Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the shutting down of a worker process.


The Data Protection for VMware component in IBM Tivoli Storage Manager for Virtual Environments (TSMVE) 6.3 through 7.1.0.2 does not properly check authorization for backup and restore operations which allows local users to obtain sensitive VM data or cause a denial of service (disk consumption) via unspecified GUI actions.


The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container related to \paths under /proc/$PID/root\ and the virInitctlSetRunLevel function.


The SSL VPN implementation in Cisco IOS 15.3(1)T2 and earlier allows remote authenticated users to cause a denial of service (interface queue wedge) via crafted DTLS packets in an SSL session aka Bug IDs CSCuh97409 and CSCud90568.


denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs which allows remote attackers to cause a denial of service (incorrect block of IP addresses) via crafted login names.


The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-length write operation.


The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7 as used in Google Chrome before 31.0.1650.63 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via JavaScript code that sets the value of an array element with a crafted index.


The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution which allows remote attackers to read arbitrary files cause a denial of service and conduct CSRF attacks via crafted XML aka an XML External Entity (XXE) issue and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.


Xen 4.2.x and 4.3.x when using Intel VT-d and a PCI device has been assigned does not clear the flag that suppresses IOMMU TLB flushes when unspecified errors occur which causes the TLB entries to not be flushed and allows local guest administrators to cause a denial of service (host crash) or gain privileges via unspecified vectors.


The ieee802154_map_rec function in epan/dissectors/packet-ieee802154.c in the IEEE 802.15.4 dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 uses an incorrect pointer chain which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Juniper Junos before 10.4S14 11.4 before 11.4R5-S2 12.1R before 12.1R3 12.1X44 before 12.1X44-D20 and 12.1X45 before 12.1X45-D15 on SRX Series services gateways when a plugin using TCP proxy is configured allows remote attackers to cause a denial of service (flow daemon crash) via an unspecified sequence of TCP packets.


clamscan in ClamAV before 0.98.5 when using -a option allows remote attackers to cause a denial of service (crash) as demonstrated by the jwplayer.js file.


Use-after-free vulnerability in core/dom/ContainerNode.cpp in Blink as used in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of DOM range objects in circumstances that require child node removal after a (1) mutation or (2) blur event.


The Cisco Express Forwarding processing module in Cisco IOS XE allows remote attackers to cause a denial of service (device reload) via crafted MPLS packets that are not properly handled during IP header validation aka Bug ID CSCuj23992.


Unspecified vulnerability in HP StoreOnce Virtual Storage Appliance (VSA) before 3.7.2 StoreOnce 26xx and 4210 iSCSI Backup System before 3.9.0 StoreOnce 4210 FC Backup System before 3.9.0 and StoreOnce 4xxx Backup System before 3.9.0 allows remote attackers to obtain sensitive information or cause a denial of service via unknown vectors.


Xen 4.2.x and 4.3.x when using Intel VT-d for PCI passthrough does not properly flush the TLB after clearing a present translation table entry which allows local guest administrators to cause a denial of service or gain privileges via unspecified vectors related to an \inverted boolean parameter.\


Use-after-free vulnerability in the web contents implementation in Google Chrome before 33.0.1750.117 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attempted conflicting access to the color chooser.


The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types which allows local users to cause a denial of service (system hang) via a crafted application aka the errata 793 issue.


The MLDP implementation in Cisco IOS 15.3(3)S and earlier on 7600 routers when many VRFs are configured allows remote attackers to cause a denial of service (chunk corruption and device reload) by establishing many multicast flows aka Bug ID CSCue22345.


Unspecified vulnerability in Citrix NetScaler Application Delivery Controller (ADC) 9.3.x before 9.3-64.4 10.0 before 10.0-77.5 and 10.1 before 10.1-118.7 allows attackers to cause a denial of service via unknown vectors related to \RADIUS authentication.\


epan/dissectors/packet-tcp.c in the TCP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 does not properly determine the amount of remaining data which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The management implementation on Cisco ONS 15454 controller cards with software 9.8 and earlier allows remote attackers to cause a denial of service (card reset) via crafted packets aka Bug ID CSCtz50902.


The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data involving collisions.


Use-after-free vulnerability in the editing implementation in Blink as used in Google Chrome before 31.0.1650.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that triggers removal of a node during processing of the DOM tree related to CompositeEditCommand.cpp and ReplaceSelectionCommand.cpp.


in

Action

View

in

Ruby

on

Rails

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(memory

consumption)

via

a

header

containing

an

invalid

MIME

type

that

leads

to

excessive

caching.


The aac_send_raw_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain size value which allows local users to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via an FSACTL_SEND_RAW_SRB ioctl call that triggers a crafted SRB command.


The apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via crafted modifications of the TMICT value.


The FlashCopy Manager for VMware component in IBM Tivoli Storage FlashCopy Manager 3.1 through 4.1.0.1 does not properly check authorization for backup and restore operations which allows local users to obtain sensitive VM data or cause a denial of service (data overwrite or disk consumption) via unspecified GUI actions.


Use-after-free

vulnerability

in

the

FormAssociatedElement::formRemovedFromTree

function

in

in

Blink

as

used

in

Google

Chrome

before

on

Windows

and

before

on

Mac

OS

X

and

Linux

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

by

leveraging

improper

handling

of

the

past

names

map

of

a

FORM

element.


Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents


IBM GSKit 7.x before 7.0.4.48 and 8.x before 8.0.50.16 as used in IBM Security Directory Server (ISDS) and Tivoli Directory Server (TDS) allows remote attackers to cause a denial of service (application crash or hang) via a malformed X.509 certificate chain.


The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.


gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts which allows user-assisted remote attackers to cause a denial of service (application crash) via a long URL that is examined with a tooltip.


Use-after-free

vulnerability

in

the

OnWindowRemovingFromRootWindow

function

in

in

Google

Chrome

before

on

Windows

and

before

on

Mac

OS

X

and

Linux

allows

user-assisted

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

involving

certain

print-preview

and

tab-switch

actions

that

interact

with

a

speech

input

element.


DNP3Driver.exe in the DNP3 driver in Schneider Electric ClearSCADA 2010 R2 through 2010 R3.1 and SCADA Expert ClearSCADA 2013 R1 through 2013 R1.2 allows remote attackers to cause a denial of service (resource consumption) via IP packets containing errors that trigger event-journal messages.


The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a denial of service (disk consumption) by creating and deleting instances with unique os_type settings which triggers the creation of a new ephemeral disk backing file.


Cisco IOS XE does not properly manage memory for TFTP UDP flows which allows remote attackers to cause a denial of service (memory consumption) via TFTP (1) client or (2) server traffic aka Bug IDs CSCuh09324 and CSCty42686.


The get_group_tree function in lib/Munin/Master/HTMLConfig.pm in Munin before 2.0.18 allows remote nodes to cause a denial of service (infinite loop and memory consumption in the munin-html process) via crafted multigraph data.


Cisco IOS XE 3.7S(.1) and earlier allows remote attackers to cause a denial of service (Packet Processor crash) via fragmented MPLS IP packets aka Bug ID CSCul00709.


The WebVPN CIFS implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0(.4.1) and earlier allows remote CIFS servers to cause a denial of service (device reload) via a long share list aka Bug ID CSCuj83344.


Use-after-free vulnerability in the RenderSVGImage::paint function in core/rendering/svg/RenderSVGImage.cpp in Blink as used in Google Chrome before 32.0.1700.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a zero-size SVG image.


Use-after-free vulnerability in Blink as used in Google Chrome before 33.0.1750.117 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper handling of overflowchanged DOM events during interaction between JavaScript and layout.


The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 does not properly initialize a data structure which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Use-after-free

vulnerability

in

the

function

in

in

Blink

as

used

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

involving

FORM

elements

as

demonstrated

by

use

of

the

speech-recognition

feature.


The SNMP module in Cisco IOS XR allows remote attackers to cause a denial of service (process reload) via a request for an unspecified MIB aka Bug ID CSCuh43144.


The IP Device Tracking (IPDT) feature in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (IPDT AVL corruption and device reload) via a crafted sequence of ARP packets aka Bug ID CSCuh38133.


The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode.


Juniper NetScreen Firewall running ScreenOS 5.4 6.2 or 6.3 when the Ping of Death screen is disabled allows remote attackers to cause a denial of service via a crafted packet.


The server in Cybozu Garoon before 3.7 SP1 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.


SkRegion::setPath in Skia allows remote attackers to cause a denial of service (crash).


The SHSTI_UPLOAD_XML function in the Application Server for ABAP (AS ABAP) in SAP NetWeaver 7.31 and earlier allows remote attackers to cause a denial of service via unspecified vectors related to an XML External Entity (XXE) issue.


The bgp_attr_unknown function in bgp_attr.c in Quagga 0.99.21 does not properly initialize the total variable which allows remote attackers to cause a denial of service (bgpd crash) via a crafted BGP update.


The

SVGAnimateElement::calculateAnimatedValue

function

in

in

Blink

as

used

in

Google

Chrome

before

does

not

properly

handle

unexpected

data

types

which

allows

remote

attackers

to

cause

a

denial

of

service

(incorrect

cast)

or

possibly

have

unspecified

other

impact

via

unknown

vectors.


The tNetTaskLimit process on the Transport Node Controller (TNC) on Cisco ONS 15454 devices with software 9.6 and earlier does not properly prioritize health pings which allows remote attackers to cause a denial of service (watchdog timeout and TNC reset) via a flood of network traffic aka Bug ID CSCud97155.


The dissect_openwire_type function in epan/dissectors/packet-openwire.c in the OpenWire dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 allows remote attackers to cause a denial of service (loop) via a crafted packet.


Unspecified vulnerability on HP LaserJet M1522n and M2727; LaserJet Pro 100 300 400 CM1415fnw CP1* M121* M1536dnf and P1*; Color LaserJet CM* and CP*; and TopShot LaserJet Pro M275 printers allows remote attackers to cause a denial of service via unknown vectors.


The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds write operation and application crash) by triggering a socket read error.


The IPSec implementation in Cisco IOS allows remote attackers to cause a denial of service (MTU change and tunnel-session drop) via crafted ICMP packets aka Bug ID CSCul29918.


Use-after-free vulnerability in the HTMLMediaElement::didMoveToNewDocument function in core/html/HTMLMediaElement.cpp in Blink as used in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the movement of a media element between documents.


util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header which allows remote HTTP servers to cause a denial of service (application crash) via a crafted response.


Multiple use-after-free vulnerabilities in the layout implementation in Blink as used in Google Chrome before 33.0.1750.117 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving (1) running JavaScript code during execution of the updateWidgetPositions function or (2) making a call into a plugin during execution of the updateWidgetPositions function.


The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM APM ASM Edge Gateway GTM Link Controller and WOM 10.0.0 through 10.2.2 and 11.0.0; Analytics 11.0.0; PSM 9.4.0 through 9.4.8 10.0.0 through 10.2.4 and 11.0.0 through 11.4.1; and WebAccelerator 9.4.0 through 9.4.8 10.0.0 through 10.2.4 and 11.0.0 through 11.3.0 might change a TCP connection to the ESTABLISHED state before receiving the ACK packet which allows remote attackers to cause a denial of service (SIGFPE or assertion failure and TMM restart) via unspecified vectors.


The Schneider Electric Telvent SAGE 3030 RTU with firmware C3413-500-001D3_P4 and C3413-500-001F0_PB allows remote attackers to cause a denial of service (temporary outage and CPU consumption) via malformed DNP3 traffic.


IBM Global Security Kit (aka GSKit) as used in Content Manager OnDemand 8.5 and 9.0 and other products allows remote attackers to cause a denial of service via a crafted handshake during resumption of an SSLv2 session.


Microsoft Word 2003 SP2 and SP3 on Windows XP SP3 allows remote attackers to cause a denial of service (CPU consumption) via a malformed .doc file containing an embedded image as demonstrated by word2003forkbomb.doc related to a \fork bomb\ issue.


The web framework on Cisco Wireless LAN Controller (WLC) devices does not properly validate configuration parameters which allows remote authenticated users to cause a denial of service via a crafted HTTP request aka Bug ID CSCuh81011.


OpenStack Compute (Nova) Folsom Grizzly and Havana when use_cow_images is set to False does not verify the virtual size of a QCOW2 image which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.


The Huawei Access Router (AR) before V200R002SPC003 allows remote attackers to cause a denial of service (device reset) via a crafted field in a DHCP request as demonstrated by a request from an IP phone.


XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0 as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3 6 before 6 SR14 6.0.1 before 6.0.1 SR6 and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier Java SE 6u60 and earlier Java SE 5.0u51 and earlier JRockit R28.2.8 and earlier JRockit R27.7.6 and earlier Java SE Embedded 7u40 and earlier and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.


Double free vulnerability in the dissect_dcom_ActivationProperties function in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet.


epan/dissectors/packet-rdp.c in the RDP dissector in Wireshark 1.8.x before 1.8.8 does not validate return values during checks for data availability which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


flowd in Juniper Junos 10.4 before 10.4R11 on SRX devices when the MSRPC Application Layer Gateway (ALG) is enabled allows remote attackers to cause a denial of service (daemon crash) via crafted MSRPC requests aka PR 772834.


Cryptocat before 2.0.22 has Remote Denial of Service via username


The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an finfo object.


Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.


Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


The

function

in

in

the

Trace

module

in

the

Intel

WiMAX

Network

Service

through

for

Intel

Wireless

WiMAX

Connection

devices

uses

world-writable

permissions

for

wimaxd.log

which

allows

local

users

to

cause

a

denial

of

service

(data

corruption)

by

modifying

this

file.


Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu_agent.c in libvirt 1.0.6 through 1.1.0 allows remote attackers to cause a denial of service (daemon crash) via a cpu count request as demonstrated by the \virsh vcpucount dom --guest\ command.


xslt.c in libxslt before 1.1.25 allows context-dependent attackers to cause a denial of service (crash) via a stylesheet that embeds a DTD which causes a structure to be accessed as a different type. NOTE: this issue is due to an incomplete fix for CVE-2012-2825.


The udp_v6_push_pending_frames function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel through 3.10.3 makes an incorrect function call for pending data which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.


The bridge multicast implementation in the Linux kernel through 3.10.3 does not check whether a certain timer is armed before modifying the timeout value of that timer which allows local users to cause a denial of service (BUG and system crash) via vectors involving the shutdown of a KVM virtual machine related to net/bridge/br_mdb.c and net/bridge/br_multicast.c.


epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly determine whether there is remaining packet data to process which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The fib6_add_rt2node function in net/ipv6/ip6_fib.c in the IPv6 stack in the Linux kernel through 3.10.1 does not properly handle Router Advertisement (RA) messages in certain circumstances involving three routes that initially qualified for membership in an ECMP route set until a change occurred for one of the first two routes which allows remote attackers to cause a denial of service (system crash) via a crafted sequence of messages.


The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service.


IBM WebSphere Portal 8.0.0.x before 8.0.0.1 CF09 when Content Template Catalog 4.0 is used does not require administrative privileges for Portal Application Archive (PAA) file installation which allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.


The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.


Multiple array index errors in epan/dissectors/packet-gsm_a_common.c in the GSM A Common dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allow remote attackers to cause a denial of service (application crash) via a crafted packet.


The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.


The http_payload_subdissector function in epan/dissectors/packet-http.c in the HTTP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 does not properly determine when to use a recursive approach which allows remote attackers to cause a denial of service (stack consumption) via a crafted packet.


The policy definition evaluator in Condor 7.5.4 8.0.0 and earlier does not properly handle attributes in a (1) PREEMPT (2) SUSPEND (3) CONTINUE (4) WANT_VACATE or (5) KILL policy that evaluate to an Unconfigured Undefined or Error state which allows remote authenticated users to cause a denial of service (condor_startd exit) via a crafted job.


flowd in Juniper Junos 10.4 before 10.4S14 11.4 before 11.4R8 12.1 before 12.1R7 and 12.1X44 before 12.1X44-D15 on SRX devices when PIM and NAT are enabled allows remote attackers to cause a denial of service (daemon crash) via crafted PIM packets aka PR 842253.


The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12 when UDP Fragmentation Offload (UFO) is enabled does not properly perform a certain size comparison before inserting a fragment header which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline.


The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 incorrectly uses a -1 data value to represent an error condition which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The kempf_decode_tile function in libavcodec/g2meet.c in FFmpeg before 2.0.1 allows remote attackers to cause a denial of service (out-of-bounds heap write) via a G2M4 encoded file.


Xen before 4.1.x 4.2.x and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors.


The xenlight library (libxl) in Xen 4.0.x through 4.2.x when IOMMU is disabled provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction.


The Stage File Proxy module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to cause a denial of service (file operations performance degradation and failure) via a large number of requests.


NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier GS748Tv4 5.4.1.14 and GS510TP 5.0.4.4 allows remote attackers to cause a denial of service (reboot or crash) via a crafted HTTP request to filesystem/.


OpenStack Compute (Nova) Folsom Grizzly and earlier when using Apache Qpid for the RPC backend does not properly handle errors that occur during messaging which allows remote attackers to cause a denial of service (connection pool consumption) as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log.


The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certificate message that contains a PEM encoded certificate.


The rwm overlay in OpenLDAP 2.4.23 2.4.36 and earlier does not properly count references which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.


The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.


Xen 4.3.x writes hypervisor mappings to certain shadow pagetables when live migration is performed on hosts with more than 5TB of RAM which allows local 64-bit PV guests to read or write to invalid memory and cause a denial of service (crash).


The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not properly allocate memory which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.


The dissect_r3_upstreamcommand_queryconfig function in epan/dissectors/packet-assa_r3.c in the Assa Abloy R3 dissector in Wireshark 1.8.x before 1.8.8 does not properly handle a zero-length item which allows remote attackers to cause a denial of service (infinite loop and CPU and memory consumption) via a crafted packet.


Unspecified vulnerability in bitcoind and Bitcoin-Qt 0.8.x allows remote attackers to cause a denial of service (memory consumption) via a large amount of tx message data.


epan/dissectors/packet-gmr1_bcch.c in the GMR-1 BCCH dissector in Wireshark 1.8.x before 1.8.8 does not properly initialize memory which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Katello has a Denial of Service vulnerability in API OAuth authentication


The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order which allows local guest administrators to cause a denial of service (host deadlock).


Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2 1.8.24 through 1.8.26 2.0.x before 2.0.10 and 2.1.x before 2.1.5 as used in Ruby 1.9.0 through 2.0.0p247 allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.


Android 3.0 through 4.1.x on Disney Mobile eAccess KDDI NTT DOCOMO SoftBank and other devices does not properly implement the WebView class which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page as demonstrated by use of the WebView.addJavascriptInterface method a related issue to CVE-2012-6636.


Memory leak in the dissect_dcom_ActivationProperties function in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (memory consumption) via crafted packets.


The dissect_schedule_message function in epan/dissectors/packet-gsm_cbch.c in the GSM CBCH dissector in Wireshark 1.8.x before 1.8.8 allows remote attackers to cause a denial of service (infinite loop and application hang) via a crafted packet.


The Fast Communications Manager (FCM) in IBM DB2 Enterprise Server Edition and Advanced Enterprise Server Edition 10.1 before FP3 and 10.5 when a multi-node configuration is used allows remote attackers to cause a denial of service via vectors involving arbitrary data.


The Ocaml xenstored implementation (oxenstored) in Xen 4.1.x 4.2.x and 4.3.x allows local guest domains to cause a denial of service (domain shutdown) via a large message reply.


389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in a GER attribute list in a search request.


The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.


Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to obtain sensitive information modify data or cause a denial of service via unknown vectors aka ZDI-CAN-1851.


The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1 when using the JAXB marshaller does not disable entity resolution which allows context-dependent attackers to read arbitrary files cause a denial of service and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource (2) StAXSource (3) SAXSource or (4) StreamSource aka an XML External Entity (XXE) issue.


Integer signedness error in the get_type_length function in epan/dissectors/packet-btsdp.c in the Bluetooth SDP dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.


The ip6_append_data_mtu function in net/ipv6/ip6_output.c in the IPv6 implementation in the Linux kernel through 3.10.3 does not properly maintain information about whether the IPV6_MTU setsockopt option had been specified which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.


The parseFields function in epan/dissectors/packet-dis-pdus.c in the DIS dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not terminate packet-data processing after finding zero remaining bytes which allows remote attackers to cause a denial of service (loop) via a crafted packet.


The OSPF implementation on HP JD9##A routers; HP J4###A J484#B J8###A JD3##A JE###A and JF55#A switches; HP 3COM routers and switches; and HP H3C routers and switches does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database which allows remote authenticated users to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet a related issue to CVE-2013-0149.


libvirt 1.1.0 and 1.1.1 allows local users to cause a denial of service (memory consumption) via a large number of domain migrate parameters in certain RPC calls in (1) daemon/remote.c and (2) remote/remote_driver.c.


MySecureShell 1.31 has a Local Denial of Service Vulnerability


epan/proto.c in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop) via a crafted packet that is not properly handled by the GSM RR dissector.


flowd in Juniper Junos 10.4 before 10.4S14 11.2 and 11.4 before 11.4R6-S2 and 12.1 before 12.1R6 on SRX devices when certain Application Layer Gateways (ALGs) are enabled allows remote attackers to cause a denial of service (daemon crash) via crafted TCP packets aka PRs 727980 806269 and 835593.


The ExportAlphaQuantumType function in export.c in GraphicsMagick before 1.3.18 might allow remote attackers to cause a denial of service (crash) via vectors related to exporting the alpha of an 8-bit RGBA image.


The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol.


The skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel through 3.12 allows remote attackers to cause a denial of service (infinite loop) via a small value in the IHL field of a packet with IPIP encapsulation.


Xen 4.2.x and 4.3.x when nested virtualization is disabled does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME which allows local HVM guest users to cause a denial of service (host crash) via unspecified vectors related to \guest VMX instruction execution.\


The remoteDispatchDomainMemoryStats function in daemon/remote.c in libvirt 0.9.1 through 0.10.1.x 0.10.2.x before 0.10.2.8 1.0.x before 1.0.5.6 and 1.1.x before 1.1.2 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a crafted RPC call.


QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.


The dissect_per_length_determinant function in epan/dissectors/packet-per.c in the ASN.1 PER dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize a length field in certain abnormal situations which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The web services APIs in Eucalyptus 2.0 through 3.4.1 allow remote attackers to cause a denial of service via vectors related to the \network connection clean up code\ and (1) Cloud Controller (CLC) (2) Walrus (3) Storage Controller (SC) and (4) VMware Broker (VB).


The buf_decompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial of service (memory consumption) via a compressed packet that has a large size when it is decompressed.


The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count which allows local users to cause a denial of service (memory consumption or system crash) via a crafted application.


Huawei AR 150 200 1200 2200 and 3200 routers when SNMPv3 is enabled allow remote attackers to cause a denial of service (device crash) via malformed SNMPv3 requests that leverage unspecified overflow issues.


The bad_mode function in arch/arm64/kernel/traps.c in the Linux kernel before 3.9.5 on the ARM64 platform allows local users to cause a denial of service (system crash) via vectors involving an attempted register access that triggers an unexpected value in the Exception Syndrome Register (ESR).


The SSH implementation on the D-Link Japan DWL-2100AP with firmware before R252JP-RC572 allows remote authenticated users to cause a denial of service (reboot) by leveraging login access.


The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1 and qemu 1.1 and other versions allows local HVM guests to cause a denial of service (domain grant reference consumption) via unspecified vectors.


Apache Tomcat before 6.0.39 7.x before 7.0.50 and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.


libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a denial of service or obtain sensitive information by editing packed revision properties.


The Misery module 6.x-2.x before 6.x-2.5 and 7.x-2.x before 7.x-2.2 for Drupal when the \delay misery\ configuration is set to a high value allows remote attackers to cause a denial of service (process consumption) via multiple requests.


The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3 Havana before havana-3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.


libavcodec/h264.c in FFmpeg before 0.11.4 allows remote attackers to cause a denial of service (crash) via vectors related to alternating bit depths in H.264 data.


traverser.py in Plone 2.1 through 4.1 4.2.x through 4.2.5 and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service (infinite loop and resource consumption) via unspecified vectors related to \retrieving information for certain resources.\


The P1 dissector in Wireshark 1.10.x before 1.10.1 does not properly initialize a global variable which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Apache Santuario XML Security for Java before 1.5.6 when applying Transforms allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs) related to signatures.


ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service (server crash) via a crafted Distinguished Name (DN) in a MOD operation request.


OpenStack Swift before 1.9.1 in Folsom Grizzly and Havana allows authenticated users to cause a denial of service (\superfluous\ tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.


The

org.jboss.remoting.transport.socket.ServerThread

class

in

Red

Hat

JBoss

Remoting

for

Red

Hat

JBoss

SOA

Platform

GA

Web

Platform

Enterprise

Application

Platform

and

other

products

allows

remote

attackers

to

cause

a

denial

of

service

(file

descriptor

consumption)

via

unspecified

vectors.


The SSH implementation on D-Link Japan DES-3810 devices with firmware before R2.20.011 allows remote authenticated users to cause a denial of service (device hang) by leveraging login access.


Microsoft Windows Movie Maker 2.1.4026.0 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash) via a crafted .wav file as demonstrated by movieMaker.wav.


The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3 when ACLs are used does not set an identity which causes event handler removal to be denied and remote attackers to cause a denial of service (use-after-free and crash) by registering an event handler and then closing the connection.


epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly validate certain index values which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.


The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4 when built with assertions enabled and SVNAutoversioning is enabled allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request as demonstrated using a trailing /.


Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1 1.8.24 through 1.8.25 2.0.x before 2.0.8 and 2.1.x before 2.1.0 as used in Ruby 1.9.0 through 2.0.0p247 allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.


Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates which allows remote authenticated users to cause a denial of service (nova-network consumption) via a large number of server-creation operations which triggers a large number of update requests.


OpenStack Compute (Nova) Folsom Grizzly and Havana does not properly verify the virtual size of a QCOW2 image which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.


The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2 9.8.6b1 9.9.x before 9.9.3-P2 and 9.9.4b1 and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1 allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message as exploited in the wild in July 2013.


The dissect_dvbci_tpdu_hdr function in epan/dissectors/packet-dvbci.c in the DVB-CI dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not validate a certain length value before decrementing it which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.


The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.6.x before 1.6.16 1.8.x before 1.8.8 and 1.10.0 does not validate a certain fragment length value which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The kernel in Juniper Junos 10.4 before 10.4R14 11.4 before 11.4R8 11.4X27 before 11.4X27.43 12.1 before 12.1R6 12.1X44 before 12.1X44-D20 12.2 before 12.2R4 and 12.3 before 12.3R2 in certain VLAN configurations with unrestricted arp-resp and proxy-arp settings allows remote attackers to cause a denial of service (device crash) via a crafted ARP request aka PR 842091.


The DMCRUIS/0.1 web server on the Samsung PS50C7700 TV allows remote attackers to cause a denial of service (daemon crash) via a long URI to TCP port 5600.


The

Canon

and

printers

allow

remote

attackers

to

cause

a

denial

of

service

(device

hang)

via

a

crafted

parameter

to

followed

by

a

direct

request

to

NOTE:

the

vendor

has

apparently

responded

by

stating

\Canon

believes

that

its

printers

will

not

have

to

deal

with

unauthorized

access

to

the

network

from

an

external

location

as

long

as

the

printers

are

used

in

a

secured

environment.\


client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header.


Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.


The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize certain structure members which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.


The virFileNBDDeviceAssociate function in util/virfile.c in libvirt 1.1.2 and earlier allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via unspecified vectors.


(1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1 4.2.x through 4.2.5 and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service (resource consumption) via a large zip archive which is expanded (decompressed).


The cloud controller (aka CLC) component in Eucalyptus 3.3.x and 3.4.x before 3.4.2 when the dns.recursive.enabled setting is used allows remote attackers to cause a denial of service (traffic amplification) via spoofed DNS queries.


The command-port listener in IBM WebSphere MQ Internet Pass-Thru (MQIPT) 2.x before 2.1.0.1 allows remote attackers to cause a denial of service (remote-administration outage) via unspecified vectors.


The OSPFv3 functionality in Cisco IOS XR 5.1 allows remote attackers to cause a denial of service (process crash) via a malformed LSA Type-1 packet aka Bug ID CSCuj82176.


Suricata before 1.4.6 allows remote attackers to cause a denial of service (crash) via a malformed SSL record.


The agent and task-agent components in Symantec Management Platform 7.0 and 7.1 before 7.1 SP2 Mp1.1v7 rollup as used in certain Altiris products use the same registry-entry encryption key across different customers' installations which makes it easier for local users to obtain sensitive information about package-server access or cause a denial of service by leveraging knowledge of this key.


Cisco Secure Access Control System (ACS) does not properly implement an incoming-packet firewall rule which allows remote attackers to cause a denial of service (process crash) via a flood of crafted packets aka Bug ID CSCui51521.


The Bluetooth HCI ACL dissector in Wireshark 1.10.x before 1.10.2 does not properly maintain a certain free list which allows remote attackers to cause a denial of service (application crash) via a crafted packet that is not properly handled by the wmem_block_alloc function in epan/wmem/wmem_allocator_block.c.


IBM WebSphere DataPower XC10 appliances 2.5.0 do not require authentication for all administrative actions which allows remote attackers to cause a denial of service via unspecified vectors.


The IPsec implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1 before 9.1(1.7) when an IPsec VPN tunnel is enabled allows remote attackers to cause a denial of service (device reload) via a (1) ICMP or (2) ICMPv6 packet that is improperly handled during decryption aka Bug ID CSCue18975.


The fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to cause a denial of service via crafted command parameters that trigger hardware-component write operations aka Bug ID CSCtq86549.


Open Network Environment Platform (ONEP) in Cisco NX-OS allows remote authenticated users to cause a denial of service (network-element reload) via a crafted packet aka Bug ID CSCui51551.


The UDP process in Cisco IOS XR 4.3.1 does not free packet memory upon detecting full packet queues which allows remote attackers to cause a denial of service (memory consumption) via UDP packets to listening ports aka Bug ID CSCue69413.


The OSPF implementation in IBM i 6.1 and 7.1 in z/OS on zSeries servers and in Networking Operating System (aka NOS formerly BLADE Operating System) does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet a related issue to CVE-2013-0149.


The VPN authentication functionality in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of service (device reload) by sending many username-from-cert IKE requests aka Bug ID CSCua91108.


Cisco 9900 fourth-generation IP phones do not properly perform SDP negotiation which allows remote attackers to cause a denial of service (device reboot) via crafted SDP packets aka Bug ID CSCuf06698.


The Sandbox subsystem in Apple iOS before 7 allows attackers to cause a denial of service (infinite loop) via an application that writes crafted values to /dev/random.


Mozilla Network Security Services (NSS) 3.14 before 3.14.5 and 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets.


The file-upload feature in Cisco Identity Services Engine (ISE) allows remote authenticated users to cause a denial of service (disk consumption and administration-interface outage) by uploading many files aka Bug ID CSCui67519.


The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation as demonstrated by a PBKDF2 computation.


The T1/E1 driver-queue functionality in Cisco IOS 12.2 and 15.0 through 15.3 when an HDLC32 driver is used allows remote attackers to cause a denial of service (interface queue wedge) via bursty network traffic aka Bug ID CSCub67465.


Cisco Adaptive Security Appliance (ASA) Software 8.2.x before 8.2(5.46) 8.3.x before 8.3(2.39) 8.4.x before 8.4(7) 8.5.x before 8.5(1.18) 8.6.x before 8.6(1.12) 8.7.x before 8.7(1.7) 9.0.x before 9.0(3.3) and 9.1.x before 9.1(1.8) when the DNS ALPI engine is enabled for TCP allows remote attackers to cause a denial of service (device reload) via crafted TCP DNS packets aka Bug ID CSCug03975.


The (1) Conn_StartLogin and (2) cb_Read_Resolver_Result functions in conn.c in ngIRCd 18 through 20.2 when the configuration option NoticeAuth is enabled does not properly handle the return code for the Handle_Write function which allows remote attackers to cause a denial of service (assertion failure and server crash) via unspecified vectors related to a \notice auth\ message not being sent to a new client.


The PPTP ALG implementation in Cisco IOS XE 3.9 before 3.9.2S on 1000 ASR devices allows remote attackers to cause a denial of service (device reload) by sending many PPTP packets over NAT aka Bug ID CSCuh19936.


The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests as exploited in the wild in December 2013.


The OSPF functionality in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted options in an LSA type 11 packet aka Bug ID CSCui21030.


The NTP implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.1 and IOS XE 2.1 through 3.3 does not properly handle encapsulation of multicast NTP packets within MSDP SA messages which allows remote attackers to cause a denial of service (device reload) by leveraging an MSDP peer relationship aka Bug ID CSCuc81226.


The Media Snapshot implementation on Cisco TelePresence Multipoint Switch (CTMS) devices allows remote authenticated users to cause a denial of service (device reload) by sending many Media Snapshot requests at the time of a meeting termination aka Bug ID CSCuh44796.


goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service (device crash) via crafted HTTP POST data.


Smart Card Services in Apple Mac OS X before 10.9 does not properly implement certificate-revocation checks which allows remote attackers to cause a denial of service (Smart Card usage outage) by interfering with the revocation-check procedure.


Apple AirPort Base Station Firmware before 7.6.4 does not properly handle incorrect frame lengths which allows remote attackers to cause a denial of service (device crash) by associating with the access point and then sending a short frame.


The Zone-Based Firewall (ZFW) feature in Cisco IOS 15.1 through 15.2 when content filtering or HTTP ALG inspection is enabled allows remote attackers to cause a denial of service (device reload or hang) via crafted IPv4 HTTP traffic aka Bug ID CSCtx56174.


The auto-update implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0.3.6 and earlier allows remote attackers to cause a denial of service (device reload) via crafted update data aka Bug ID CSCui33308.


The vino_server_client_data_pending function in vino-server.c in GNOME Vino 2.26.1 2.32.1 3.7.3 and earlier and 3.8 when encryption is disabled does not properly clear client data when an error causes the connection to close during authentication which allows remote attackers to cause a denial of service (infinite loop CPU and disk consumption) via multiple crafted requests during authentication.


The Java process in the Impact server in Cisco Prime Central for Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (process crash) via a flood of TCP packets aka Bug ID CSCug57345.


The kernel in Apple Mac OS X before 10.9 does not properly check for errors during the processing of multicast Wi-Fi packets which allows remote attackers to cause a denial of service (system crash) by leveraging presence in an 802.11 network's coverage area.


The web framework on Cisco Web Security Appliance (WSA) Email Security Appliance (ESA) and Content Security Management Appliance (SMA) devices does not properly manage the state of HTTP and HTTPS sessions which allows remote attackers to cause a denial of service (management GUI outage) via multiple TCP connections aka Bug IDs CSCuj59411 CSCuf89818 and CSCuh05635.


Gretech GOM Media Player 2.2.53.5169 and possibly earlier allows remote attackers to cause a denial of service (application crash) via a crafted WAV file.


Cisco Adaptive Security Appliance (ASA) Software when certain same-security-traffic and management-access options are enabled allows remote authenticated users to cause a denial of service (stack overflow and device reload) by using the clientless SSL VPN portal for internal-resource browsing aka Bug ID CSCui51199.


The authentication manager process in the web framework in Cisco Intrusion Prevention System (IPS) does not properly handle user tokens which allows remote attackers to cause a denial of service (intermittent MainApp hang) via a crafted management-interface connection request aka Bug ID CSCuf20148.


Triangle Research International (aka Tri) Nano-10 PLC devices with firmware r81 and earlier do not properly handle large length values in MODBUS data which allows remote attackers to cause a denial of service (transition to the interrupt state) via a crafted packet to TCP port 502.


The IPv6 implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1.3 and earlier when NAT64 or NAT66 is enabled does not properly process NAT rules which allows remote attackers to cause a denial of service (device reload) via crafted packets aka Bug ID CSCue34342.


Unspecified vulnerability in the SSH implementation on D-Link Japan DES-3800 devices with firmware before R4.50B58 allows remote authenticated users to cause a denial of service (device hang) via unknown vectors a different vulnerability than CVE-2013-5998.


Cisco IOS XR 3.8.1 through 4.2.0 does not properly process fragmented packets within the RP-A RP-B PRP and DRP-B route-processor components which allows remote attackers to cause a denial of service (transmission outage) via (1) IPv4 or (2) IPv6 traffic aka Bug ID CSCuh30380.


The XSLT library in IBM DB2 and DB2 Connect 9.5 through 10.5 and the DB2 pureScale Feature 9.8 for Enterprise Server Edition allows remote authenticated users to cause a denial of service via unspecified vectors.


The (1) IPv6 and (2) ATM ioctl request handlers in the kernel in FreeBSD 8.3 through 9.2-STABLE do not validate SIOCSIFADDR SIOCSIFBRDADDR SIOCSIFDSTADDR and SIOCSIFNETMASK requests which allows local users to perform link-layer actions cause a denial of service (panic) or possibly gain privileges via a crafted application.


Cisco IOS XE 3.9 before 3.9.2S on 1000 ASR devices allows remote attackers to cause a denial of service (device reload) by sending malformed EoGRE packets over (1) IPv4 or (2) IPv6 aka Bug ID CSCuf08269.


hostd-vmdb in VMware ESXi 4.0 through 5.0 and ESX 4.0 through 4.1 allows remote attackers to cause a denial of service (hostd-vmdb service outage) by modifying management traffic.


The PPTP implementation in Cisco IOS 12.2 and 15.0 through 15.3 when NAT is used allows remote attackers to cause a denial of service (device reload) via crafted TCP port-1723 packets aka Bug ID CSCtq14817.


Blue Coat ProxySG before 6.2.14.1 6.3.x 6.4.x and 6.5 before 6.5.2 allows remote attackers to cause a denial of service (memory consumption and dropped connections) via a recursive href in an HTML page which triggers a large number of HTTP RW pipeline pre-fetch requests.


The remember feature in the DHCP server in Cisco IOS allows remote attackers to cause a denial of service (device reload) by acquiring a lease and then sending a DHCPRELEASE message aka Bug ID CSCuh46822.


Cisco Secure Access Control System (ACS) does not properly handle requests to read from the TACACS+ socket which allows remote attackers to cause a denial of service (process crash) via malformed TCP packets aka Bug ID CSCuh12488.


The SQL*Net inspection engine in Cisco Adaptive Security Appliance (ASA) Software 7.x before 7.2(5.12) 8.x before 8.2(5.44) 8.3.x before 8.3(2.39) 8.4.x before 8.4(6) 8.5.x before 8.5(1.18) 8.6.x before 8.6(1.12) 8.7.x before 8.7(1.6) 9.0.x before 9.0(2.10) and 9.1.x before 9.1(2) and Firewall Services Module (FWSM) 3.1.x and 3.2.x before 3.2(27) and 4.x before 4.1(14) allows remote attackers to cause a denial of service (device reload) via crafted segmented Transparent Network Substrate (TNS) packets aka Bug ID CSCub98434.


Cisco IOS XE 3.4 before 3.4.2S and 3.5 before 3.5.1S on 1000 ASR devices allows remote attackers to cause a denial of service (device reload) via malformed ICMP error packets associated with a (1) TCP or (2) UDP session that is under inspection by the Zone-Based Firewall (ZBFW) component aka Bug ID CSCtt26470.


The USB hub controller in Apple Mac OS X before 10.9 allows local users to cause a denial of service (system crash) via a request with a crafted (1) port or (2) port number.


The dissect_nbap_T_dCH_ID function in epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not restrict the dch_id value which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Cisco Identity Services Engine does not properly restrict the creation of guest accounts which allows remote attackers to cause a denial of service (exhaustion of the account supply) via a series of requests within one session aka Bug ID CSCue94287.


The Bloom Filter implementation in bitcoind and Bitcoin-Qt 0.8.x before 0.8.4rc1 allows remote attackers to cause a denial of service (divide-by-zero error and daemon crash) via a crafted sequence of messages.


Cisco NX-OS 5.0 and earlier on MDS 9000 devices allows remote attackers to cause a denial of service (supervisor CPU consumption) via Authentication Header (AH) authentication in a Virtual Router Redundancy Protocol (VRRP) frame aka Bug ID CSCte27874.


Cisco IOS 15.0 through 15.3 and IOS XE 3.2 through 3.8 when a VRF interface exists allows remote attackers to cause a denial of service (interface queue wedge) via crafted UDP RSVP packets aka Bug ID CSCuf17023.


The Proxy Bypass Content Rewriter feature in the WebVPN subsystem in Cisco Adaptive Security Appliance (ASA) Software 9.1(.2) and earlier allows remote authenticated users to cause a denial of service (device crash or error-recovery event) via an HTTP request that triggers a rewrite aka Bug ID CSCug91577.


The deployment module in the server in Cisco WebEx Meeting Center does not properly validate the passphrase which allows remote attackers to launch a deployment or cause a denial of service (deployment interruption) via a direct request aka Bug ID CSCuf52200.


The ITM web server in Cisco Prime Central for Hosted Collaboration Solution (HCS) allows remote attackers to cause a denial of service (temporary HTTP service outage) via a flood of TCP packets aka Bug ID CSCuh36313.


The random-number generator in the kernel in Apple Mac OS X before 10.9 provides lengthy exclusive access for processing of large requests which allows local users to cause a denial of service (temporary generator outage) via an application that requires many random numbers.


The dissect_mq_rr function in epan/dissectors/packet-mq.c in the MQ dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not properly determine when to enter a certain loop which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Cisco Adaptive Security Appliance (ASA) Software 8.4(.6) and earlier when using an unsupported configuration with overlapping criteria for filtering and inspection allows remote attackers to cause a denial of service (traffic loop and device crash) via a packet that triggers multiple matches aka Bug ID CSCui45606.


The DNS-over-TCP implementation in Cisco IOS 12.2 and 15.0 through 15.3 when NAT is used allows remote attackers to cause a denial of service (device reload) via a crafted IPv4 DNS TCP stream aka Bug ID CSCtn53730.


The ActiveX controls in the HelpAsst component in NI Help Links in National Instruments LabWindows/CVI 2012 SP1 and earlier LabVIEW 2012 SP1 and earlier and other products allow remote attackers to cause a denial of service by triggering the display of local .chm files.


Cisco Common Services as used in Cisco Prime LAN Management Solution (LMS) Cisco Security Manager Cisco Unified Service Monitor and Cisco Unified Operations Manager does not properly interact with the ActiveMQ component which allows remote attackers to cause a denial of service (memory consumption) via simultaneous TCP sessions aka Bug IDs CSCuh54766 CSCuh01267 CSCuh95976 and CSCuh95969.


The kernel in Apple Mac OS X before 10.9 does not properly determine the output length for SHA-2 digest function calls which allows context-dependent attackers to cause a denial of service (panic) by triggering a digest operation as demonstrated by an IPSec connection.


The TCP implementation in Cisco IOS does not properly implement the transitions from the ESTABLISHED state to the CLOSED state which allows remote attackers to cause a denial of service (flood of ACK packets) via a crafted series of ACK and FIN packets aka Bug ID CSCtz14399.


The TCP reassembly feature in Cisco IOS XE 3.7 before 3.7.3S and 3.8 before 3.8.1S on 1000 ASR devices allows remote attackers to cause a denial of service (device reload) via large TCP packets that are processed by the (1) NAT or (2) ALG component aka Bug ID CSCud72509.


The DNS-over-TCP implementation in Cisco IOS 12.2 and 15.0 through 15.3 when NAT is used allows remote attackers to cause a denial of service (device reload) via a crafted IPv4 DNS TCP stream aka Bug ID CSCuf28733.


Unspecified vulnerability in the Web manager implementation on D-Link Japan DES-3800 devices with firmware before R4.50B58 allows remote attackers to cause a denial of service (device hang) via unknown vectors a different vulnerability than CVE-2013-5997.


The Security component in Symfony 2.0.x before 2.0.25 2.1.x before 2.1.13 2.2.x before 2.2.9 and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation as demonstrated by a PBKDF2 computation a similar issue to CVE-2013-5750.


Junos Pulse Secure Access Service (IVE) 7.1 before 7.1r5 7.2 before 7.2r10 7.3 before 7.3r6 and 7.4 before 7.4r3 and Junos Pulse Access Control Service (UAC) 4.1 before 4.1r8.1 4.2 before 4.2r5 4.3 before 4.3r6 and 4.4 before 4.4r3 when a hardware SSL acceleration card is enabled allows remote attackers to cause a denial of service (device hang) via a crafted packet.


The PPTP-ALG component in CRS Carrier Grade Services Engine (CGSE) and ASR 9000 Integrated Service Module (ISM) in Cisco IOS XR allows remote attackers to cause a denial of service (module reset) via crafted packet streams aka Bug ID CSCue91963.


The Bluetooth USB host controller in Apple Mac OS X before 10.9 prematurely deletes interfaces which allows local users to cause a denial of service (system crash) via a crafted application.


The Clientless SSL VPN feature in Cisco Adaptive Security Appliance (ASA) Software 8.x before 8.2(5.44) 8.3.x before 8.3(2.39) 8.4.x before 8.4(5.7) 8.6.x before 8.6(1.12) 9.0.x before 9.0(2.6) and 9.1.x before 9.1(1.7) allows remote attackers to cause a denial of service (device reload) via crafted HTTPS requests aka Bug ID CSCua22709.


Cisco Adaptive Security Appliance (ASA) Software 8.4 before 8.4(7.2) 8.7 before 8.7(1.8) 9.0 before 9.0(3.6) and 9.1 before 9.1(2.8) allows remote attackers to cause a denial of service (firewall-session disruption or device reload) via crafted ICMP packets aka Bug ID CSCui77398.


epan/dissectors/packet-assa_r3.c in the ASSA R3 dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


Cisco IOS 12.2 through 12.4 and 15.0 through 15.3 and IOS XE 2.1 through 3.9 allows remote attackers to cause a denial of service (device reload) via crafted DHCP packets that are processed locally by a (1) server or (2) relay agent aka Bug ID CSCug31561.


The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12 7.0 before 7.0.0.7 and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities.


The Secure Shell (SSH) implementation on Cisco Adaptive Security Appliances (ASA) devices and in Cisco Firewall Services Module (FWSM) does not properly terminate sessions which allows remote attackers to cause a denial of service (SSH service outage) by repeatedly establishing SSH connections aka Bug IDs CSCue63881 CSCuf51892 CSCue78671 and CSCug26937.


Cisco Small Business Wireless Access Points WAP200 WAP2000 WAP200E and WET200 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SSID that is not properly handled during a site survey aka Bug IDs CSCua86182 CSCua91196 CSCud36155 and CSCua86190.


do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4 when a single-component realm name is used allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.


The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle a large number of padding bits which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


The traffic engineering (TE) processing subsystem in Cisco IOS XR allows remote attackers to cause a denial of service (process restart) via crafted TE packets aka Bug ID CSCue04000.


The dissect_clnp function in epan/dissectors/packet-clnp.c in the CLNP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly manage an offset variable which allows remote attackers to cause a denial of service (infinite loop or application crash) via a malformed packet.


OpenStack Compute (Nova) Grizzly Folsom (2012.2) and Essex (2012.1) does not properly implement a quota for fixed IPs which allows remote authenticated users to cause a denial of service (resource exhaustion and failure to spawn new instances) via a large number of calls to the addFixedIp function.


Xen 3.1 through 4.x when running 64-bit hosts on Intel CPUs does not clear the NT flag when using an IRET after a SYSENTER instruction which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault which is not properly handled by another IRET instruction.


The dissect_sip_p_charging_func_addresses function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle offset data associated with a quoted string which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


The ISM module in Cisco IOS on ISR G2 routers does not properly handle authentication-header packets which allows remote authenticated users to cause a denial of service (module reload) via a series of malformed packets aka Bug ID CSCub92025.


Use-after-free vulnerability in the shmem_remount_fs function in mm/shmem.c in the Linux kernel before 3.7.10 allows local users to gain privileges or cause a denial of service (system crash) by remounting a tmpfs filesystem without specifying a required mpol (aka mempolicy) mount option.


Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.0 allows remote attackers to cause a denial of service (CPU consumption and monitoring outage) via malformed TLS messages to TCP port (1) 9043 or (2) 9443 aka Bug ID CSCuc07155.


The fragment_set_tot_len function in epan/reassemble.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly determine the length of a reassembled packet for the DTLS dissector which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


Cisco IOS XE 3.2 through 3.4 before 3.4.5S and 3.5 through 3.7 before 3.7.1S on 1000 series Aggregation Services Routers (ASR) when VRF-aware NAT and SIP ALG are enabled allows remote attackers to cause a denial of service (card reload) by sending many SIP packets aka Bug ID CSCuc65609.


The regex engine in the BGP implementation in Cisco NX-OS when a complex regular expression is configured for inbound routes allows remote attackers to cause a denial of service (device reload) via a crafted AS path set aka Bug ID CSCuf49554.


The RSVP protocol implementation in Cisco IOS 12.2 and 15.0 through 15.2 and IOS XE 3.1.xS through 3.4.xS before 3.4.5S and 3.5.xS through 3.7.xS before 3.7.2S when MPLS-TE is enabled allows remote attackers to cause a denial of service (incorrect memory access and device reload) via a traffic engineering PATH message in an RSVP packet aka Bug ID CSCtg39957.


mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module but a certain href attribute in XML data refers to a non-DAV URI.


The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that trigger a free of an invalid pointer.


Xen 4.1.x and 4.2.x when the XSA-45 patch is in place does not properly maintain references on pages stored for deferred cleanup which allows local PV guest kernels to cause a denial of service (premature page free and hypervisor crash) or possibly gain privileges via unspecified vectors.


The Connection Manager in Cisco Jabber Extensible Communications Platform (aka Jabber XCP) does not properly validate login data which allows remote attackers to cause a denial of service (service crash) by sending a series of malformed login packets aka Bug ID CSCts76762.


The Protocol Translation (PT) functionality in Cisco IOS 12.3 through 12.4 and 15.0 through 15.3 when one-step port-23 translation or a Telnet-to-PAD ruleset is configured does not properly validate TCP connection information which allows remote attackers to cause a denial of service (device reload) via an attempted connection to a PT resource aka Bug ID CSCtz35999.


The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13 when JRuby is used does not properly restrict the capabilities of the XML parser which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.


win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 Windows 7 Gold and SP1 and Windows 8 allows local users to cause a denial of service (reboot) via a crafted OpenType font aka \OpenType Font Parsing Vulnerability\ or \Win32k Font Parsing Vulnerability.\


The DSP card on Cisco TelePresence MCU 4500 and 4501 devices before 4.3(2.30) TelePresence MCU MSE 8510 devices before 4.3(2.30) and TelePresence Server before 2.3(1.55) does not properly validate H.264 data which allows remote attackers to cause a denial of service (device reload) via crafted RTP packets in a (1) SIP session or (2) H.323 session aka Bug IDs CSCuc11328 and CSCub05448.


Xen 4.0.x and 4.1.x incorrectly releases a grant reference when releasing a non-v1 non-transitive grant which allows local guest administrators to cause a denial of service (host crash) obtain sensitive information or possibly have other impacts via unspecified vectors.


Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure.


Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allow remote attackers to cause a denial of service (application crash) via a crafted WAV file that is not properly handled by the nsCString::CharAt function.


Cisco TelePresence Supervisor MSE 8050 before 2.3(1.31) allows remote attackers to cause a denial of service (CPU consumption or device reload) by establishing TCP connections at a high rate aka Bug IDs CSCuf76076 and CSCuf79763.


The NAT process on Cisco Adaptive Security Appliances (ASA) devices allows remote attackers to cause a denial of service (connections-table memory consumption) via crafted packets aka Bug ID CSCue46386.


channel.c in ngIRCd 20 and 20.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a KICK command for a user who is not on the associated channel.


HTTP.sys in Microsoft Windows 8 Windows Server 2012 and Windows RT allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP header aka \HTTP.sys Denial of Service Vulnerability.\


The Smart Install client functionality in Cisco IOS 12.2 and 15.0 through 15.3 on Catalyst switches allows remote attackers to cause a denial of service (device reload) via crafted image list parameters in Smart Install packets aka Bug ID CSCub55790.


Cisco ASA CX Context-Aware Security Software allows remote attackers to cause a denial of service (device reload) via crafted TCP packets that appear to have been forwarded by a Cisco Adaptive Security Appliances (ASA) device aka Bug ID CSCue88386.


The dissect_oampdu_event_notification function in epan/dissectors/packet-slowprotocols.c in the IEEE 802.3 Slow Protocols dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle certain short lengths which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document aka an XML Entity Expansion (XEE) attack.


Mantis Bug Tracker (aka MantisBT) 1.2.12 before 1.2.15 allows remote attackers to cause a denial of service (resource consumption) via a filter using a criteria text search and the \any condition\ match type.


The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.


The Ethernet frame-forwarding implementation in Cisco NX-OS on Nexus 7000 devices allows remote attackers to cause a denial of service (forwarding loop and service outage) via a crafted frame aka Bug ID CSCug47098.


The XML libraries for Python 3.4 3.3 3.2 3.1 2.7 and 2.6 as used in OpenStack Keystone Essex Folsom and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.


The dissect_version_4_primary_header function in epan/dissectors/packet-dtn.c in the DTN dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 accesses an inappropriate pointer which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


The generic input/output control implementation in Cisco IOS does not properly manage buffers which allows remote authenticated users to cause a denial of service (device reload) by sending many SNMP requests at the same time aka Bug ID CSCub41105.


The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a \ \ character in an Accept-Language header.


The dissect_sdp_media_attribute function in epan/dissectors/packet-sdp.c in the SDP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly process crypto-suite parameters which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


The Location Bandwidth Manager (LBM) Intracluster-communication feature in Cisco Unified Communications Manager (CUCM) 9.x before 9.1(1) does not require authentication from the remote LBM Hub node which allows remote attackers to conduct cache-poisoning attacks against transaction records and cause a denial of service (bandwidth-pool consumption and call outage) via unspecified vectors aka Bug ID CSCub28920.


The dissect_rohc_ir_packet function in epan/dissectors/packet-rohc.c in the ROHC dissector in Wireshark 1.8.x before 1.8.5 does not properly handle unknown profiles which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


Cisco NX-OS on the Nexus 1000V does not assign the proper priority to heartbeat messages from a Virtual Ethernet Module (VEM) to a Virtual Supervisor Module (VSM) which allows remote attackers to cause a denial of service (false VEM unavailability report) via a flood of UDP packets aka Bug ID CSCud14840.


econvert in ExactImage 0.8.9 and earlier does not properly initialize the setjmp variable which allows context-dependent users to cause a denial of service (crash) via a crafted image file.


Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash) related to event handling with frames.


Cisco IOS XE 3.2 through 3.4 before 3.4.2S and 3.5 on 1000 series Aggregation Services Routers (ASR) when bridge domain interface (BDI) is enabled allows remote attackers to cause a denial of service (card reload) via packets that are not properly handled during the processing of encapsulation aka Bug ID CSCtt11558.


Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline character in a file name.


Cisco NX-OS on the Nexus 7000 when a certain Overlay Transport Virtualization (OTV) configuration is used allows remote attackers to cause a denial of service (M1-Series module reload) via crafted packets aka Bug ID CSCud15673.


A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly implement the PV EOI feature which allows guest OS users to cause a denial of service (host OS crash) by leveraging a time window during which interrupts are disabled but copy_to_user function calls are possible.


The SNMP module in Cisco IOS XR allows remote authenticated users to cause a denial of service (process restart) via crafted SNMP packets aka Bug ID CSCue69472.


The NativeKey widget in Mozilla Firefox before 24.0 Thunderbird before 24.0 and SeaMonkey before 2.21 processes key messages after destruction by a dispatched event listener which allows remote attackers to cause a denial of service (application crash) by leveraging incorrect event usage after widget-memory reallocation.


The dissect_pw_eth_heuristic function in epan/dissectors/packet-pw-eth.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle apparent Ethernet address values at the beginning of MPLS data which allows remote attackers to cause a denial of service (loop) via a malformed packet.


Certain page table manipulation operations in Xen 4.1.x 4.2.x and earlier are not preemptible which allows local PV kernels to cause a denial of service via vectors related to \deep page table traversal.\


Array index error in the SSL module in PolarSSL before 1.2.5 might allow remote attackers to cause a denial of service via vectors involving a crafted padding-length value during validation of CBC padding in a TLS session a different vulnerability than CVE-2013-0169.


SensorApp in Cisco Intrusion Prevention System (IPS) allows local users to cause a denial of service (Regex hardware job failure and application hang) via a (1) initiate signature upgrade (2) initiate global correlation (3) show statistics anomaly-detection or (4) clear database action aka Bug ID CSCuc74630.


The management API in the XML API management service in the Manager component in Cisco Unified Computing System (UCS) 1.x before 1.2(1b) allows remote attackers to cause a denial of service (service outage) via a malformed request aka Bug ID CSCtg48206.


The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of requests \to list all volumes for the particular pool.\


The Portable Tool Library (aka PTLib) before 2.10.10 as used in Ekiga before 4.0.1 does not properly detect recursion during entity expansion which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references aka a \billion laughs attack.\


Integer signedness error in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to cause a denial of service (incorrect memory copy) via a SOAPAction header that lacks a \ (double quote) character a different vulnerability than CVE-2013-0230.


Cisco Unified Communications Domain Manager allows remote attackers to cause a denial of service (CPU consumption) via a flood of malformed UDP packets aka Bug ID CSCug47057.


X.org X server 1.13.3 and earlier when not run as root allows local users to cause a denial of service (crash) or possibly gain privileges via vectors involving cached xkb files.


The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.


The C-Series Rack Server component 1.4 in Cisco Unified Computing System (UCS) does not properly restrict inbound access to ports which allows remote attackers to cause a denial of service (Integrated Management Controller reboot or hang) via crafted packets as demonstrated by nmap aka Bug ID CSCtx19850.


Cisco TelePresence System Software does not properly handle inactive t-shell sessions which allows remote authenticated users to cause a denial of service (memory consumption and service outage) by establishing multiple SSH connections aka Bug ID CSCug77610.


The General Responder implementation in the IP Service Level Agreement (SLA) feature in Cisco IOS 15.2 and IOS XE 3.1.xS through 3.4.xS before 3.4.5S and 3.5.xS through 3.7.xS before 3.7.2S allows remote attackers to cause a denial of service (device reload) via crafted (1) IPv4 or (2) IPv6 IP SLA packets on UDP port 1167 aka Bug ID CSCuc72594.


The XML parser in the Cisco Jabber IM application for Android allows remote authenticated users to cause a denial of service (blocked connection) by leveraging an entry on a Buddy list and sending a crafted XMPP presence update message aka Bug ID CSCue38383.


The authentication-proxy implementation on Cisco Adaptive Security Appliances (ASA) devices with software 7.x before 7.2(5.10) 8.0 before 8.0(5.31) 8.1 and 8.2 before 8.2(5.38) 8.3 before 8.3(2.37) 8.4 before 8.4(5.3) 8.5 and 8.6 before 8.6(1.10) 8.7 before 8.7(1.4) 9.0 before 9.0(1.1) and 9.1 before 9.1(1.2) allows remote attackers to cause a denial of service (device reload) via a crafted URL aka Bug ID CSCud16590.


The dissect_pft_fec_detailed function in epan/dissectors/packet-dcp-etsi.c in the DCP-ETSI dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle fragment gaps which allows remote attackers to cause a denial of service (loop) via a malformed packet.


The dissect_bthci_eir_ad_data function in epan/dissectors/packet-bthci_cmd.c in the Bluetooth HCI dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 uses an incorrect data type for a counter variable which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


The crypto engine process in Cisco IOS on Aggregation Services Router (ASR) Route Processor 2 does not properly manage memory which allows local users to cause a denial of service (route processor crash) by creating multiple tunnels and then examining encryption statistics aka Bug ID CSCuc52193.


MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.


The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8 1.5.x before 1.5.4 and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.


The Cisco Small Business 200 Series Smart Switch 1.2.7.76 and earlier Small Business 300 Series Managed Switch 1.2.7.76 and earlier and Small Business 500 Series Stackable Managed Switch 1.2.7.76 and earlier allow remote attackers to cause a denial of service (SSL/TLS layer outage) via malformed (1) SSH or (2) SSL packets aka Bug ID CSCua30246.


epan/tvbuff.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly validate certain length values for the MS-MMC dissector which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


The CallServer component in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to cause a denial of service (call-acceptance outage) via malformed SIP INVITE messages aka Bug ID CSCua65148.


The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.


The LDAP service in Microsoft Active Directory Active Directory Application Mode (ADAM) Active Directory Lightweight Directory Service (AD LDS) and Active Directory Services allows remote attackers to cause a denial of service (memory consumption and service outage) via a crafted query aka \Memory Consumption Vulnerability.\


Cisco IOS XE 2.x and 3.x before 3.4.5S and 3.5 through 3.7 before 3.7.1S on 1000 series Aggregation Services Routers (ASR) allows remote attackers to cause a denial of service (card reload) by sending many crafted L2TP packets aka Bug ID CSCtz23293.


Cisco Unified Communications Manager (CUCM) 8.6 before 8.6(2a)su2 8.6 BE3k before 8.6(4) BE3k and 9.x before 9.0(1) allows remote attackers to cause a denial of service (CPU consumption and GUI and voice outages) via malformed packets to unused UDP ports aka Bug ID CSCtx43337.


A denial of service vulnerability exists in some motherboard implementations of Intel e1000e/82574L network controller devices through 2013-02-06 where the device can be brought into a non-processing state when parsing 32 hex 33 hex or 34 hex byte values at the 0x47f offset. NOTE: A followup statement from Intel suggests that the root cause of this issue was an incorrectly configured EEPROM image.


The RESTful Web Services (RESTWS) module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.0-alpha5 for Drupal when page caching is enabled and anonymous users are assigned RESTWS permissions allows remote attackers to cause a denial of service via a GET request with an HTTP Accept header set to a non-HTML type which can \interfere with Drupal's page cache.\


Cisco Adaptive Security Appliances (ASA) devices with software 7.x before 7.2(5.10) 8.0 before 8.0(5.28) 8.1 and 8.2 before 8.2(5.35) 8.3 before 8.3(2.34) 8.4 before 8.4(4.11) 8.6 before 8.6(1.10) and 8.7 before 8.7(1.3) and Cisco Firewall Services Module (FWSM) software 3.1 and 3.2 before 3.2(24.1) and 4.0 and 4.1 before 4.1(11.1) allow remote attackers to cause a denial of service (device reload) via a crafted IKEv1 message aka Bug IDs CSCub85692 and CSCud20267.


The Wireless Intrusion Prevention System (wIPS) component on Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.0 7.1 and 7.2 before 7.2.110.0 and 7.3 before 7.3.101.0 allows remote attackers to cause a denial of service (device reload) via crafted IP packets aka Bug ID CSCtx80743.


Cisco Universal Broadband (aka uBR) 10000 series routers when an IPv4/IPv6 dual-stack modem is used allow remote attackers to cause a denial of service (routing-engine reload) via unspecified changes to IP address assignments aka Bug ID CSCue15313.


Cisco Adaptive Security Appliances (ASA) devices with software 7.x before 7.2(5.10) 8.0 before 8.0(5.31) 8.1 and 8.2 before 8.2(5.38) 8.3 before 8.3(2.37) 8.4 before 8.4(5) 8.5 before 8.5(1.17) 8.6 before 8.6(1.10) and 8.7 before 8.7(1.3) allow remote attackers to cause a denial of service (device reload) via a crafted certificate aka Bug ID CSCuc72408.


ModSecurity before 2.7.3 allows remote attackers to read arbitrary files send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference aka an XML External Entity (XXE) vulnerability.


The dissect_cmstatus_tlv function in plugins/docsis/packet-cmstatus.c in the DOCSIS CM-STATUS dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 uses an incorrect data type for a position variable which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.


The IP stack in Cisco Intrusion Prevention System (IPS) Software in ASA 5500-X IPS-SSP software and hardware modules before 7.1(5)E4 IPS 4500 sensors before 7.1(6)E4 and IPS 4300 sensors before 7.1(5)E4 allows remote attackers to cause a denial of service (MainApp process hang) via malformed IPv4 packets aka Bug ID CSCtx18596.


The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit which triggers an access of an uninitialized variable.


The dissect_r3_cmd_alarmconfigure function in epan/dissectors/packet-assa_r3.c in the R3 dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle a certain alarm length which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


Cisco Unified Presence Server (CUPS) 8.6 9.0 and 9.1 before 9.1.1 allows remote attackers to cause a denial of service (CPU consumption) via crafted packets to the SIP TCP port aka Bug ID CSCua89930.


The auth-proxy functionality in Cisco Firewall Services Module (FWSM) software 3.1 and 3.2 before 3.2(20.1) 4.0 before 4.0(15.2) and 4.1 before 4.1(5.1) allows remote attackers to cause a denial of service (device reload) via a crafted URL aka Bug ID CSCtg02624.


The dissect_version_5_and_6_primary_header function in epan/dissectors/packet-dtn.c in the DTN dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 accesses an inappropriate pointer which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


Array index error in the Virtual Ethernet Module (VEM) kernel driver for VMware ESXi in Cisco NX-OS on the Nexus 1000V when STUN debugging is enabled allows remote attackers to cause a denial of service (ESXi crash and purple screen of death) by sending crafted STUN packets to a VEM aka Bug ID CSCud14825.


Cisco IOS XE 3.4 before 3.4.4S 3.5 and 3.6 on 1000 series Aggregation Services Routers (ASR) does not properly implement the Cisco Multicast Leaf Recycle Elimination (MLRE) feature which allows remote attackers to cause a denial of service (card reload) via fragmented IPv6 multicast packets aka Bug ID CSCtz97563.


Cisco NX-OS on Nexus 5500 devices 4.x and 5.x before 5.0(3)N2(2) Nexus 3000 devices 5.x before 5.0(3)U3(2) and Unified Computing System (UCS) 6200 devices before 2.0(1w) allows remote attackers to cause a denial of service (device reload) by sending a jumbo packet to the management interface aka Bug IDs CSCtx17544 CSCts10593 and CSCtx95389.


The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.


Cisco Carrier Routing System (CRS) allows remote attackers to cause a denial of service (packet loss) via short malformed packets that trigger inefficient processing aka Bug ID CSCud79136.


The Cisco Prime Network Control System (NCS) appliance with software before 1.1.1.24 has a default password for the database user account which makes it easier for remote attackers to change the configuration or cause a denial of service (service disruption) via unspecified vectors aka Bug ID CSCtz30468.


Cisco Wireless LAN Controller (WLC) devices do not properly address the resource consumption of terminated TELNET sessions which allows remote attackers to cause a denial of service (TELNET outage) by making many TELNET connections and improperly ending these connections aka Bug ID CSCug35507.


The mDNS snooping functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.4.1.54 and earlier does not properly manage buffers which allows remote authenticated users to cause a denial of service (device reload) via crafted mDNS packets aka Bug ID CSCue04153.


The rtps_util_add_bitmap function in epan/dissectors/packet-rtps.c in the RTPS dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly implement certain nested loops for processing bitmap data which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


MariaDB 5.5.x before 5.5.30 5.3.x before 5.3.13 5.2.x before 5.2.15 and 5.1.x before 5.1.68 and Oracle MySQL 5.1.69 and earlier 5.5.31 and earlier and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points which is not properly handled when processing the binary representation of this feature related to a numeric calculation error.


Xen 4.x when using Intel VT-d for a bus mastering capable PCI device does not properly check the source when accessing a bridge device's interrupt remapping table entries for MSI interrupts which allows local guest domains to cause a denial of service (interrupt injection) via unspecified vectors.


Xen 4.2.x and 4.1.x does not properly restrict access to IRQs which allows local stub domain clients to gain access to IRQs and cause a denial of service via vectors related to \passed-through IRQs or PCI devices.\