6.x before 0.6.5rc2 and 0.7.x before 0.7.3rc2 and wxBitcoin do not properly consider whether a block's size could require an excessive number of database locks which allows remote attackers to cause a denial of service (split) and enable certain double-spending capabilities via a large block that triggers incorrect Berkeley DB locking.


The servlet gateway in IBM Cognos Business Intelligence 8.4.1 before IF3 10.1.0 before IF4 10.1.1 before IF4 10.2.0 before IF4 10.2.1 before IF2 and 10.2.1.1 before IF1 allows remote attackers to cause a denial of service (temporary gateway outage) via crafted HTTP requests.


Cisco Intrusion Prevention System (IPS) Software on IPS NME devices before 7.0(9)E4 allows remote attackers to cause a denial of service (device reload) via malformed IPv4 packets that trigger incorrect memory allocation aka Bug ID CSCua61977.


plugins/system/remember/remember.php in Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 does not properly handle an object obtained by unserializing a cookie which allows remote authenticated users to conduct PHP object injection attacks and cause a denial of service via unspecified vectors.


Cisco Unified Communications Domain Manager does not properly allocate memory for GET and POST requests which allows remote authenticated users to cause a denial of service (memory consumption and process crash) via crafted requests to the management interface aka Bug ID CSCud22922.


Memory leak in Cisco Unified Communications Manager IM and Presence Service before 8.6(5)SU1 and 9.x before 9.1(2) and Cisco Unified Presence allows remote attackers to cause a denial of service (memory and CPU consumption) by making many TCP connections to port (1) 5060 or (2) 5061 aka Bug ID CSCud84959.


The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.


The OpenManage web application 2.5 build 1.19 on Dell PowerConnect 3348 1.2.1.3 3524p 2.0.0.48 and 5324 2.0.1.4 switches allows remote authenticated users to cause a denial of service (device reset) via a direct request to an unspecified OSPF URL.


epan/dissectors/packet-gtpv2.c in the GTPv2 dissector in Wireshark 1.8.x before 1.8.7 calls incorrect functions in certain contexts related to ciphers which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


Microsoft .NET Framework 2.0 SP2 3.5 3.5 SP1 3.5.1 4 and 4.5 does not properly parse a DTD during XML digital-signature validation which allows remote attackers to cause a denial of service (application crash or hang) via a crafted signed XML document aka \Entity Expansion Vulnerability.\


Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.x before 9.2(1) allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets to port 44444 aka Bug ID CSCtz92776.


The dissect_dsmcc_un_download function in epan/dissectors/packet-mpeg-dsmcc.c in the MPEG DSM-CC dissector in Wireshark 1.8.x before 1.8.7 uses an incorrect format string which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


The Cisco Unified IP Conference Station 7937G allows remote attackers to cause a denial of service (networking outage) via a flood of TCP packets aka Bug ID CSCuh42052.


** DISPUTED ** The Zend Engine in PHP before 5.4.16 RC1 and 5.5.0 before RC2 does not properly determine whether a parser error occurred which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition as demonstrated by an attack within a shared web-hosting environment. NOTE: the vendor's http://php.net/security-note.php page says \for critical security situations you should be using OS-level security by running multiple web servers each as their own user id.\


The RIP process in Cisco IOS XR allows remote attackers to cause a denial of service (process crash) via a crafted version-2 RIP packet aka Bug ID CSCue46731.


The Cisco Unified IP Phone 8945 with software 9.3(2) allows remote attackers to cause a denial of service (device hang) via a malformed PNG file aka Bug ID CSCud04270.


AirLive POE-2600HD allows remote attackers to cause a denial of service (device reset) via a long URL.


The IronPort Spam Quarantine (ISQ) component in the web framework in IronPort AsyncOS on Cisco Email Security Appliance devices before 7.1.5-106 and 7.3 7.5 and 7.6 before 7.6.3-019 and Content Security Management Appliance devices before 7.9.1-102 and 8.0 before 8.0.0-404 allows remote attackers to cause a denial of service (service crash or hang) via a high rate of TCP connection attempts aka Bug IDs CSCzv25573 and CSCzv81712.


The firewall subsystem in Cisco Identity Services Engine has an incorrect rule for open ports which allows remote attackers to cause a denial of service (CPU consumption or process crash) via a flood of malformed IP packets aka Bug ID CSCug94572.


The Sharp AQUOS PhotoPlayer HN-PP150 with firmware before 1.04.00.04 allows remote attackers to cause a denial of service (networking outage) via crafted packet data.


The Web Administrator Interface on Cisco Wireless LAN Controller (WLC) devices allows remote authenticated users to cause a denial of service (device crash) by leveraging membership in the Full Manager managers group Read Only managers group or Lobby Ambassador managers group and sending a request that (1) lacks a parameter value or (2) contains a malformed parameter value aka Bug IDs CSCuh14313 CSCuh14159 CSCuh14368 and CSCuh14436.


The Next-Generation Firewall (aka NGFW formerly CX Context-Aware Security) module 9.x before 9.1.1.9 and 9.1.2.x before 9.1.2.12 for Cisco Adaptive Security Appliances (ASA) devices allows remote attackers to cause a denial of service (device reload or traffic-processing outage) via fragmented (1) IPv4 or (2) IPv6 traffic aka Bug ID CSCue88387.


Memory leak in Cisco Unified Communications Manager (Unified CM) 8.5(x) before 8.5(1)su6 8.6(x) before 8.6(2a)su3 and 9.x before 9.1(1) allows remote attackers to cause a denial of service (service disruption) via a high rate of UDP packets aka Bug ID CSCub85597.


The rle_unpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly use the bytestream2 API which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted RLE data. NOTE: the vendor has listed this as an issue fixed in 1.2.1 but the issue is actually in new code that was not shipped with the 1.2.1 release or any earlier release.


The dissect_ber_choice function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does not properly initialize a certain variable which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a buffer which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted CD Graphics Video data.


Multiple integer signedness errors in the tvb_unmasked function in epan/dissectors/packet-websocket.c in the Websocket dissector in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (application crash) via a malformed packet.


FrameworkService.exe in McAfee Framework Service in McAfee Managed Agent (MA) before 4.5.0.1927 and 4.6 before 4.6.0.3258 allows remote attackers to cause a denial of service (service crash) via a malformed HTTP request.


The id1.GetPrinterURLList function in Novell iPrint Client before 5.93 allows remote attackers to cause a denial of service via unspecified vectors.


The Intel VT-d Interrupt Remapping engine in Xen 3.3.x through 4.3.x allows local guests to cause a denial of service (kernel panic) via a malformed Message Signaled Interrupt (MSI) from a PCI device that is bus mastering capable that triggers a System Error Reporting (SERR) Non-Maskable Interrupt (NMI).


Cisco Unified Communications Manager (Unified CM) 8.5(x) and 8.6(x) before 8.6(2a)su3 and 9.x before 9.1(1) does not properly restrict the rate of SIP packets which allows remote attackers to cause a denial of service (memory and CPU consumption and service disruption) via a flood of UDP packets to port 5060 aka Bug ID CSCub35869.


The mk_request_header_process function in mk_request.c in Monkey 1.1.1 allows remote attackers to cause a denial of service (thread crash and service outage) via a '\\0' character in an HTTP request.


The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via crafted data that triggers a log message.


Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows 8 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to cause a denial of service (reboot) via a crafted TrueType font (TTF) file aka \TrueType Font Parsing Vulnerability.\


The fragment_add_seq_common function in epan/reassemble.c in the ASN.1 BER dissector in Wireshark before r48943 has an incorrect pointer dereference during a comparison which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


NetGear WNDR4700 Media Server devices with firmware 1.0.0.34 allow remote attackers to cause a denial of service (device crash).


The Precision Video Engine component in Cisco Jabber for Windows and Cisco Virtualization Experience Media Engine allows remote attackers to cause a denial of service (process crash and call disconnection) via crafted RTP packets aka Bug IDs CSCuh60706 and CSCue21117.


The posix_spawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not properly validate the data for file actions and port actions which allows local users to (1) cause a denial of service (panic) via a size value that is inconsistent with a header count field or (2) obtain sensitive information from kernel heap memory via a certain size value in conjunction with a crafted buffer.


The TCP/IP implementation in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows Server 2012 and Windows RT does not properly perform memory allocation for inbound ICMPv6 packets which allows remote attackers to cause a denial of service (system hang) via crafted packets aka \ICMPv6 Vulnerability.\


The TP-Link IP Cameras TL-SC3171 TL-SC3130 TL-SC3130G TL-SC3171G and possibly other models before beta firmware LM.1.6.18P12_sign6 does not properly restrict access to certain administrative functions which allows remote attackers to (1) cause a denial of service (device reboot) via a request to cgi-bin/reboot or (2) cause a denial of service (reboot and reset to factory defaults) via a request to cgi-bin/hardfactorydefault.


The VBA32 AntiRootKit component for Novell Client 2 SP3 before IR5 on Windows allows local users to cause a denial of service (bugcheck and BSOD) via an IOCTL call for an invalid IOCTL.


The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows Server 2012 and Windows RT does not check whether linked-list traversal is continually accessing the same list member which allows local users to cause a denial of service (infinite traversal) via vectors that trigger a crafted PATHRECORD chain.


RealNetworks RealPlayer 16.0.2.32 and earlier allows remote attackers to cause a denial of service (resource consumption or application crash) via an HTML document containing JavaScript code that constructs a long string.


The web console in Apache ActiveMQ before 5.8.0 does not require authentication which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.


Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.x before 9.2(1) allows remote attackers to cause a denial of service (disk consumption) via a flood of TCP packets to port 5400 leading to large error-log files aka Bug ID CSCua42724.


Cisco Adaptive Security Appliances (ASA) devices when SMP is used do not properly process X.509 certificates which allows remote attackers to cause a denial of service (device crash) via a large volume of (1) SSL or (2) TLS traffic aka Bug ID CSCuh19462.


Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file


A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.


A use-after-free flaw was found in the add_partition in block/partitions/core.c in the Linux kernel. A local attacker with user privileges could cause a denial of service on the system. The issue results from the lack of code cleanup when device_add call fails when adding a partition to the disk.


Large loop in the Kafka dissector in Wireshark 3.6.0 allows denial of service via packet injection or crafted capture file


Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file


Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file


Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file


Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file


Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file


A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected. In this flaw the KVM subsystem may crash the kernel due to mishandling of memory errors that happens during VCPU construction which allows an attacker with special user privilege to cause a denial of service. This flaw affects kernel versions prior to 5.15 rc7.


An issue was discovered in libjpeg through 2020021. An uncaught floating point exception in the function ACLosslessScan::ParseMCU() located in aclosslessscan.cpp. It allows an attacker to cause Denial of Service.


Large loop in the PNRP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file


In reinit of HeifDecoderImpl.cpp there is a possible crash due to a missing null check. This could lead to remote persistent denial of service in the file picker with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-215002587


In sortSimPhoneAccountsForEmergency of CreateConnectionProcessor.java there is a possible prevention of access to emergency calling due to an unhandled exception. In rare instances this could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-208267659


An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6 all versions starting from 14.4 before 14.4.4 all versions starting from 14.5 before 14.5.2. GitLab Maven Package registry is vulnerable to a regular expression denial of service when a specifically crafted string is sent.


Hilinksvc has a Data Processing Errors vulnerability.Successful exploitation of this vulnerability may cause denial of service attacks.


Apprise

is

an

open

source

library

which

allows

you

to

send

a

notification

to

almost

all

of

the

most

popular

notification

services

available.

In

affected

versions

users

who

use

Apprise

granting

them

access

to

the

IFTTT

plugin

(which

just

comes

out

of

the

box)

are

subject

to

a

denial

of

service

attack

on

an

inefficient

regular

expression.

The

vulnerable

regular

expression

is

The

problem

has

been

patched

in

release

version

Users

who

are

unable

to

upgrade

are

advised

to

remove

`apprise/plugins/NotifyIFTTT.py`

to

eliminate

the

service.


NULL pointer exception in the IEEE 802.11 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file


In Package Manger there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-67862680


NULL pointer exception in the IPPUSB dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet injection or crafted capture file


A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6 all versions starting from 14.4 before 14.4.4 all versions starting from 14.5 before 14.5.2 allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted deploy Slash commands


A denial of service vulnerability in GitLab CE/EE affecting all versions starting from 12.0 before 14.3.6 all versions starting from 14.4 before 14.4.4 all versions starting from 14.5 before 14.5.2 allows low-privileged users to bypass file size limits in the NPM package repository to potentially cause denial of service.


Large loop in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file


A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9 all versions starting from 14.1 before 14.1.4 and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.


NULL pointer exception in the Modbus dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file


kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. This only affects applications that use polymorphic serialization with the default tagged polymorphism style. Applications using the property polymorphism style are not affected. YAML input for a polymorphic type that provided a tag but no value for the object would trigger the issue. Version 0.35.3 or later contain the fix for this issue.


IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process. IBM X-Force ID: 213964.


A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user


In Bluetooth there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-205989472


Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file


XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default since it cannot be secured for general purpose.


The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption.


IBM WebSphere Application Server 7.0 8.0 8.5 and 9.0 is vulnerable to a denial of service caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available CPU resources. IBM X-Force ID: 211405.


IBM DataPower Gateway 10.0.2.0 10.0.3.0 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a denial of service by consuming resources with multiple requests. IBM X-Force ID: 208348.


In Contiki 3.0 potential nonterminating acknowledgment loops exist in the Telnet service. When the negotiated options are already disabled servers still respond to DONT and WONT requests with WONT or DONT commands which may lead to infinite acknowledgment loops denial of service and excessive CPU consumption.


IBM SPSS Statistics for Windows 24.0 25.0 26.0 27.0 27.0.1 and 28.0 could allow a local user to cause a denial of service by writing arbitrary files to admin protected directories on the system. IBM X-Force ID: 212046.


Certain NETGEAR devices are affected by denial of service. This affects R6400v2 before 1.0.4.98 R6700v3 before 1.0.4.98 R7900 before 1.0.3.18 and R8000 before 1.0.4.46.


OpenStack Neutron before 16.4.1 17.x before 17.1.3 and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.


The Background service in Allwinner R818 SoC Android Q SDK V1.0 is used to manage background applications. Malicious apps can use the interface provided by the service to set the number of applications allowed to run in the background to 0 and add themselves to the whitelist so that once other applications enter the background they will be forcibly stopped by the system causing a denial of service.


IBM MQ 8.0 9.0 LTS 9.1 LTS 9.2 LTS 9.1 CD and 9.2 CD is vulnerable to a denial of service attack caused by an error processing messages. IBM X-Force ID: 208398.


drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations.


fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection.


net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service (xdr_set_page_base slab-out-of-bounds access) by performing many NFS 4.2 READ_PLUS operations.


Microsoft SharePoint Denial of Service Update


A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursively which will consume stack space and lead to crash.


A Format String vulnerablity exists in TRENDnet TEW-755AP 1.11B03 TEW-755AP2KAC 1.11B03 TEW-821DAP2KAC 1.11B03 and TEW-825DAP 1.11B03 which could let a remote malicious user cause a denial of service due to a logic bug at address 0x40dcd0 when calling fprintf with \%s: key len = %d too long\\n\ format. The two variables seem to be put in the wrong order. The vulnerability could be triggered by sending the POST request to apply_cgi with a long and unknown key in the request body.


The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses allowing attackers in radio range to trigger a denial of service (crash) in ESP32 by flooding the target device with LMP Feature Response data.


Stormshield SNS with versions before 3.7.18 3.11.6 and 4.1.6 has a memory-management defect in the SNMP plugin that can lead to excessive consumption of memory and CPU resources and possibly a denial of service.


MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repeatedly at high speed which results in many SetWindowTextA or SetWindowTextW calls.


An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug it allows a denial of service. When resolving a request with the urn: scheme the parser leaks a small amount of memory. However there is an unspecified attack methodology that can easily trigger a large amount of memory consumption.


Windows Application Compatibility Cache Denial of Service Vulnerability


Adobe After Effects version 18.2 (and earlier) is affected by an Our-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information and cause a denial of service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread but concurrently that SQPOLL thread is waiting for a signal to start aka CID-3ebba796fa25.


Windows Console Driver Denial of Service Vulnerability This CVE ID is unique from CVE-2021-28438.


An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS there is a denial of service. This header can plausibly occur in benign network traffic.


Windows AppX Deployment Server Denial of Service Vulnerability


An issue was discovered in the Linux kernel through 5.11.3 as used with Xen PV. A certain part of the netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931.


A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively which will consume stack space and lead to a crash.


Mintty before 3.4.5 allows remote servers to cause a denial of service (Windows GUI hang) by telling the Mintty window to change its title repeatedly at high speed which results in many SetWindowTextA or SetWindowTextW calls. In other words it does not implement a usleep or similar delay upon processing a title change.


An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.


Windows Console Driver Denial of Service Vulnerability This CVE ID is unique from CVE-2021-28443.


The Bluetooth Classic implementation on JBL TUNE500BT devices does not properly handle the reception of continuous unsolicited LMP responses allowing attackers in radio range to trigger a denial of service and shutdown a device by flooding the target device with LMP Feature Response data.


Windows NTFS Denial of Service Vulnerability


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

denial

of

service

by

exploiting

a

`CHECK`-failure

coming

from

This

is

because

the

assumes

that

the

is

always

a

valid

scalar.

However

an

attacker

can

send

any

other

tensor

as

the

first

argument

of

`LoadAndRemapMatrix`.

This

would

cause

the

rank

`CHECK`

in

`scalar<T>()()`

to

trigger

and

terminate

the

process.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

runtime

division

by

zero

error

and

denial

of

service

in

This

is

because

the

computes

a

divisor

quantity

by

dividing

two

user

controlled

values.

The

user

controls

the

values

of

and

(via

the

`value.shape()`

and

arguments).

If

the

value

in

is

smaller

than

the

then

the

floor

operation

results

in

being

The

line

is

a

no-op

outside

of

debug

mode

so

in

released

versions

of

TF

this

does

not

trigger.

Later

these

computed

values

are

used

as

to

There

the

first

computation

is

a

division

in

a

modulo

operation.

Since

can

be

this

results

in

runtime

crashing.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

runtime

division

by

zero

error

and

denial

of

service

in

`tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`.

This

is

because

the

does

not

validate

all

constraints

specified

in

the

op's

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

Incomplete

validation

in

`SparseReshape`

results

in

a

denial

of

service

based

on

a

`CHECK`-failure.

The

has

no

validation

that

the

input

arguments

specify

a

valid

sparse

tensor.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

and

TensorFlow

as

these

are

the

only

affected

versions.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

denial

of

service

via

a

FPE

runtime

error

in

This

is

because

the

computes

a

divisor

value

from

user

data

but

does

not

check

that

the

result

is

before

doing

the

division.

Since

`data`

is

given

by

the

`values`

argument

is

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

and

TensorFlow

as

these

are

also

affected.


Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it makes to remote Matrix homeservers. A malicious homeserver could return a very large response again leading to memory exhaustion and denial of service. This affects any server which accepts registration requests from untrusted clients. This issue has been patched by releases 89071a1 0523511 f56eee3. As a workaround request sizes can be limited in an HTTP reverse-proxy. There are no known workarounds for the problem with overlarge responses.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

The

operations

fail

to

validate

that

the

input

tensors

are

not

empty.

In

turn

this

would

result

in

a

division

by

This

is

because

the

does

not

check

that

the

divisor

used

in

computing

the

shard

size

is

not

zero.

Thus

if

attacker

controls

the

input

sizes

they

can

trigger

a

denial

of

service

via

a

division

by

zero

error.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

The

implementation

of

triggers

an

undefined

behavior

if

one

of

the

input

tensors

is

empty.

The

code

is

also

vulnerable

to

a

denial

of

service

attack

as

a

`CHECK`

condition

becomes

false

and

aborts

the

process.

The

fails

to

validate

that

input

and

output

tensors

are

not

empty

and

are

of

the

same

rank.

Each

of

these

unchecked

assumptions

is

responsible

for

the

above

issues.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


Db2 for Linux UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200659.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

trigger

a

denial

of

service

via

a

`CHECK`-fail

in

`tf.raw_ops.QuantizeAndDequantizeV4Grad`.

This

is

because

the

does

not

validate

the

rank

of

the

tensors.

In

turn

this

results

in

the

tensors

being

passes

as

they

are

to

However

the

`vec<T>`

method

requires

the

rank

to

and

triggers

a

`CHECK`

failure

otherwise.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

as

this

is

the

only

other

affected

version.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

The

implementation

of

allows

for

stack

overflow

and/or

`CHECK`-fail

based

denial

of

service.

The

fails

to

validate

that

and

arguments

are

valid.

Negative

values

for

can

result

in

stack

overflow

or

`CHECK`-failure

depending

on

the

version

of

Eigen

code

used

to

implement

the

operation.

Similar

behavior

can

be

exhibited

by

invalid

values

of

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

trigger

a

denial

of

service

via

a

`CHECK`-fail

in

This

is

because

the

takes

the

values

specified

in

as

dimensions

for

the

output

shape.

The

`TensorShape`

uses

a

`CHECK`

operation

which

triggers

when

returns

a

non-OK

status.

This

is

a

legacy

implementation

of

the

constructor

and

operations

should

use

`BuildTensorShapeBase`

or

`AddDimWithStatus`

to

prevent

`CHECK`-failures

in

the

presence

of

overflows.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


Db2 for Linux UNIX and Windows (includes Db2 Connect Server) 11.1.4 and 11.5.5 is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. IBM X-Force ID: 200658.


IBM Engineering Requirements Quality Assistant prior to 3.1.3 could allow an authenticated user to cause a denial of service. IBM X-Force ID: 207413.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

Due

to

lack

of

validation

in

an

attacker

can

trigger

denial

of

service

via

segmentation

faults.

The

fails

to

detect

cases

when

the

input

tensor

is

empty

and

proceeds

to

read

data

from

a

buffer.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

trigger

a

denial

of

service

via

a

`CHECK`-fail

in

converting

sparse

tensors

to

CSR

Sparse

matrices.

This

is

because

the

does

a

double

redirection

to

access

an

element

of

an

array

allocated

on

the

heap.

If

the

value

at

`indices(i

is

such

that

`indices(i

is

outside

the

bounds

of

this

results

in

writing

outside

of

bounds

of

heap

allocated

data.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841 12.2-STABLE before r369859 11.4-STABLE before r369866 13.0-RELEASE before p1 12.2-RELEASE before p7 and 11.4-RELEASE before p10 missing message validation in libradius(3) could allow malicious clients or servers to trigger denial of service in vulnerable servers or clients respectively.


IBM AIX 7.1 could allow a non-privileged local user to exploit a vulnerability in the trace facility to expose sensitive information or cause a denial of service. IBM X-Force ID: 200663.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

trigger

a

denial

of

service

via

a

`CHECK`

failure

by

passing

an

empty

image

to

This

is

because

the

uses

assertions

instead

of

to

validate

user

controlled

inputs.

Whereas

allows

returning

an

error

condition

back

to

the

user

the

macros

result

in

a

crash

if

the

condition

is

false

similar

to

`assert`.

In

this

case

`height`

is

from

the

`images`

input.

This

results

in

being

negative

and

the

assertion

being

falsified

followed

by

aborting

program

execution.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

runtime

division

by

zero

error

and

denial

of

service

in

This

is

because

the

computes

a

modulo

operation

without

validating

that

the

divisor

is

not

zero.

Since

is

determined

based

on

input

a

user

can

trigger

scenarios

where

this

quantity

is

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

denial

of

service

via

a

FPE

runtime

error

in

This

is

because

the

performs

a

division

based

on

the

last

dimension

of

the

`x`

tensor.

Since

this

is

controlled

by

the

user

an

attacker

can

trigger

a

denial

of

service.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


GraphHopper

is

an

open-source

Java

routing

engine.

In

GrassHopper

from

version

and

before

version

there

is

a

regular

expression

injection

vulnerability

that

may

lead

to

Denial

of

Service.

This

has

been

patched

in

and

See

this

pull

request

for

the

fix:


matrix-media-repo is an open-source multi-domain media repository for Matrix. Versions 1.2.6 and earlier of matrix-media-repo do not properly handle malicious images which are crafted to be small in file size but large in complexity. A malicious user could upload a relatively small image in terms of file size using particular image formats which expands to have extremely large dimensions during the process of thumbnailing. The server can be exhausted of memory in the process of trying to load the whole image into memory for thumbnailing leading to denial of service. Version 1.2.7 has a fix for the vulnerability.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

trigger

a

denial

of

service

via

a

`CHECK`-fail

in

This

is

because

the

has

a

inserted

to

validate

some

invariants.

When

this

condition

is

false

the

program

aborts

instead

of

returning

a

valid

error

to

the

user.

This

abnormal

termination

can

be

weaponized

in

denial

of

service

attacks.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


IBM MQ 9.1 LTS 9.1 CD 9.2 LTS and 9.2CD is vulnerable to a denial of service attack caused by an issue processing message properties. IBM X-Force ID: 205203.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

An

attacker

can

cause

a

segfault

and

denial

of

service

via

accessing

data

outside

of

bounds

in

This

is

because

the

assumes

the

inputs

are

not

empty.

If

any

of

these

inputs

is

empty

`.flat<T>()`

is

an

empty

buffer

so

accessing

the

element

at

index

is

accessing

data

outside

of

bounds.

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service by exploiting a `CHECK`-failure coming from the implementation of `tf.raw_ops.IRFFT`. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 TensorFlow 2.3.3 TensorFlow 2.2.3 and TensorFlow 2.1.4 as these are also affected and still in supported range.