Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service (CPU consumption) via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associated with nested comments. NOTE: the default configuration in 1.908 mitigates this vulnerability but misparses certain realistic comments.


ntpd in NTP 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the log file.


The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default which allows remote attackers to set NTP to an arbitrary time when started with the -g option or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources and leveraging a resulting denial of service (abort and restart).


The session backends in Django before 1.4.21 1.5.x through 1.6.x 1.7.x before 1.7.9 and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.


The sys_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denial of service (kernel panic).


The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template as demonstrated by file:///dev/zero.


The ff_h263_decode_mba function in libavcodec/ituh263dec.c in Libav before 11.5 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a file with crafted dimensions.


Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux Adobe AIR before 18.0.0.199 Adobe AIR SDK before 18.0.0.199 and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.


Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server which allows remote authenticated users with the Monitor Deployer or Auditor role to cause a denial of service via unspecified vectors.


The Juniper EX4600 QFX3500 QFX3600 and QFX5100 switches with Junos 13.2X51-D15 through 13.2X51-D25 13.2X51 before 13.2X51-D30 and 14.1X53 before 14.1X53-D10 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.


The Application Store component in Apple iOS before 9 allows remote attackers to cause a denial of service to an enterprise-signed app via a crafted ITMS URL.


The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values which allows remote attackers to cause a denial of service (EPOLLET epoll application read outage) via an incorrect checksum in a UDP packet a different vulnerability than CVE-2015-5364.


The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.


The glob implementation in tnftpd (formerly lukemftpd) as used in Apple OS X before 10.11 allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern as demonstrated by multiple instances of the {.. .. ..}/* substring.


The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.


The eap_pwd_process function in eap_server/eap_server_pwd.c in hostapd 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when used with (1) an internal EAP server or (2) a RADIUS server and EAP-pwd is enabled in a runtime configuration which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.


Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12 Acrobat and Acrobat Reader DC Classic before 2015.006.30060 and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to cause a denial of service via invalid data.


Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain and Records per RecordSet quotas when processing an internal zone file transfer which might allow remote attackers to cause a denial of service (infinite loop) via a crafted resource record set.


Vordel XML Gateway (acquired by Axway) version 7.2.2 could allow remote attackers to cause a denial of service via a specially crafted request.


PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to cause a denial of service (assertion failure and server crash) via crafted query packets.


providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner which allows remote authenticated users to cause a denial of service via a duplicate SP name.


The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when EAP-pwd is enabled in a network configuration profile which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.


The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.


The Flow Collector in IBM Security QRadar QFLOW 7.1.x before 7.1 MR2 Patch 11 IF3 and 7.2.x before 7.2.5 Patch 4 IF3 allows remote attackers to cause a denial of service via unspecified packets.


The

contrib.sessions.backends.base.SessionBase.flush

and

functions

in

Django

before

before

and

possibly

other

versions

create

empty

sessions

in

certain

circumstances

which

allows

remote

attackers

to

cause

a

denial

of

service

(session

store

consumption)

via

unspecified

vectors.


providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).


The SRX Network Security Daemon (nsd) in Juniper SRX Series services gateways with Junos 12.1X44 before 12.1X44-D50 12.1X46 before 12.1X46-D35 12.1X47 before 12.1X47-D25 and 12.3X48 before 12.3X48-D15 allows remote DNS servers to cause a denial of service (crash) via a crafted DNS response.


The routed daemon in FreeBSD 9.3 before 9.3-RELEASE-p22 10.2-RC2 before 10.2-RC2-p1 10.2-RC1 before 10.2-RC1-p2 10.2 before 10.2-BETA2-p3 and 10.1 before 10.1-RELEASE-p17 allows remote authenticated users to cause a denial of service (assertion failure and daemon exit) via a query from a network that is not directly connected.


The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23 9.1.x before 9.1.19 9.2.x before 9.2.14 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a \too-short\ salt.


The fasttrap driver in the kernel in Apple OS X before 10.10.5 allows local users to cause a denial of service (resource consumption) via unspecified vectors.


The API server in OpenShift Origin 1.0.5 allows remote attackers to cause a denial of service (master process crash) via crafted JSON data.


HP Systems Insight Manager (SIM) before 7.5.0 as used in HP Matrix Operating Environment before 7.5.0 and other products allows local users to gain privileges and consequently obtain sensitive information modify data or cause a denial of service via unspecified vectors.


Memory leak in the virtual server component in F5 Big-IP LTM AAM AFM Analytics APM ASM GTM Link Controller and PEM 11.5.x before 11.5.1 HF10 11.5.3 before HF1 and 11.6.0 before HF5 BIG-IQ Cloud Device and Security 4.4.0 through 4.5.0 and BIG-IQ ADC 4.5.0 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted ICMP packets.


The debugging feature in the kernel in Apple OS X before 10.11 mismanages state which allows local users to cause a denial of service via unspecified vectors.


ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.


The get_contents function in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20 might allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database.


Juniper

Junos

OS

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(mbuf

and

connection

consumption

and

restart)

via

a

large

number

of

requests

that

trigger

a

TCP

connection

to

move

to

the

state

when

there

is

more

data

to

send.


Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux Adobe AIR before 19.0.0.190 Adobe AIR SDK before 19.0.0.190 and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.


The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href which triggers a large memory allocation.


OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.


The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.


The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option as demonstrated by a modified client that provides a different password for each pam element on this list.


The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote attackers to cause a denial of service (memory consumption) via a large request header.


IBM

WebSphere

Portal

through

through

through

before

and

before

allows

remote

authenticated

users

to

cause

a

denial

of

service

(memory

consumption)

via

a

crafted

document.


Memory

leak

in

the

last

hop

kernel

module

in

BIG-IP

LTM

GTM

and

Link

Controller

before

before

before

and

before

BIG-IP

AAM

before

and

before

BIG-IP

AFM

and

PEM

before

and

before

BIG-IP

Analytics

before

before

and

before

BIG-IP

APM

and

ASM

through

before

before

and

before

BIG-IP

Edge

Gateway

WebAccelerator

and

WOM

before

before

and

BIG-IP

PSM

before

before

and

before

HF

Enterprise

Manager

through

BIG-IQ

Cloud

and

Security

through

BIG-IQ

Device

through

and

BIG-IQ

ADC

might

allow

remote

attackers

to

cause

a

denial

of

service

(memory

consumption)

via

a

large

number

of

crafted

UDP

packets.


Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.


Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role and entering drafts with the editor-autosave feature.


The phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43 5.5.x before 5.5.27 and 5.6.x before 5.6.11 does not validate a file pointer before a close operation which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted TAR archive that is mishandled in a Phar::convertToData call.


The KVM subsystem in the Linux kernel through 4.2.6 and Xen 4.3.x through 4.6.x allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions related to svm.c and vmx.c.


IBM Connections 3.x before 3.0.1.1 CR3 4.0 before CR4 4.5 before CR5 and 5.0 before CR3 does not properly detect recursion during XML entity expansion which allows remote attackers to cause a denial of service (CPU consumption and application crash) via a crafted XML document containing a large number of nested entity references a similar issue to CVE-2003-1564.


The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.


Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.


Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (memory consumption) via a large number of logins that trigger parsing of PAC blobs during Kerberos authentication.


The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to a length field.


The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via crafted query packets.


The protected range register in the EFI component in Apple OS X before 10.11 has an incorrect value which allows attackers to cause a denial of service (boot failure) via a crafted app that writes to an unintended address.


python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.


HP Systems Insight Manager (SIM) before 7.5.0 as used in HP Matrix Operating Environment before 7.5.0 and other products allows remote authenticated users to obtain sensitive information modify data or cause a denial of service via unspecified vectors.


HPE Networking Products originally branded as Comware 5 Comware 7 H3C or HP allow remote attackers to bypass intended access restrictions or cause a denial of service via \Virtual routing and forwarding (VRF) hopping.\


sendd

in

Juniper

Junos

before

before

before

before

before

before

before

before

before

before

before

and

before

when

the

\set

protocols

neighbor-discovery

secure

security-level

default\

option

is

configured

allows

remote

attackers

to

cause

a

denial

of

service

(CPU

consumption)

via

a

crafted

Secure

Neighbor

Discovery

(SEND)

Protocol

packet.


The MSVDX driver in Apple iOS before 8.4.1 allows remote attackers to cause a denial of service (device crash) via a crafted video.


buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) by creating a zone containing a malformed DNSSEC key and issuing a query for a name in that zone.


The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.


in

Apache

HttpComponents

HttpClient

before

ignores

the

http.socket.timeout

configuration

setting

during

an

SSL

handshake

which

allows

remote

attackers

to

cause

a

denial

of

service

(HTTPS

call

hang)

via

unspecified

vectors.


contrib.sessions.middleware.SessionMiddleware

in

Django

before

before

before

and

possibly

other

versions

allows

remote

attackers

to

cause

a

denial

of

service

(session

store

consumption

or

session

record

removal)

via

a

large

number

of

requests

to

contrib.auth.views.logout

which

triggers

the

creation

of

an

empty

session

record.


Teradata Gateway before 15.00.03.02-1 and 15.10.x before 15.10.00.01-1 and TD Express before 15.00.02.08_Sles10 and 15.00.02.08_Sles11 allow remote attackers to cause a denial of service (database crash) via a malformed CONFIG REQUEST message.


AxiomSL's Axiom java applet module (used for editing uploaded Excel files and associated Java RMI services) 9.5.3 and earlier allows remote attackers to (1) access data of other basic users through arbitrary SQL commands (2) perform a horizontal and vertical privilege escalation (3) cause a Denial of Service on global application or (4) write/read/delete arbitrary files on server hosting the application.


The BER decoder in Botan 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (application crash) via an empty BIT STRING in ASN.1 data.


The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.


validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.


The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.


Dell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request.


The regular-expression implementation in Google V8 as used in Google Chrome before 44.0.2403.89 mishandles interrupts which allows remote attackers to cause a denial of service (application crash) via crafted JavaScript code as demonstrated by an error in garbage collection during allocation of a stack-overflow exception message.


The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data a different vulnerability than CVE-2014-3660.


openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted DNS response.


The checkint division routines in removefile in Apple iOS before 9 allow attackers to cause a denial of service (overflow fault and app crash) via crafted data.


The host memory mapping path feature in the NVIDIA GPU graphics driver R346 before 346.87 and R352 before 352.41 for Linux and R352 before 352.46 for GRID vGPU and vSGA does not properly restrict access to third-party device IO memory which allows attackers to gain privileges cause a denial of service (resource consumption) or possibly have unspecified other impact via unknown vectors related to the follow_pfn kernel-mode API call.


ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.


Cisco IOS XR 5.2.1 allows remote attackers to cause a denial of service (ipv6_io service reload) via a malformed IPv6 packet aka Bug ID CSCuq95565.


The fs_pin implementation in the Linux kernel before 4.0.5 does not ensure the internal consistency of a certain list data structure which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call related to fs/fs_pin.c and include/linux/fs_pin.h.


mar_read.c in the Updater in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows local users to gain privileges or cause a denial of service (out-of-bounds write) via a crafted name of a Mozilla Archive (aka MAR) file.


Cisco IOS XR 5.1.1.K9SEC allows remote authenticated users to cause a denial of service (vty error and SSH and TELNET outage) via a crafted disconnect action within an SSH session aka Bug ID CSCul63127.


QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices which might allow local x86 HVM guests to gain privileges cause a denial of service (host crash) obtain sensitive information or possibly have other unspecified impact via unknown vectors.


IBM WebSphere MQ Light 1.x before 1.0.2 allows remote attackers to cause a denial of service (MQXR service crash) via a series of connect and disconnect actions a different vulnerability than CVE-2015-4943.


The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.


The PPPoE establishment implementation in Cisco IOS XE 3.5.0S on ASR 1000 devices allows remote attackers to cause a denial of service (device reload) by sending malformed PPPoE Active Discovery Request (PADR) packets on the local network aka Bug ID CSCty94202.


Cisco Videoscape Policy Resource Manager (PRM) 3.5.4 allows remote attackers to cause a denial of service (CPU and memory consumption and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood aka Bug IDs CSCuu35104 and CSCuu35128.


The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercall_iret call with EFLAGS.VM set.


epan/dissectors/packet-gsm_a_dtap.c in the GSM DTAP dissector in Wireshark 1.12.x before 1.12.6 does not properly validate digit characters which allows remote attackers to cause a denial of service (application crash) via a crafted packet related to the de_emerg_num_list and de_bcd_num functions.


Memory leak in Cisco IOS 12.2 in the Performance Routing Engine (PRE) module on uBR10000 devices allows remote authenticated users to cause a denial of service (memory consumption or PXF process crash) by sending docsIfMCmtsMib SNMP requests quickly aka Bug ID CSCue65051.


(1) unsquash-1.c (2) unsquash-2.c (3) unsquash-3.c and (4) unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service (application crash) via a crafted input.


The chmd_init_decomp function in chmd.c in libmspack before 0.5 does not properly validate the reset interval which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted CHM file.


name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2 when configured as a recursive resolver with DNSSEC validation allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) by constructing crafted zone data and then making a query for a name in that zone.


The packet-reassembly implementation in Cisco IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (CPU consumption or packet loss) via fragmented (1) IPv4 or (2) IPv6 packets that trigger ATTN-3-SYNC_TIMEOUT errors after reassembly failures aka Bug ID CSCuo37957.


The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed which allows remote attackers to cause a denial of service (memory leak) via a crafted message.


Memory leak in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (memory consumption) by triggering an error during CPE negotiation aka Bug ID CSCug00885.


The filename sanitization component in ownCloud Server before 6.0.8 7.0.x before 7.0.6 and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast by PHP to an array which allows remote attackers to cause a denial of service (infinite loop and log file consumption) via crafted endpoint file names.


The FastL4 virtual server in F5 BIG-IP LTM AAM AFM Analytics APM ASM GTM Link Controller and PEM 11.3.0 through 11.5.2 and 11.6.0 through 11.6.0 HF4 BIG-IP Edge Gateway WebAccelerator and WOM 11.2.1 through 11.3.0 and BIG-IP PSM 11.2.1 through 11.4.1 allows remote attackers to cause a denial of service (Traffic Management Microkernel restart) via a fragmented packet.


SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors aka SAP Security Note 2121661.


Unspecified vulnerability in the Oracle Payments component in Oracle E-Business Suite 11.5.10.2 12.0.6 12.1.3 12.2.3 and 12.2.4 allows remote attackers to affect confidentiality integrity and availability via unknown vectors related to Punch-in. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability which allows remote attackers to cause a denial of service or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/IspPunchInServlet.


Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41 5.5.x before 5.5.25 and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.


Cisco IOS XR 5.3.1 on ASR 9000 devices allows remote attackers to cause a denial of service (NPU chip reset or line-card reload) by sending crafted IEEE 802.3x flow-control PAUSE frames on the local network aka Bug ID CSCut19959.


Nexus Data Broker (NDB) on Cisco Nexus 3000 devices with software 6.0(2)A6(1) allows remote attackers to cause a denial of service (Java process restart) via crafted connections to the Java application aka Bug ID CSCut87006.


Unspecified vulnerability in the Oracle iSupplier Portal component in Oracle E-Business Suite 12.0.6 12.1.3 12.2.3 and 12.2.4 allows remote attackers to affect confidentiality integrity and availability via vectors related to XML input. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability which allows remote attackers to read arbitrary files cause a denial of service or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/oramipp_lpr.


Cisco Digital Content Manager (DCM) 15.0.0 might allow remote ad servers to cause a denial of service (reboot) via malformed ad messages aka Bug ID CSCur13999.


The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field which allows remote attackers to cause a denial of service (crash) via a crafted message.


The Gateway General Packet Radio Service Support Node (GGSN) component on Cisco ASR 5000 devices with software 17.2.0.59184 and 18.0.L0.59219 allows remote attackers to cause a denial of service (Session Manager restart) via an invalid TCP/IP header aka Bug ID CSCut68058.


Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.


The global-configuration implementation on Cisco ASR 9000 devices with software 5.1.3 and 5.3.0 improperly closes vty sessions after a commit/end operation which allows local users to cause a denial of service (tmp/*config file creation memory consumption and device hang) via unspecified vectors aka Bug ID CSCut93842.


Cisco Wireless LAN Controller (WLC) devices with software 7.5(102.0) and 7.6(1.62) allow remote attackers to cause a denial of service (device crash) by triggering an exception during attempted forwarding of unspecified IPv6 packets to a non-IPv6 device aka Bug ID CSCuj01046.


The Packet Data Network Gateway (aka PGW) component on Cisco ASR 5000 devices with software 15.0(912) 15.0(935) and 15.0(938) allows remote attackers to cause a denial of service (Session Manager outage) via malformed fields in an IP packet aka Bug ID CSCut38476.


The SNMP implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4(7) and 8.6(1.2) allows remote authenticated users to cause a denial of service (device reload) by sending many SNMP requests during a time of high network traffic aka Bug ID CSCul02601.


IBM WebSphere MQ Light 1.x before 1.0.2 allows remote attackers to cause a denial of service (MQXR service crash) via a series of connect and disconnect actions a different vulnerability than CVE-2015-4942.


Cisco NX-OS on Nexus 9000 devices 11.1(1c) allows remote authenticated users to cause a denial of service (device hang) via large files that are copied to a device's filesystem aka Bug ID CSCuu77225.


Cisco AsyncOS on Email Security Appliance (ESA) devices with software 8.5.6-073 8.5.6-074 and 9.0.0-461 when clustering is enabled allows remote attackers to cause a denial of service (clustering and SSH outage) via a packet flood aka Bug IDs CSCur13704 and CSCuq05636.


Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5 6.4 before 6.4.3.1 and 7.1 before 7.1.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted Web client URL.


The kernel extension in Cisco AnyConnect Secure Mobility Client 4.0(2049) on OS X allows local users to cause a denial of service (panic) via vectors involving contiguous memory locations aka Bug ID CSCut12255.


The collect_mounts function in fs/namespace.c in the Linux kernel before 4.0.5 does not properly consider that it may execute after a path has been unmounted which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call.


The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented which allows remote attackers to cause a denial of service (crash) via a crafted message.


The Packet Data Network Gateway (aka PGW) component on Cisco ASR 5000 devices with software 18.0.0.59167 and 18.0.0.59211 allows remote attackers to cause a denial of service via a malformed header in a GTPv2 packet aka Bug ID CSCut11534.


The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.


The packet-storing feature on Cisco 9900 phones with firmware 9.3(2) does not properly support the RTP protocol which allows remote attackers to cause a denial of service (device hang) by sending malformed RTP packets after a call is answered aka Bug ID CSCur39976.


The Concurrent Data Management Replication process in Cisco IOS XR 5.3.0 on ASR 9000 devices allows remote attackers to cause a denial of service (BGP process reload) via malformed BGPv4 packets aka Bug ID CSCur70670.


The Call Policy Configuration page in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.3 improperly validates external DTDs which allows remote authenticated users to read arbitrary files or cause a denial of service via a crafted XML document aka Bug ID CSCuv31853.


Cisco IP Communicator 8.6(4) allows remote attackers to cause a denial of service (service outage) via an unspecified URL in a GET request aka Bug ID CSCuu37656.


Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages which allows local x86 HVM guests to cause a denial of service (host disk consumption) via certain invalid operations.


IBM WebSphere MQ Light 1.x before 1.0.2 mishandles abbreviated TLS handshakes which allows remote attackers to cause a denial of service (MQXR service crash) via unspecified vectors.


The Tomcat throttling feature in Cisco Unified Communications Manager 10.5(1.99995.9) allows remote authenticated users to cause a denial of service (management outage) by sending many requests aka Bug ID CSCuu99709.


The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.6 does not properly determine whether enough memory is available for storing IP address strings which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via a crafted packet.


Cisco Prime Collaboration Assurance 10.0 allows remote attackers to cause a denial of service (HTTP service outage) via a crafted HTTP request aka Bug ID CSCum38844.


The XML parser in EMC Atmos before 2.2.3.426 and 2.3.x before 2.3.1.0 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


The js::jit::AssemblerX86Shared::lock_addl function in the JavaScript implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to cause a denial of service (application crash) by leveraging the use of shared memory and accessing (1) an Atomics object or (2) a SharedArrayBuffer object.


The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program.


The Local Packet Transport Services (LPTS) implementation in Cisco IOS XR 5.1.2 5.1.3 5.2.1 and 5.2.2 on ASR9k devices makes incorrect decisions about the opening of TCP and UDP ports during the processing of flow base entries which allows remote attackers to cause a denial of service (resource consumption) by sending traffic to these ports continuously aka Bug ID CSCur88273.


Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config which allows remote attackers to cause a denial of service (reboot or shutdown) create arbitrary users or possibly have unspecified other impact via a crafted request as demonstrated by a beckhoff.com:service:cxconfig:1#Write SOAP action to /upnpisapi.


Cisco NX-OS 5.2(5) on Nexus 7000 devices allows remote attackers to cause a denial of service (device crash) by sending a malformed LLDP packet on the local network aka Bug ID CSCud89415.


Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2 12.0.6 12.1.3 12.2.3 and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Reports Security. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability which allows remote attackers to read arbitrary files cause a denial of service or conduct SMB Relay attacks via a crafted DTD in an XML request involving the OA_HTML/copxml servlet.


Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.


Cisco IOS XR 5.1.3 allows remote attackers to cause a denial of service (process reload) via crafted MPLS Label Distribution Protocol (LDP) packets aka Bug ID CSCuu77478.


Unisys Libra 43xx 63xx and 83xx and FS600 class systems with MCP-FIRMWARE 40.0 before 40.0IC4 Build 270 might allow remote authenticated users to cause a denial of service (data corruption or system crash) via vectors related to using program operators during EPSILON (level 5) based codefiles at peak memory usage which triggers CPM stack corruption.


SAP Content Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors aka SAP Security Note 2127995.


The client detection protocol in Valve Steam allows remote attackers to cause a denial of service (process crash) via a crafted response to a broadcast packet.


The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash).


Cisco IOS XE 2.x before 2.4.3 and 2.5.x before 2.5.1 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted series of fragmented (1) IPv4 or (2) IPv6 packets aka Bug ID CSCtd72617.


Cisco Email Security Appliance (ESA) devices with software 8.5.6-106 and 9.5.0-201 allow remote attackers to cause a denial of service (per-domain e-mail reception outage) by placing malformed DMARC policy data in DNS TXT records for a domain aka Bug ID CSCuv14806.


The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement which allows local users to cause a denial of service (transaction overrun and data corruption) or possibly gain privileges by leveraging XFS filesystem access.


The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2 12.4 15.0 15.2 15.3 and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (disrupted domain access) via spoofed AN messages that reset a finite state machine aka Bug ID CSCup62293.


in

the

TSC

driver

for

the

Linux

kernel

as

used

in

Qualcomm

Innovation

Center

(QuIC)

Android

contributions

for

MSM

devices

and

other

products

allows

attackers

to

cause

a

denial

of

service

(invalid

pointer

dereference)

or

possibly

have

unspecified

other

impact

via

a

crafted

application

that

makes

a

ioctl

call.


The SMB module in Cisco Wide Area Application Services (WAAS) 6.0(1) allows remote attackers to cause a denial of service (module reload) via an invalid field in a Negotiate Protocol request aka Bug ID CSCuo75645.


The High Availability (HA) subsystem in Cisco NX-OS on MDS 9000 devices allows remote attackers to cause a denial of service via crafted traffic aka Bug ID CSCuo09129.


The web-authentication functionality on Cisco Wireless LAN Controller (WLC) devices 7.3(103.8) and 7.4(110.0) allows remote attackers to cause a denial of service (device reload) via a malformed password aka Bug ID CSCui57980.


The font mapper in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 does not properly scale fonts which allows local users to cause a denial of service (system hang) via a crafted application aka \Windows Font Driver Denial of Service Vulnerability.\


The

mozilla::layers::BufferTextureClient::AllocateForSurface

function

in

Mozilla

Firefox

before

allows

remote

attackers

to

cause

a

denial

of

service

(out-of-bounds

write

of

zero

values

and

application

crash)

via

vectors

that

trigger

use

of

DrawTarget

and

the

Cairo

library

for

image

drawing.


The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates.


Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier use weak permissions for unspecified files which allows local users to cause a denial of service (persistent hang or reboot) by writing to a phone's filesystem aka Bug ID CSCup90474.


Cisco IOS XE 3.10.2S on an ASR 1000 device with an Embedded Services Processor (ESP) module when NAT is enabled allows remote attackers to cause a denial of service (module crash) via malformed H.323 packets aka Bug ID CSCup21070.


IBM DB2 9.7 through FP10 9.8 through FP5 10.1 before FP5 and 10.5 through FP5 on Linux UNIX and Windows allows remote authenticated users to cause a denial of service (daemon crash) by leveraging an unspecified scalar function in a SQL statement.


The SNMPv2 implementation in Cisco IOS XR allows remote authenticated users to cause a denial of service (snmpd daemon reload) via a malformed SNMP packet aka Bug ID CSCur25858.


The Network-Based Application Recognition (NBAR) protocol implementation in Cisco IOS 15.3(100)M and earlier on Cisco 2900 Integrated Services Router (aka Cisco Internet Router) devices allows remote attackers to cause a denial of service (NBAR process hang) via IPv4 packets aka Bug ID CSCuo73682.


The vgic_v2_to_sgi function in arch/arm/vgic-v2.c in Xen 4.5.x when running on ARM hardware with general interrupt controller (GIC) version 2 allows local guest users to cause a denial of service (host crash) by writing an invalid value to the GICD.SGIR register.


The Service Discovery Gateway (aka mDNS Gateway) in Cisco IOS 12.2 12.4 15.0 15.1 15.2 15.3 and 15.4 and IOS XE 3.9.xS and 3.10.xS before 3.10.4S 3.11.xS before 3.11.3S 3.12.xS before 3.12.2S and 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (device reload) by sending malformed mDNS UDP packets over (1) IPv4 or (2) IPv6 aka Bug ID CSCup70579.


In open buildservice 2.6 before 2.6.3 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.


Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices allow remote attackers to cause a denial of service (CPU consumption and SNMP outage) via malformed SNMP packets aka Bug ID CSCur13393.


Adobe Font Driver in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 does not properly allocate memory which allows remote attackers to cause a denial of service via a crafted (1) web site or (2) file aka \Adobe Font Driver Denial of Service Vulnerability.\


epan/dissectors/packet-smtp.c in the SMTP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 uses an incorrect length value for certain string-append operations which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The WebGL implementation in Mozilla Firefox before 36.0 does not properly allocate memory for copying an unspecified string to a shader's compilation log which allows remote attackers to cause a denial of service (application crash) via crafted WebGL content.


Cisco IOS 15.5S and IOS XE allow remote authenticated users to cause a denial of service (device crash) by leveraging knowledge of the RADIUS secret and sending crafted RADIUS packets aka Bug ID CSCur21348.


The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0) 9.2(0.104) 9.2(3.1) 9.2(3.4) 9.3(1.105) 9.3(2.100) 9.4(0.115) 100.13(0.21) 100.13(20.3) 100.13(21.9) and 100.14(1.1) does not properly implement multicast-forwarding registration which allows remote attackers to cause a denial of service (forwarding outage) via a crafted multicast packet aka Bug ID CSCus74398.


X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (crash) via a crafted string length value in a XkbSetGeometry request.


The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.


Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains which allows remote authenticated users to cause a denial of service (prevent host start) by creating a long snapshot chain.


Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch leading to failure of replay detection.


The hamgr service in the IPv6 Proxy Mobile (PM) implementation in Cisco StarOS 18.1.0.59776 on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and call-processing outage) via malformed PM packets aka Bug ID CSCut94711.


The Zone-Based Firewall implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers incorrect kernel-timer handling aka Bug ID CSCuh25672.


The Wireless Intrusion Detection (aka WIDS) functionality on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device outage) via crafted packets that are improperly handled during rendering of the Signature Events Summary page aka Bug ID CSCus46861.


The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 15.4S and 15.4(3)S allows remote attackers to modify configuration settings or cause a denial of service (partial service outage) by sending crafted Autonomic Networking (AN) messages on an intranet network aka Bug ID CSCup62167.


The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7 8.6 before 8.6(2a)SU4 9.x before 9.1(2)SU2 and 10.0 before 10.0(1)SU1 when SIP trunk integration is enabled allows remote attackers to cause a denial of service (core dump and restart) via crafted SIP INVITE messages aka Bug ID CSCul20444.


The DNS implementation in Cisco Videoscape Distribution Suite for Internet Streaming (VDS-IS) 3.2(1) allows remote attackers to cause a denial of service (CPU consumption and network-resource consumption) via crafted packets aka Bug ID CSCun15911.


The high-speed logging (HSL) feature in Cisco IOS XE 2.x and 3.x before 3.10.4S 3.11 before 3.11.3S 3.12 before 3.12.1S 3.13 before 3.13.0S 3.14 before 3.14.0S and 3.15 before 3.15.0S allows remote attackers to cause a denial of service (device reload) via large IP packets that require NAT and HSL processing after fragmentation aka Bug ID CSCuo25741.


The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7 8.6 before 8.6(2a)SU4 and 9.x before 9.1(2)SU2 when SIP trunk integration is enabled allows remote attackers to cause a denial of service (core dump and restart) by improperly terminating SIP TCP connections aka Bug ID CSCul69819.


Cisco TelePresence Video Communication Server (VCS) X8.5RC4 allows remote attackers to cause a denial of service (CPU consumption or device outage) via a crafted SDP parameter-negotiation request in an SDP session during a SIP connection aka Bug ID CSCut42422.


Cisco IOS XE before 3.7.5S on ASR 1000 devices does not properly handle route adjacencies which allows remote attackers to cause a denial of service (device hang) via crafted IP packets aka Bug ID CSCub31873.


Multiple use-after-free vulnerabilities in epan/dissectors/packet-dec-dnart.c in the DEC DNA Routing Protocol dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allow remote attackers to cause a denial of service (application crash) via a crafted packet related to the use of packet-scope memory instead of pinfo-scope memory.


Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic aka Bug ID CSCus04097.


Cisco IOS 15.4S 15.4SN and 15.5S and IOS XE 3.13S and 3.14S allow remote attackers to cause a denial of service (device crash) by including an IA_NA option in a DHCPv6 Solicit message on the local network aka Bug ID CSCur29956.


The

Layer

Redirect

feature

in

Cisco

IOS

XE

and

before

before

before

before

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(device

reload)

via

malformed

or

packets

aka

Bug

ID


The Zone-Based Firewall implementation in Cisco IOS 12.4(122)T and earlier does not properly manage session-object structures which allows remote attackers to cause a denial of service (device reload) via crafted network traffic aka Bug ID CSCul65003.


The Overlay Transport Virtualization (OTV) implementation in Cisco IOS XE 3.10S allows remote attackers to cause a denial of service (device reload) via a series of packets that are considered oversized and trigger improper fragmentation handling aka Bug IDs CSCup37676 and CSCup30335.


The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server.


IBM OpenPages GRC Platform 6.2 before IF7 6.2.1 before 6.2.1.1 IF5 7.0 before FP4 and 7.1 before FP1 allows remote authenticated users to cause a denial of service (maintenance-mode transition and data-storage outage) by calling the System Administration Mode function.


The

TFTP

server

in

Cisco

IOS

and

and

IOS

XE

and

before

and

before

before

before

and

allows

remote

attackers

to

cause

a

denial

of

service

(device

hang

or

reload)

via

multiple

requests

that

trigger

improper

memory

management

aka

Bug

ID


The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU6 8.6 before 8.6(2a)SU4 and 9.x before 9.1(2)SU2 when SIP trunk integration is enabled allows remote attackers to cause a denial of service (SIP outage) via a crafted UDP packet aka Bug ID CSCuh25062.


telnetd in Cisco IOS XR 5.0.1 on Network Convergence System 6000 devices allows remote attackers to cause a denial of service (device reload) via a malformed TELNET packet aka Bug ID CSCuq31566.


PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers an internal error.


The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP message with (1) an invalid range in a sequence set (2) content-bearing methods other than message-transfer or (3) a session-gap control before a corresponding session-attach.


The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers.


The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI support does not properly handle certain non-blocking I/O cases which allows remote attackers to cause a denial of service (pointer corruption and application crash) via unspecified vectors.


Cisco Videoscape Distribution Suite Service Broker (aka VDS-SB) when a VDSM configuration on UCS is used and Videoscape Distribution Suite for Internet Streaming (aka VDS-IS or CDS-IS) before 3.3.1 R7 and 4.x before 4.0.0 R4 allow remote attackers to cause a denial of service (device reload) via a crafted HTTP request aka Bug IDs CSCus79834 and CSCuu63409.


Cisco

IOS

XE

and

before

before

before

before

before

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(device

reload)

via

crafted

packets

aka

Bug

ID


The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request.


The IOS Shell in Cisco IOS allows local users to cause a denial of service (device crash) via unspecified commands aka Bug ID CSCur59696.


Cisco NX-OS 4.0 through 6.1 on Nexus 1000V 3000 4000 5000 6000 and 7000 devices and Unified Computing System (UCS) platforms allows remote attackers to cause a denial of service (TCP stack reload) by sending crafted TCP packets to a device that has a TIME_WAIT TCP session aka Bug ID CSCub70579.


The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2 12.4 15.0 15.2 15.3 and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (device reload) via spoofed AN messages aka Bug ID CSCup62315.


Cisco IOS XR 4.3.4 through 5.3.0 on ASR 9000 devices when uRPF PBR QoS or an ACL is configured does not properly handle bridge-group virtual interface (BVI) traffic which allows remote attackers to cause a denial of service (chip and card hangs and reloads) by triggering use of a BVI interface for IPv4 packets aka Bug ID CSCur62957.


The ISDN implementation in Cisco IOS 15.3S allows remote attackers to cause a denial of service (device reload) via malformed Q931 SETUP messages aka Bug ID CSCut37890.


filter/mediaplugin/filter.php in Moodle through 2.5.9 2.6.x before 2.6.7 2.7.x before 2.7.4 and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression.


npppd in the PPP Access Concentrator (PPPAC) on SEIL SEIL/x86 Fuji routers 1.00 through 3.30 SEIL/X1 routers 3.50 through 4.70 SEIL/X2 routers 3.50 through 4.70 and SEIL/B1 routers 3.50 through 4.70 allows remote attackers to cause a denial of service (infinite loop and device hang) via a crafted SSTP packet.


The virtualization layer in Cisco ASA FirePOWER Software before 5.3.1.2 and 5.4.x before 5.4.0.1 and ASA Context-Aware (CX) Software before 9.3.2.1-9 allows remote attackers to cause a denial of service (device reload) by rapidly sending crafted packets to the management interface aka Bug IDs CSCus11007 and CSCun56954.


Cisco IOS 12.2 12.4 15.0 15.2 and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) TCP packets aka Bug ID CSCun63514.


The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1 Windows 8 Windows 8.1 and Windows Server 2012 Gold and R2 allows remote attackers to cause a denial of service (memory consumption and RDP outage) by establishing many RDP sessions that do not properly free allocated memory aka \Remote Desktop Protocol (RDP) Denial of Service Vulnerability.\


ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3 when show_hidden_initial is set to True allows remote attackers to cause a denial of service by submitting duplicate values which triggers a large number of SQL queries.


nbd-server.c in Network Block Device (nbd-server) before 3.11 does not properly handle signals which allows remote attackers to cause a denial of service (deadlock) via unspecified vectors.


The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7 8.6 before 8.6(2a)SU4 9.x before 9.1(2)SU2 and 10.0 before 10.0(1)SU1 when SIP trunk integration is enabled allows remote attackers to cause a denial of service (core dump and restart) via crafted SIP INVITE messages aka Bug ID CSCul26267.


The SNMP implementation in Cisco IOS 15.1(2)SG4 on Catalyst 4500 devices when single-switch Virtual Switching System (VSS) is configured allows remote authenticated users to cause a denial of service (device crash) by performing SNMP polling aka Bug ID CSCuq04574.


The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not initialize certain data structures which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The wireless web-authentication subsystem on Cisco Wireless LAN Controller (WLC) devices 7.5.x and 7.6.x before 7.6.120 allows remote attackers to cause a denial of service (process crash and device restart) via a crafted value aka Bug ID CSCum03269.


Cisco IOS 12.2 12.4 15.0 15.2 and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) UDP packets aka Bug ID CSCum98371.


Microsoft Windows Server 2003 SP2 Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (system hang and RADIUS outage) via crafted username strings to (1) Internet Authentication Service (IAS) or (2) Network Policy Server (NPS) aka \Network Policy Server RADIUS Implementation Denial of Service Vulnerability.\


Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to cause a denial of service (daemon hang and GUI outage) via a flood of malformed TCP packets aka Bug ID CSCur44177.


The session-manager service in Cisco StarOS 12.0 12.2(300) 14.0 and 14.0(600) on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and packet loss) via malformed HTTP packets aka Bug ID CSCud14217.


Cisco TelePresence MCU devices with software 4.5(1.45) allow remote attackers to cause a denial of service (device reload) via an unspecified series of TCP packets aka Bug ID CSCur50347.


internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.


The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.


The DHCPv4 server in Cisco IOS XR 5.2.2 on ASR 9000 devices allows remote attackers to cause a denial of service (service outage) via a flood of crafted DHCP packets aka Bug ID CSCup67822.


The Common Flow Table (CFT) feature in Cisco IOS XE 3.6 and 3.7 before 3.7.1S 3.8 before 3.8.0S 3.9 before 3.9.0S 3.10 before 3.10.0S 3.11 before 3.11.0S 3.12 before 3.12.0S 3.13 before 3.13.0S 3.14 before 3.14.0S and 3.15 before 3.15.0S when MMON or NBAR is enabled allows remote attackers to cause a denial of service (device reload) via malformed IPv6 packets with IPv4 UDP encapsulation aka Bug ID CSCua79665.


Cisco

IOS

and

and

IOS

XE

through

before

through

before

and

before

allow

remote

attackers

to

cause

a

denial

of

service

(memory

consumption

and

device

reload)

by

sending

malformed

packets

over

or

aka

Bug

ID


The XML parser in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5 and 4.x before 4.0.7 iFix3 does not properly detect recursion during entity expansion which allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references a similar issue to CVE-2003-1564.


The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2 12.4 15.0 15.2 15.3 and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to spoof Autonomic Networking Registration Authority (ANRA) responses and consequently bypass intended device and node access restrictions or cause a denial of service (disrupted domain access) via crafted AN messages aka Bug ID CSCup62191.


Multiple use-after-free vulnerabilities in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allow remote attackers to cause a denial of service (application crash) via a crafted packet related to the use of packet-scope memory instead of pinfo-scope memory.


The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf 1.0.0 before 1.0.0r 1.0.1 before 1.0.1m and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.


qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203.


Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet aka Bug ID CSCur69192.


The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference as demonstrated by reading private keys related to an XML External Entity (XXE) issue aka Bug ID CSCup92880.


EMC RSA Certificate Manager (RCM) before 6.9 build 558 and RSA Registration Manager (RRM) before 6.9 build 558 allow remote attackers to cause an Administration Server denial of service via an invalid MIME e-mail message with a multipart/* Content-Type header.


The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to cause a denial of service (logoff) via crafted packets aka Bug ID CSCuq12139.


Pearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers' installations which allows remote attackers to modify test metadata or cause a denial of service (test disruption) by leveraging knowledge of this password.


Cisco IOS XR 5.0.1 and 5.2.1 on Network Convergence System (NCS) 6000 devices and 5.1.3 and 5.1.4 on Carrier Routing System X (CRS-X) devices allows remote attackers to cause a denial of service (line-card reload) via malformed IPv6 packets with extension headers aka Bug ID CSCuq95241.


The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets aka Bug IDs CSCur84322 and CSCur27693.


The cluster repository manager in IBM WebSphere MQ 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allows remote authenticated administrators to cause a denial of service (memory overwrite and daemon outage) by triggering multiple transmit-queue records.


Cisco Finesse 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consumption) via a crafted XML document aka Bug ID CSCut95810.


GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message a different vulnerability than CVE-2015-8215.


The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5 when the guest OS lacks SYSENTER MSR initialization allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.


Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allow local users to cause a denial of service (device reload) via crafted commands aka Bug ID CSCup92790.


Cisco ONS 15454 System Software 10.30 and 10.301 allows remote attackers to cause a denial of service (tNetTask CPU consumption or card reset) via a flood of (1) IP or (2) Ethernet traffic aka Bug ID CSCus57263.


The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request for a (1) group with a large number of members or (2) user that belongs to a large number of groups.


Memory leak in the embedded web server in the WebVPN subsystem in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of service (memory consumption and SSL outage) via multiple crafted HTTP requests aka Bug ID CSCue05458.


The Session Description Protocol (SDP) implementation in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X8.2 and Cisco TelePresence Conductor before XC2.4 allows remote attackers to cause a denial of service (mishandled exception and device reload) via a crafted media description aka Bug IDs CSCus96593 and CSCun73192.


The django.views.static.serve view in Django before 1.4.18 1.6.x before 1.6.10 and 1.7.x before 1.7.3 reads files an entire line at a time which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.


The call-handling implementation in Cisco Unity Connection 8.5 before 8.5(1)SU7 8.6 before 8.6(2a)SU4 9.x before 9.1(2)SU2 and 10.0 before 10.0(1)SU1 when SIP trunk integration is enabled allows remote attackers to cause a denial of service (port consumption) by improperly terminating SIP sessions aka Bug ID CSCul28089.


The IKE implementation in the WS-IPSEC-3 service module in Cisco IOS 12.2 on Catalyst 6500 devices allows remote authenticated users to cause a denial of service (device reload) by sending a crafted message during IPsec tunnel setup aka Bug ID CSCur70505.


CREAR AL-Mail32 before 1.13d allows remote attackers to cause a denial of service (application crash) via a (1) CON (2) AUX or (3) NUL device name in the filename of an attachment.


asn1/lpp/lpp.cnf in the LPP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not validate a certain index value which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet.


The SNMP implementation in Cisco NX-OS 6.1(2)I2(3) on Nexus 9000 devices when a Reset High Availability (HA) policy is configured allows remote authenticated users to cause a denial of service (device reload) via unspecified vectors aka Bug ID CSCuq92240.


Cisco IOS XR 4.0.1 through 4.2.0 for CRS-3 Carrier Routing System allows remote attackers to cause a denial of service (NPU ASIC scan and line-card reload) via crafted IPv6 extension headers aka Bug ID CSCtx03546.


The network drivers in Cisco TelePresence T Cisco TelePresence TE and Cisco TelePresence TC before 7.3.2 allow remote attackers to cause a denial of service (process restart or device reload) via a flood of crafted IP packets aka Bug ID CSCuj68952.


Memory leak in the TCP input module in Cisco IOS 12.2 12.4 15.0 15.2 15.3 and 15.4 and IOS XE 3.3.xXO 3.5.xE 3.6.xE 3.8.xS through 3.10.xS before 3.10.5S and 3.11.xS and 3.12.xS before 3.12.3S allows remote attackers to cause a denial of service (memory consumption or device reload) by sending crafted TCP packets over (1) IPv4 or (2) IPv6 aka Bug ID CSCum94811.


Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs which allows remote attackers to execute arbitrary Java methods via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.


The XML parser in Cisco Adaptive Security Appliance (ASA) Software 8.4 before 8.4(7.28) 8.6 before 8.6(1.17) 9.0 before 9.0(4.33) 9.1 before 9.1(6) 9.2 before 9.2(3.4) and 9.3 before 9.3(3) when Clientless SSL VPN AnyConnect SSL VPN or AnyConnect IKEv2 VPN is used allows remote attackers to cause a denial of service (VPN outage or device reload) via a crafted XML document aka Bug ID CSCus95290.


Cisco DTA Control System (DTACS) 4.0.0.9 and Cisco Headend System Release allow remote attackers to cause a denial of service (CPU and memory consumption and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood aka Bug IDs CSCus50642 CSCus50662 CSCus50625 CSCus50657 and CSCus68315.


The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html.


The banner (aka MOTD) implementation in Cisco NX-OS 4.1(2)E1(1f) on Nexus 4000 devices 5.2(1)SV3(2.1) on Nexus 1000V devices 6.0(2)N2(2) on Nexus 5000 devices 6.2(11) on MDS 9000 devices 6.2(12) on Nexus 7000 devices 7.0(3) on Nexus 9000 devices and 7.2(0)ZN(99.67) on Nexus 3000 devices allows remote attackers to cause a denial of service (login process reset) via an unspecified terminal-session request during TELNET session setup aka Bug IDs CSCuo10554 CSCuu75466 CSCuu75471 CSCuu75484 CSCuu75498 CSCuu77170 and CSCuu77182.


EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled allow remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero a similar issue to CVE-2015-1787.


The web administration interface on Cisco Wireless LAN Controller (WLC) devices before 7.0.241 7.1.x through 7.4.x before 7.4.122 and 7.5.x and 7.6.x before 7.6.120 allows remote authenticated users to cause a denial of service (device crash) via unspecified parameters aka Bug IDs CSCum65159 and CSCum65252.


Cisco

IOS

and

and

IOS

XE

through

before

through

before

and

before

allow

remote

attackers

to

cause

a

denial

of

service

(device

reload)

by

sending

malformed

packets

over

or

aka

Bug

ID


The SSLv2 implementation in OpenSSL before 0.9.8zf 1.0.0 before 1.0.0r 1.0.1 before 1.0.1m and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.


Multiple use-after-free vulnerabilities in the DOM implementation in Blink as used in Google Chrome before 41.0.2272.76 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger movement of a SCRIPT element to different documents related to (1) the HTMLScriptElement::didMoveToNewDocument function in core/html/HTMLScriptElement.cpp and (2) the SVGScriptElement::didMoveToNewDocument function in core/svg/SVGScriptElement.cpp.


Apache HBase 0.98 before 0.98.12.1 1.0 before 1.0.1.1 and 1.1 before 1.1.0.1 as used in IBM InfoSphere BigInsights 3.0 3.0.0.1 and 3.0.0.2 and other products uses incorrect ACLs for ZooKeeper coordination state which allows remote attackers to cause a denial of service (daemon outage) obtain sensitive information or modify data via unspecified client traffic.


kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash).


The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5 VMware Player 6.x before 6.0.5 and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors.


in

Blink

as

used

in

Google

Chrome

before

does

not

initialize

a

certain

width

field

which

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

crafted

Unicode

text.


The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service (locked CAPWAP Access Controller) via a large number of ClientHello DTLS messages.


MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.


ClamAV before 0.98.6 allows remote attackers to cause a denial of service (crash) via a crafted petite packer file related to an \incorrect compiler optimization.\


vpxd in VMware vCenter Server 5.0 before u3e 5.1 before u3 and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.


named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2 when DNSSEC validation and the managed-keys feature are enabled allows remote attackers to cause a denial of service (assertion failure and daemon exit or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.


in

the

SVG

implementation

in

Blink

as

used

in

Google

Chrome

before

does

not

properly

handle

an

insufficient

number

of

values

in

an

feColorMatrix

filter

which

allows

remote

attackers

to

cause

a

denial

of

service

(container

overflow)

or

possibly

have

unspecified

other

impact

via

a

crafted

document.


XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1 when a Java Security Manager is not in place allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.


IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data a different vulnerability than CVE-2015-1958 and CVE-2015-1987.


The mach_vm_read functionality in the kernel in Apple OS X before 10.10.3 allows local users to cause a denial of service (system crash) via unspecified vectors.


Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink as used in Google Chrome before 42.0.2311.135 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered.


Use-after-free

vulnerability

in

the

GPU

process

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

by

leveraging

the

continued

availability

of

a

GPUChannelHost

data

structure

during

Blink

shutdown

related

to

and


The media_server component in Android allows remote attackers to cause a denial of service via a crafted application.


The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call.


The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an anonymous Diffie-Hellman (DH) ServerKeyExchange message.


The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.


Use-after-free vulnerability in Blink as used in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread related to the shutdown function in web/WebKit.cpp.


Use-after-free

vulnerability

in

in

the

IndexedDB

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

by

leveraging

an

abort

action

before

a

certain

write

operation.


The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s 1.0.0 before 1.0.0e 1.0.1 before 1.0.1n and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field which allows remote attackers to cause a denial of service (infinite loop) via a session that uses an Elliptic Curve algorithm as demonstrated by an attack against a server that supports client authentication.


Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1 when using the PJSIP channel driver does not properly reclaim RTP ports which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs.


The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.


The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups.


IBM

WebSphere

Portal

through

through

through

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(CPU

and

memory

consumption)

via

a

crafted

request.


The Google Email application 4.2.2.0200 for Android allows remote attackers to cause a denial of service (persistent application crash) via a \Content-Disposition: ;\ header in an e-mail message.


The ReduceTransitionElementsKind function in hydrogen-check-elimination.cc in Google V8 before 4.2.77.8 as used in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that leverages \type confusion\ in the check-elimination optimization.


Use-after-free

vulnerability

in

the

VisibleSelection::nonBoundaryShadowTreeRootNode

function

in

in

the

DOM

implementation

in

Blink

as

used

in

Google

Chrome

before

on

Windows

OS

X

and

Linux

and

before

on

Android

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

crafted

JavaScript

code

that

triggers

improper

handling

of

a

shadow-root

anchor.


Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.


Multiple use-after-free vulnerabilities in fpdfsdk/src/javascript/Document.cpp in PDFium as used in Google Chrome before 44.0.2403.89 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document related to the (1) Document::delay and (2) Document::DoFieldDelay functions.


Use-after-free

vulnerability

in

the

GIFImageReader::parseData

function

in

in

Blink

as

used

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

frame

size

in

a

GIF

image.


Use-after-free vulnerability in the accessibility implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging lack of certain validity checks for accessibility-tree data structures.


The kernel in Apple iOS before 8.3 Apple OS X before 10.10.3 and Apple TV before 7.2 makes routing changes in response to ICMP_REDIRECT messages which allows remote attackers to cause a denial of service (network outage) or obtain sensitive packet-content information via a crafted ICMP packet.


jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.


The label decompression functionality in PowerDNS Recursor 3.5.x 3.6.x before 3.6.3 and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x 3.3.x before 3.3.2 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.


OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them a different vulnerability than CVE-2014-9684.


IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data a different vulnerability than CVE-2015-1956 and CVE-2015-1958.


The filters implementation in Skia as used in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.


IBM WebSphere Portal 8.5 through CF05 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.


common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions.


The RenderCounter::updateCounter function in core/rendering/RenderCounter.cpp in Blink as used in Google Chrome before 41.0.2272.76 does not force a relayout operation and consequently does not initialize memory for a data structure which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted Cascading Style Sheets (CSS) token sequence.


Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Microsoft .NET Framework 2.0 SP2 3.5 3.5.1 4 4.5 4.5.1 and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encrypted data in an XML document aka \.NET XML Decryption Denial of Service Vulnerability.\


The getHiddenProperty function in bindings/core/v8/V8EventListenerList.h in Blink as used in Google Chrome before 41.0.2272.76 has a name conflict with the AudioContext class which allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that adds an AudioContext event listener and triggers \type confusion.\


Use-after-free vulnerability in the SVG implementation in Blink as used in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element.


The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).


The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.


platform/image-decoders/ImageFrame.h in Blink as used in Google Chrome before 40.0.2214.91 does not initialize a variable that is used in calls to the Skia SkBitmap::setAlphaType function which might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document a different vulnerability than CVE-2015-1205.


The TCP implementation in the kernel in Apple iOS before 8.3 Apple OS X before 10.10.3 and Apple TV before 7.2 does not properly implement the Urgent (aka out-of-band data) mechanism which allows remote attackers to cause a denial of service via crafted packets.


The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image as demonstrated by libtiff5.tif.


audio/AudioPolicyManagerBase.cpp in Android before 5.1 allows attackers to cause a denial of service (audio_policy application outage) via a crafted application that provides a NULL device address.


Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value which allows remote attackers to trigger a negative value for a size field and consequently cause a denial of service or possibly have unspecified other impact via a crafted frame size in VP9 video data.


The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia as used in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.


The ActiveMQ Broker in Samsung Security Manager (SSM) before 1.31 allows remote attackers to delete arbitrary files and consequently cause a denial of service via a DELETE request.


Multiple

use-after-free

vulnerabilities

in

the

ServiceWorkerScriptCacheMap

implementation

in

in

Google

Chrome

before

allow

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

that

trigger

a

ServiceWorkerContextWrapper::DeleteAndStartOver

call

related

to

the

NotifyStartedCaching

and

NotifyFinishedCaching

functions.


The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.


parsers.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to an HTTP time header.


The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink as used in Google Chrome before 44.0.2403.89 does not properly check for a page's maximum number of frames which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements.


Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.


The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.


The

V8LazyEventListener::prepareListenerObject

function

in

in

the

bindings

in

Blink

as

used

in

Google

Chrome

before

does

not

properly

compile

listeners

which

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

that

leverage

\type

confusion.\


kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.


Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allow local users to cause a denial of service via a crafted .msc file aka \Microsoft Management Console File Format Denial of Service Vulnerability.\


The ssl3_get_client_key_exchange function in s3_srvr.c in OpenSSL 1.0.2 before 1.0.2a when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled allows remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero.


Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation a different vulnerability than CVE-2015-1212.


vmware-authd (aka the Authorization process) in VMware Workstation 10.x before 10.0.5 VMware Player 6.x before 6.0.5 and VMware ESXi 5.0 through 5.5 allows attackers to cause a host OS denial of service via unspecified vectors.


IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (CPU consumption) via a crafted byte sequence in authentication data.


Use-after-free vulnerability in the SkMatrix::invertNonIdentity function in core/SkMatrix.cpp in Skia as used in Google Chrome before 45.0.2454.85 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering the use of matrix elements that lead to an infinite result during an inversion calculation.


The

prefix

variable

in

the

function

in

Lasso

before

commit

allows

remote

attackers

to

cause

a

denial

of

service

(uninitialized

memory

access

and

application

crash)

via

unspecified

vectors.


chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.


Multiple

use-after-free

vulnerabilities

in

in

the

WebRTC

implementation

in

Google

Chrome

before

allow

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

crafted

JavaScript

code

that

executes

upon

completion

of

a

getUserMedia

request.


The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application aka an \I/O vector array overrun.\


The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink as used in Google Chrome before 45.0.2454.85 does not check whether a node is expected which allows remote attackers to bypass the Same Origin Policy or cause a denial of service (DOM tree corruption) via a web site with crafted JavaScript code and IFRAME elements.


The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged.


The Multicast DNS (mDNS) responder in IBM Security Access Manager for Web 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 inadvertently responds to unicast queries with source addresses that are not link-local which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets.


The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.


The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data related to an XML Entity Expansion (XEE) attack.


The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.


Multiple

use-after-free

vulnerabilities

in

the

PrintWebViewHelper

class

in

in

Google

Chrome

before

allow

user-assisted

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

by

triggering

nested

IPC

messages

during

preparation

for

printing

as

demonstrated

by

messages

associated

with

PDF

documents

in

conjunction

with

messages

about

printer

capabilities.


Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation.


The Remote Document Conversion Service (DCS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0.0 through 7.0.0.2 CF29 8.0.0 before 8.0.0.1 CF16 and 8.5.0 through CF05 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.


Use-after-free vulnerability in the shared-timer implementation in Blink as used in Google Chrome before 45.0.2454.85 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging erroneous timer firing related to ThreadTimers.cpp and Timer.cpp.


Unspecified

vulnerability

in

Jazz

Team

Server

in

Jazz

Foundation

in

IBM

Rational

Collaborative

Lifecycle

Management

(CLM)

and

before

and

before

Rational

Quality

Manager

(RQM)

and

before

before

and

before

Rational

Team

Concert

(RTC)

and

before

before

and

before

Rational

Requirements

Composer

(RRC)

and

before

and

through

Rational

DOORS

Next

Generation

(RDNG)

before

and

before

Rational

Engineering

Lifecycle

Manager

(RELM)

through

through

and

through

Rational

Rhapsody

Design

Manager

(DM)

through

through

through

and

and

Rational

Software

Architect

Design

Manager

(DM)

through

through

and

through

allows

remote

attackers

to

cause

a

denial

of

service

via

unknown

vectors.


The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU) as used in Google Chrome before 44.0.2403.89 mishandles converter names with initial x- substrings which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file.


IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data a different vulnerability than CVE-2015-1956 and CVE-2015-1987.


CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.


Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in Blink as used in Google Chrome before 41.0.2272.76 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger extraneous change events as demonstrated by events for invalid input or input to read-only fields related to the initializeTypeInParsing and updateType functions.


kbx/keybox-search.c in GnuPG before 1.4.19 2.0.x before 2.0.27 and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file related to sign extensions and \memcpy with overlapping ranges.\


The inet module in FreeBSD 10.2x before 10.2-PRERELEASE 10.2-BETA2-p2 10.2-RC1-p1 10.1x before 10.1-RELEASE-p16 9.x before 9.3-STABLE 9.3-RELEASE-p21 and 8.x before 8.4-STABLE 8.4-RELEASE-p35 on systems with VNET enabled and at least 16 VNET instances allows remote attackers to cause a denial of service (mbuf consumption) via multiple concurrent TCP connections.


The nft_flush_table function in net/netfilter/nf_tables_api.c in the Linux kernel before 3.18.5 mishandles the interaction between cross-chain jumps and ruleset flushes which allows local users to cause a denial of service (panic) by leveraging the CAP_NET_ADMIN capability.


The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg 1.0.0 before 1.0.0s 1.0.1 before 1.0.1n and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure as demonstrated by an unrecognized X.660 OID for a hash function.