The KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a denial of service (assertion failure and hypervisor hang or crash) via an out-of bounds guest_irq value related to arch/x86/kvm/vmx.c and virt/kvm/eventfd.c.


The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping.


The unpack_parse_unit function in libavcodec/dirac_parser.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation fault) via a crafted file.


In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25 there is a use-after-free in ReadOneMNGImage in coders/png.c which allows attackers to cause a denial of service via a crafted MNG image file that is mishandled in an MngInfoDiscardObject call.


Certain

NETGEAR

devices

are

affected

by

denial

of

service.

This

affects

before

before

before

before

before

before

and

before


The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls.


An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume an attacker may access the underlying raw volume and corrupt the LUKS header resulting in a denial of service attack on the compute host. (The same code error also results in data loss but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected.


PostGIS 2.x before 2.3.3 as used with PostgreSQL allows remote attackers to cause a denial of service via crafted ST_AsX3D function input as demonstrated by an abnormal server termination for \SELECT ST_AsX3D('LINESTRING EMPTY');\ because empty geometries are mishandled.


Certain

NETGEAR

devices

are

affected

by

denial

of

service.

This

affects

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered in Mattermost Server before 4.5.0 4.4.5 4.3.4 and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.


The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string a different vulnerability than CVE-2016-4055.


In

in

the

Linux

kernel

before

local

users

can

cause

a

denial

of

service

(use-after-free

and

BUG)

or

possibly

have

unspecified

other

impact

by

leveraging

differences

in

skb

handling

between

and


An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c which allows attackers to cause a denial of service via a crafted file because file size is not properly used to restrict scanline strip and tile allocations.


nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails as demonstrated by a leading \\n character to ssh-brute.nse or ssh-auth-methods.nse.


The f2fs implementation in the Linux kernel before 4.14 mishandles reference counts associated with f2fs_wait_discard_bios calls which allows local users to cause a denial of service (BUG) as demonstrated by fstrim.


Certain

NETGEAR

devices

are

affected

by

denial

of

service.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An

issue

was

discovered

in

Exempi

before

The

VPXChunk

class

in

does

not

ensure

nonzero

widths

and

heights

which

allows

remote

attackers

to

cause

a

denial

of

service

(assertion

failure

and

application

exit)

via

a

crafted

.webp

file.


In change_port_settings in drivers/usb/serial/io_ti.c in the Linux kernel before 4.11.3 local users could cause a denial of service by division-by-zero in the serial device layer by trying to set very high baud rates.


The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to cause a denial of service (deadlock) via DIO requests.


An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadOnePNGImage in coders/png.c which allows attackers to cause a denial of service via a crafted file that triggers an attempt at a large png_pixels array allocation.


An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via a crafted file.


The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file as demonstrated by pdftops.


Brave Browser before 0.13.0 allows remote attackers to cause a denial of service (resource consumption) via a long alert() argument in JavaScript code because window dialogs are mishandled.


An

issue

was

discovered

in

Exempi

before

It

allows

remote

attackers

to

cause

a

denial

of

service

(invalid

memcpy

with

resultant

use-after-free)

or

possibly

have

unspecified

other

impact

via

a

.pdf

file

containing

JPEG

data

related

to

and


In Pylons Colander through 1.6 the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.


An

issue

was

discovered

in

Exempi

before

The

function

in

allows

remote

attackers

to

cause

a

denial

of

service

(infinite

loop)

via

crafted

XMP

data

in

a

.qt

file.


In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22 an infinite loop vulnerability was found in the function ReadTXTImage in coders/txt.c which allows attackers to cause a denial of service (CPU exhaustion) via a crafted image file that is mishandled in a GetImageIndexInList call.


The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related to negative pitch.


The ReadOneJNGImage and ReadJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 allow remote attackers to cause a denial of service (magick/blob.c CloseBlob use-after-free) or possibly have unspecified other impact via a crafted file a related issue to CVE-2017-11403.


The arch_timer_reg_read_stable macro in arch/arm64/include/asm/arch_timer.h in the Linux kernel before 4.13 allows local users to cause a denial of service (infinite recursion) by writing to a file under /sys/kernel/debug in certain circumstances as demonstrated by a scenario involving debugfs ftrace PREEMPT_TRACER and FUNCTION_GRAPH_TRACER.


NETGEAR WNDR4500v3 devices before 1.0.0.48 are affected by denial of service.


The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex within libsas which allows local users to cause a denial of service (deadlock) by triggering certain error-handling code.


Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash) related to an incompatibility with certain versions of the LuaSocket library such as the lua-socket package from Debian stretch. The attacker needs to trigger a stream error. A crash can be observed in for example the c2s module.


An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c which allow remote attackers to cause a denial of service via a crafted file.


crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances allowing a local user able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have unspecified other impact by executing a crafted sequence of system calls.


An

issue

was

discovered

in

Exempi

before

The

function

in

allows

remote

attackers

to

cause

a

denial

of

service

(infinite

loop)

via

a

crafted

.asf

file.


** DISPUTED ** The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications \need to be prepared to handle a wide variety of exceptions.\


In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22 an infinite loop vulnerability was found in the function ReadMIFFImage in coders/miff.c which allows attackers to cause a denial of service (CPU exhaustion) via a crafted MIFF image file.


The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file because the decoder functionality does not restrict memory usage to what is required for a legitimate file.


An

memmove

implementation

for

in

sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S

in

the

GNU

C

Library

(aka

glibc

or

through

does

not

correctly

perform

the

overlapping

memory

check

if

the

source

memory

range

spans

the

middle

of

the

address

space

resulting

in

corrupt

data

being

produced

by

the

copy

operation.

This

may

disclose

information

to

context-dependent

attackers

or

result

in

a

denial

of

service

or

possibly

code

execution.


fs/f2fs/extent_cache.c in the Linux kernel before 4.13 mishandles extent trees which allows local users to cause a denial of service (BUG) via an application with multiple threads.


An issue was discovered in Mattermost Server before 4.3.0 4.2.1 and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post.


An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c which allow remote attackers to cause a denial of service via a crafted file.


The __oom_reap_task_mm function in mm/oom_kill.c in the Linux kernel before 4.14.4 mishandles gather operations which allows attackers to cause a denial of service (TLB entry leak or use-after-free) or possibly have unspecified other impact by triggering a copy_to_user call within a certain time window.


An

issue

was

discovered

in

Exempi

before

The

function

in

allows

remote

attackers

to

cause

a

denial

of

service

(invalid

pointer

dereference

and

application

crash)

via

a

crafted

.ps

file.


** UNSUPPORTED WHEN ASSIGNED ** A vulnerability which was classified as problematic was found in WEKA INTEREST Security Scanner up to 1.8. This affects an unknown part of the component LAN Viewer. The manipulation with an unknown input leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in WEKA INTEREST Security Scanner 1.8. It has been rated as problematic. This issue affects some unknown processing of the component HTTP Handler. The manipulation with an unknown input leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


** UNSUPPORTED WHEN ASSIGNED ** A vulnerability which was classified as problematic has been found in WEKA INTEREST Security Scanner up to 1.8. Affected by this issue is some unknown functionality of the component Webspider. The manipulation with an unknown input leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in WEKA INTEREST Security Scanner up to 1.8 and classified as problematic. This vulnerability affects unknown code of the component Portscan. The manipulation with an unknown input leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in WEKA INTEREST Security Scanner up to 1.8. Affected is Stresstest Scheme Handler which leads to a denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in WEKA INTEREST Security Scanner up to 1.8. Affected by this vulnerability is the Stresstest Configuration Handler. A manipulation leads to a local denial of service. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


IrfanView

version

with

FPX

Plugin

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77df0000!RtlpFreeHeap+0x0000000000000393.\


Denial of Service was found in Horde_Image 2.x before 2.5.0 via a crafted URL to the \Null\ image driver.


plugins\\codec\\libflac_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted FLAC file.


smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.


The NFSv4 implementation in the Linux kernel through 4.11.1 allows local users to cause a denial of service (resource consumption) by leveraging improper channel callback shutdown when unmounting an NFSv4 filesystem aka a \module reference and kernel daemon\ leak.


The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled which allows remote attackers to cause a denial of service (infinite loop) via a crafted certificate.


LibTIFF 4.0.7 has an invalid read in the _TIFFVGetField function in tif_dir.c which might allow remote attackers to cause a denial of service (crash) via a crafted TIFF file.


imagew-cmd.c:854:45 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted image related to imagew-api.c.


A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service or achieve code execution by crafting a malicious APKINDEX.tar.gz file with a bad pax header block.


libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.


A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service or achieve code execution by crafting a malicious APKINDEX.tar.gz file.


IrfanView

version

with

TOOLS

Plugin

might

allow

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

file

related

to

\Data

from

Faulting

Address

is

used

as

one

or

more

arguments

in

a

subsequent

Function

Call

starting

at

ntdll_77df0000!RtlFreeHandle+0x0000000000000218.\


The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted DEX file.


In

SWFTools

on

Windows

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

file

related

to

a

\Read

Access

Violation

starting

at


The wav_open_read function in frontend/input.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to cause a denial of service (large loop) via a crafted wav file.


The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value aka a \double fetch\ vulnerability.


The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of service (permanent display of a \Cannot exit above the top directory\ error message throughout the entire web application) via a \..\ in the path field. In other words the denial of service is caused by an incorrect implementation of a directory-traversal protection mechanism.


The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before 2013-11-12 as used in shlr/grub/fs/ext2.c in radare2 1.5.0 allows remote attackers to cause a denial of service (excessive stack use and application crash) via a crafted binary file related to use of a variable-size stack array.


QEMU (aka Quick Emulator) when built with the e1000e NIC emulation support allows local guest OS privileged users to cause a denial of service (infinite loop) via vectors related to setting the initial receive / transmit descriptor head (TDH/RDH) outside the allocated descriptor buffer.


In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption).


The TDStretch::acceptNewOverlapLength function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (memory allocation error and application crash) via a crafted wav file.


The qemu-nbd server in QEMU (aka Quick Emulator) when built with the Network Block Device (NBD) Server support allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all initialization occurs before talking to a client in the nbd_negotiate function.


XnView

Classic

for

Windows

Version

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77df0000!TpAllocCleanupGroup+0x00000000000003d7.\


The _dwarf_decode_s_leb128_chk function in dwarf_leb.c in libdwarf through 2017-06-28 allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.


admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service (inability to save revisions) via XSS sequences in a revision name.


In LibTIFF 4.0.7 the TIFFReadDirEntryLong8Array function in libtiff/tif_dirread.c mishandles a malloc operation which allows attackers to cause a denial of service (memory leak within the function _TIFFmalloc in tif_unix.c) via a crafted file.


XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18 7.0.x before 7.0.17 7.1.x before 7.1.12 and 8.0.x before 8.0.3 allows remote attackers to obtain sensitive information cause a denial of service or conduct server-side request forgery (SSRF) attacks via unspecified vectors.


IrfanView

version

with

FPX

Plugin

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77df0000!RtlpLowFragHeapFree+0x000000000000001f.\


The lzw_add_to_dict function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted image.


Memory leak in QEMU (aka Quick Emulator) when built with IDE AHCI Emulation support allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the AHCI device.


systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section.


The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and application crash) or possibly have unspecified other impact by triggering crafted operations on array data structures.


IrfanView

version

with

TOOLS

Plugin

might

allow

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77df0000!RtlFreeHandle+0x00000000000001b6.\


In

SWFTools

on

Windows

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

file

related

to

a

\Read

Access

Violation

starting

at


SAP NetWeaver AS ABAP 7.40 allows remote authenticated users with certain privileges to cause a denial of service (process crash) via vectors involving disp+work.exe aka SAP Security Note 2406841.


The snd_msndmidi_input_read function in sound/isa/msnd/msnd_midi.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value aka a \double fetch\ vulnerability.


The cmd_info function in libr/core/cmd_info.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted binary file.


The faacEncOpen function in libfaac/frame.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.


When an Apache Geode cluster before v1.2.1 is operating in secure mode an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition an attacker could perform a denial of service attack on the cluster.


The mp4ff_parse_tag function in common/mp4ff/mp4meta.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.


The TDStretch::processSamples function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted wav file.


XnView

Classic

for

Windows

Version

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77df0000!RtlpFreeHeap+0x0000000000000393.\


In Wireshark 2.2.7 PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function in plugins/profinet/packet-dcerpc-pn-io.c.


The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file.


IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file related to \Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at FPX+0x000000000000688d.\


XnView

Classic

for

Windows

Version

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

is

used

as

one

or

more

arguments

in

a

subsequent

Function

Call

starting

at

Xfpx!gffGetFormatInfo+0x0000000000028508.\


QEMU (aka Quick Emulator) before 2.9.0 when built with the USB OHCI Emulation support allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value a different vulnerability than CVE-2017-6505.


An Uncontrolled Resource Consumption issue was discovered in Schneider Electric Wonderware ArchestrA Logger versions 2017.426.2307.1 and prior. The uncontrolled resource consumption vulnerability could allow an attacker to exhaust the memory resources of the machine causing a denial of service.


The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls a related issue to CVE-2017-8890.


The print_symbol_for_build_attribute function in readelf.c in GNU Binutils 2017-04-12 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted ELF file.


in

VideoLAN

VLC

media

player

allows

remote

attackers

to

cause

a

denial

of

service

(invalid

read

and

application

crash)

or

possibly

have

unspecified

other

impact

via

a

crafted

file.


The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec which allows remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.


The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via a crafted document.


An incorrect \pair?\ check in the Scheme \length\ procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to 4.13 which allows an attacker to cause a denial of service by passing an improper list to an application that calls \length\ on it.


disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request aka SAP Security Note 2405918.


XnView

Classic

for

Windows

Version

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

an

\Error

Code

starting

at

wow64!Wow64NotifyDebugger+0x000000000000001d.\


The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file.


QEMU (aka Quick Emulator) when built with USB xHCI controller emulator support allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing.


IrfanView

version

with

FPX

Plugin

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

is

used

as

one

or

more

arguments

in

a

subsequent

Function

Call

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x0000000000006a98.\


libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document related to QPDFObjectHandle::parseInternal aka qpdf-infiniteloop2.


The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur which allows local users to cause a denial of service (system crash) via crafted system calls.


An issue was discovered in adns before 1.5.2. It overruns reading a buffer if a domain ends with backslash. If the query domain ended with \\ and adns_qf_quoteok_query was specified qdparselabel would read additional bytes from the buffer and try to treat them as the escape sequence. It would depart the input buffer and start processing many bytes of arbitrary heap data as if it were the query domain. Eventually it would run out of input or find some other kind of error and declare the query domain invalid. But before then it might outrun available memory and crash. In principle this could be a denial of service attack.


The iw_get_ui16be function in imagew-util.c:422:24 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted image related to imagew-jpeg.c.


IrfanView

version

with

FPX

Plugin

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

a

\Read

Access

Violation

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x0000000000003714.\


XnView

Classic

for

Windows

Version

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77df0000!RtlpLowFragHeapFree+0x000000000000001f.\


The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls a related issue to CVE-2017-8890.


IrfanView

version

with

FPX

Plugin

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

is

used

as

one

or

more

arguments

in

a

subsequent

Function

Call

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x0000000000007053.\


The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted jpg file.


The quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.


imagew-cmd.c:850:46 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted image related to imagew-api.c.


IrfanView

version

with

FPX

Plugin

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

FPX!FPX_GetScanDevicePropertyGroup+0x00000000000031a0.\


The iw_get_ui16le function in imagew-util.c:405:23 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted image related to imagew-jpeg.c.


XnView

Classic

for

Windows

Version

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

Xfpx!gffGetFormatInfo+0x00000000000228e8.\


The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls a related issue to CVE-2017-8890.


The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.


GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers related to the get_program_headers function in readelf.c.


The read_packet function in knc (Kerberised NetCat) before 1.11-1 is vulnerable to denial of service (memory exhaustion) that can be exploited remotely without authentication possibly affecting another services running on the targeted host.


The intr function in sound/oss/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value aka a \double fetch\ vulnerability.


When handling a libprocess message wrapped in an HTTP request libprocess in Apache Mesos before 1.1.3 1.2.x before 1.2.2 1.3.x before 1.3.1 and 1.4.0-dev crashes if the request path is empty because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.


Mitsubishi E-Designer Version 7.52 Build 344 contains two code sections which may be exploited to allow an attacker to overwrite arbitrary memory locations. This can result in arbitrary code execution compromised data integrity denial of service and system crash.


In Apache httpd before 2.2.34 and 2.4.x before 2.4.27 the value placeholder in Proxy-Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request leading to leakage of potentially confidential information and a segfault in other cases resulting in denial of service.


Improperly implemented option-field processing in the TCP/IP stack on Allen-Bradley L30ERMS safety devices v30 and earlier causes a denial of service. When a crafted TCP packet is received the device reboots immediately.


TeamSpeak Client 3.0.19 allows remote attackers to cause a denial of service (application crash) via the ᗪ Unicode character followed by the ༿ Unicode character.


The xps_true_callback_glyph_name function in xps/xpsttf.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (Segmentation Violation and application crash) via a crafted file.


libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function a different vulnerability than CVE-2017-9304.


XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file related to \Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at Xfpx+0x0000000000010e81.\


The my_skip_input_data_fn function in imagew-jpeg.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted image.


Memory leak in QEMU (aka Quick Emulator) when built with USB EHCI Emulation support allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device.


libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document related to unparse functions aka qpdf-infiniteloop3.


The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to a denial of service attack.


libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document related to releaseResolved functions aka qpdf-infiniteloop1.


IrfanView

version

with

FPX

Plugin

allows

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77df0000!RtlpCoalesceFreeBlocks+0x00000000000001b6.\


XnView

Classic

for

Windows

Version

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

.fpx

file

related

to

\Data

from

Faulting

Address

controls

Branch

Selection

starting

at

ntdll_77df0000!RtlAddAccessAllowedAce+0x000000000000027a.\


The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value aka a \double fetch\ vulnerability.


Windows Subsystem for Linux in Windows 10 1703 allows a denial of service vulnerability due to the way it handles objects in memory aka \Windows Subsystem for Linux Denial of Service Vulnerability\.


An integer underflow vulnerability exists in pixel-a.asm the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.4 as used by the x265_encoder_encode dependency in libbpg and other products. A small picture can cause an integer underflow which leads to a Denial of Service in the process of encoding.


curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact because too little memory is allocated for interfacing to an SSL library.


** DISPUTED ** The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization which allows remote attackers to cause a denial of service (virtual memory allocation or memory consumption if an overcommit setting is not used) via a crafted UDP packet to port 111 a related issue to CVE-2017-8779. NOTE: Information provided from upstream and references


drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 uses a spinlock without considering that sleeping is possible in a USB HID request callback which allows local users to cause a denial of service (deadlock) via unspecified vectors.


Windows Hyper-V in Windows 10 1607 1703 and Windows Server 2016 allows a denial of service vulnerability when it fails to properly validate input from a privileged user on a guest operating system aka \Windows Hyper-V Denial of Service Vulnerability\.


Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file allowing a local user to cause a denial of service (menu unavailability).


The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 Microsoft Exchange Server 2013 and 2016 does not properly scan a specially crafted file leading to denial of service. aka \Microsoft Malware Protection Engine Denial of Service Vulnerability\ a different vulnerability than CVE-2017-8536 CVE-2017-8537 CVE-2017-8539 and CVE-2017-8542.


The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 Microsoft Exchange Server 2013 and 2016 does not properly scan a specially crafted file leading to denial of service. aka \Microsoft Malware Protection Engine Denial of Service Vulnerability\ a different vulnerability than CVE-2017-8535 CVE-2017-8536 CVE-2017-8537 and CVE-2017-8542.


In Tor before 0.2.5.16 0.2.6 through 0.2.8 before 0.2.8.17 0.2.9 before 0.2.9.14 0.3.0 before 0.3.0.13 and 0.3.1 before 0.3.1.9 an attacker can cause a denial of service (application hang) via crafted PEM input that signifies a public key requiring a password which triggers an attempt by the OpenSSL library to ask the user for the password aka TROVE-2017-011.


The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted PDF document.


The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.


The Windows Hyper-V component on Microsoft Windows 10 1607 and Windows Server 2016 allows a denial of service vulnerability when it fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Denial of Service Vulnerability\.


Windows Explorer in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 allows a denial of service vulnerability when it attempts to open a non-existent file aka \Windows Explorer Denial of Service Vulnerability\.


The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 Microsoft Exchange Server 2013 and 2016 does not properly scan a specially crafted file leading to denial of service. aka \Microsoft Malware Protection Engine Denial of Service Vulnerability\ a different vulnerability than CVE-2017-8535 CVE-2017-8536 CVE-2017-8537 and CVE-2017-8539.


Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process (causing a denial of service) via a crafted subtitles file.


The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b if NDEBUG is omitted allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file.


PSKMAD.sys in Panda Free Antivirus 18.0 allows local users to cause a denial of service (BSoD) via a crafted DeviceIoControl request to \\\\.\\PSMEMDriver.


The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted archive.


The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state.


The read_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted archive.


Microsoft Windows 10 1511 1607 and 1703 and Windows Server 2016 allow an unauthenticated attacker to send a specially crafted kernel mode request to cause a denial of service on the target system aka \Windows VAD Cloning Denial of Service Vulnerability\.


In ImageMagick 7.0.5-6 the ReadBMPImage function in bmp.c:1379 allows attackers to cause a denial of service (memory leak) via a crafted file.


A userspace process can cause a Denial of Service in the camera driver in all Qualcomm products with Android releases from CAF using the Linux kernel.


The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file.


The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.


Sublime Text 3 Build 3126 allows user-assisted attackers to cause a denial of service or possibly have unspecified other impact via a crafted .mkv file. One threat model is a victim who obtains an untrusted crafted file from a remote location and issues several user-defined commands as demonstrated by Ctrl-A Delete and Ctrl-Z.


A Remote Denial of Service vulnerability in Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance version v1.20 was found.


The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file.


sinopia as used in SAP HANA XS 1.00 and 2.00 allows remote attackers to cause a denial of service (assertion failure and service crash) by pushing a package with a filename containing a $ (dollar sign) or % (percent) character aka SAP Security Note 2407694.


rpcbind through 0.2.4 LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3 and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111 aka rpcbomb.


PoDoFo

allows

denial

of

service

(infinite

recursion

and

stack

consumption)

via

a

crafted

PDF

file

in

PoDoFo::PdfParser::ReadDocumentStructure

(PdfParser.cpp).


The bmpr_read_uncompressed function in imagew-bmp.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted image.


An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6 45.x versions prior to 45.4 52.x versions prior to 52.1). In some cases the UAA allows an authenticated user for a particular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque tokens or JWT tokens validated using the check_token endpoint. A malicious actor could cause denial of service.


The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call.


hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via the message ring page count.


PCManFM 1.2.5 insecurely uses /tmp for a socket file allowing a local user to cause a denial of service (application unavailability).


The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 Microsoft Exchange Server 2013 and 2016 does not properly scan a specially crafted file leading to denial of service. aka \Microsoft Malware Protection Engine Denial of Service Vulnerability\ a different vulnerability than CVE-2017-8535 CVE-2017-8537 CVE-2017-8539 and CVE-2017-8542.


The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule.


The Debian pg_ctlcluster pg_createcluster and pg_upgradecluster scripts as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu) handled symbolic links insecurely which could result in local denial of service by overwriting arbitrary files.


In Avast Antivirus before v17 using the LPC interface API exposed by the AvastSVC.exe Windows service it is possible to launch predefined binaries or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled. It is also exploitable in conjunction with CVE-2017-8308 when Avast Self-Defense is enabled. The vulnerability allows for Denial of Service attacks and hiding traces of a possible attack.


The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 Microsoft Exchange Server 2013 and 2016 does not properly scan a specially crafted file leading to denial of service. aka \Microsoft Malware Protection Engine Denial of Service Vulnerability\ a different vulnerability than CVE-2017-8535 CVE-2017-8536 CVE-2017-8539 and CVE-2017-8542.


has

CSRF

in

Thumbnail

Editor

in

the

File

Manager

which

allows

remote

attackers

to

disable

the

entire

installation

by

merely

tricking

an

admin

into

viewing

a

malicious

page

involving

the

/tools/required/files/importers/imageeditor?fID=1&imgData=

URI.

This

results

in

a

site-wide

denial

of

service

making

the

site

not

accessible

to

any

users

or

any

administrators.


The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling.


A Unauthenticated Remote Denial of Service vulnerability was identified in HPE Integrated Lights-Out 3 (iLO 3) version v1.88 only. The vulnerability is resolved in iLO3 v1.89 or subsequent versions.


An issue was discovered in EMC ScaleIO 2.0.1.x. A vulnerability in message parsers (MDM SDS and LIA) could potentially allow an unauthenticated remote attacker to send specifically crafted packets to stop ScaleIO services and cause a denial of service situation.


drivers/media/usb/dvb-usb/cxusb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact by leveraging use of more than one virtual page for a DMA scatterlist.


forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit which might allow remote attackers to cause a denial of service (login inability) or possibly conduct Arbitrary User Password Reset attacks via a series of requests.


libimageworsener.a in ImageWorsener before 1.3.1 has \left shift cannot be represented in type int\ undefined behavior issues which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image related to imagew-bmp.c and imagew-util.c.


The lzo1x_decompress function in lzo1x_d.ch in LZO 2.08 as used in lrzip 0.631 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted archive.


Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0) 7.3(101.0) and 7.4(1.19) allow remote attackers to cause a denial of service (device outage) by sending malformed 802.11i management data to a managed access point aka Bug ID CSCub65236.


The dissect_zbee_secure function in epan/dissectors/packet-zbee-security.c in the ZigBee dissector in Wireshark 1.12.x before 1.12.7 improperly relies on length fields contained in packet data which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The IP ingress packet handler on Cisco Aironet 1800 devices with software 8.1(112.3) and 8.1(112.4) allows remote attackers to cause a denial of service via a crafted header in an IP packet aka Bug ID CSCuv63138.


Cisco ASR 5000 devices with software 16.0(900) allow remote attackers to cause a denial of service (telnetd process restart) via a TELNET connection aka Bug ID CSCuv25815.


The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.


Cisco Email Security Appliance (ESA) 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service (file-descriptor consumption and device reload) via crafted HTTP requests aka Bug ID CSCuw32211.


Use-after-free

vulnerability

in

in

the

ServiceWorker

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

by

leveraging

object

destruction

in

a

callback.


The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) software 9.0 before 9.0(4.37) 9.1 before 9.1(6.6) 9.2 before 9.2(4) 9.3 before 9.3(3.5) and 9.4 before 9.4(2) allows remote attackers to cause a denial of service (device reload) via crafted DHCPv6 packets aka Bug IDs CSCus56252 and CSCus57142.


The passthrough FTP feature on Cisco Web Security Appliance (WSA) devices with software 8.0.7-142 and 8.5.1-021 allows remote attackers to cause a denial of service (CPU consumption) via FTP sessions in which the control connection is ended after data transfer aka Bug ID CSCut94150.


The ff_frame_thread_init function in libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles certain memory-allocation failures which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via a crafted file as demonstrated by an AVI file.


Use-after-free vulnerability in the AppCache implementation in Google Chrome before 47.0.2526.73 allows remote attackers with renderer access to cause a denial of service or possibly have unspecified other impact by leveraging incorrect AppCacheUpdateJob behavior associated with duplicate cache selection.


Cisco IOS XE 2.1.0 through 2.4.3 and 2.5.0 on ASR 1000 devices when NAT Application Layer Gateway is used allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted SIP packet aka Bug IDs CSCta74749 and CSCta77008.


Cisco Virtual Topology System (VTS) 2.0(0) and 2.0(1) allows remote attackers to cause a denial of service (CPU and memory consumption and TCP port outage) via a flood of crafted TCP packets aka Bug ID CSCux13379.


Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted (1) IPv4 or (2) IPv6 packet aka Bug ID CSCsw69990.


The reset functionality in the TimedMediaHandler extension for MediaWiki does not create a new transcode which allows remote attackers to cause a denial of service (transcode deletion) by resetting a transcode.


The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process reset) via crafted packets aka Bug ID CSCun72171.


Cisco

NX-OS

through

and

through

on

Nexus

and

devices

allows

remote

attackers

to

cause

a

denial

of

service

(device

crash)

via

crafted

DHCP

packets

to

the

relay

agent

or

smart

relay

agent

aka

Bug

IDs

and


IPSec in Microsoft Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1 and Windows 10 Gold and 1511 mishandles encryption negotiation which allows remote authenticated users to cause a denial of service (system hang) via crafted IP traffic aka \Windows IPSec Denial of Service Vulnerability.\


The Domino web agent in CA Single Sign-On (aka SSO formerly SiteMinder) R6 R12.0 before SP3 CR13 R12.0J before SP3 CR1.2 R12.5 before CR5 R12.51 before CR4 and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.


The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.


Cisco IOS 15.2(3)E and earlier and IOS XE 3.6(2)E and earlier allow remote attackers to cause a denial of service (functionality loss) via crafted Cisco Discovery Protocol (CDP) packets aka Bug ID CSCuu25770.


Cisco ASR 5000 and 5500 devices with software 18.0.0.57828 and 19.0.M0.61045 allow remote attackers to cause a denial of service (vpnmgr process restart) via a crafted header in a TACACS packet aka Bug ID CSCuw01984.


The opj_dwt_decode_1* functions in dwt.c in OpenJPEG as used in PDFium in Google Chrome before 47.0.2526.73 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data that is mishandled during a discrete wavelet transform.


Cisco Content Security Management Appliance (SMA) 7.8.0-000 does not properly validate credentials which allows remote attackers to cause a denial of service (rapid log-file rollover and application fault) via crafted HTTP requests aka Bug ID CSCuw09620.


Cisco Aironet 1800 devices with software 8.1(131.0) allow remote attackers to cause a denial of service (CPU consumption) by improperly establishing many SSHv2 connections aka Bug ID CSCux13374.


The ptvcursor_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Cisco Web Security Appliance (WSA) 8.0.7 allows remote HTTP servers to cause a denial of service (memory consumption from stale TCP connections) via crafted responses aka Bug ID CSCuw10426.


The

snooping

functionality

in

the

first-hop

security

subsystem

in

Cisco

IOS

and

and

IOS

XE

and

before

before

and

before

before

and

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(device

reload)

via

a

malformed

ND

packet

with

the

Cryptographically

Generated

Address

(CGA)

option

aka

Bug

ID


Cisco Secure Access Control Server (ACS) Solution Engine 5.7(0.15) allows remote authenticated users to cause a denial of service (SSH screen process crash) via crafted (1) CLI or (2) GUI commands aka Bug ID CSCuw24694.


The convolution implementation in Skia as used in Google Chrome before 47.0.2526.73 does not properly constrain row lengths which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted graphics data.


Cisco

NX-OS

through

and

through

on

Nexus

and

devices

allows

remote

attackers

to

cause

a

denial

of

service

(device

crash)

via

malformed

DHCP

packets

to

the

relay

agent

aka

Bug

IDs

and


Cisco NX-OS 6.1(2)I3(4) and 7.0(3)I1(1) on Nexus 9000 (N9K) devices allows remote attackers to cause a denial of service (CPU consumption or control-plane instability) or trigger unintended traffic forwarding via a Layer 2 packet with a reserved VLAN number aka Bug ID CSCuw13560.


The GoAhead web server on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to cause a denial of service (reboot) via a crafted URL.


Multiple integer underflows in the ff_mjpeg_decode_frame function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.


Cisco NX-OS 7.1(1)N1(1) on Nexus 5500 5600 and 6000 devices does not properly validate PDUs in SNMP packets which allows remote attackers to cause a denial of service (SNMP application restart) via a crafted packet aka Bug ID CSCut84645.


Use-after-free

vulnerability

in

the

ContainerNode::notifyNodeInsertedInternal

function

in

in

the

DOM

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

related

to

DOMCharacterDataModified

events

for

certain

detached-subtree

insertions.


Cisco IOS XR 4.2.0 4.3.0 5.0.0 5.1.0 5.2.0 5.2.2 5.2.4 5.3.0 and 5.3.2 does not properly restrict the number of Path Computation Elements (PCEs) for OSPF LSA opaque area updates which allows remote attackers to cause a denial of service (device reload) via a crafted update aka Bug ID CSCuw83486.


Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800 819 and 829 devices allows remote attackers to cause a denial of service (memory consumption) via crafted TCP packets on the SSH port aka Bug ID CSCuu13476.


The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.7 does not prevent the conflicting use of a table for both IPv4 and IPv6 addresses which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Cisco AsyncOS before 8.5.7-043 9.x before 9.1.1-023 and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance (ESA) devices mishandles malformed fields during body-contains attachment-contains every-attachment-contains attachment-binary-contains dictionary-match and attachment-dictionary-match filtering which allows remote attackers to cause a denial of service (memory consumption) via a crafted attachment in an e-mail message aka Bug ID CSCuv47151.


The prctl_set_vma_anon_name function in kernel/sys.c in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 does not ensure that only one vma is accessed in a certain update action which allows attackers to gain privileges or cause a denial of service (vma list corruption) via a crafted application aka internal bug 20017123.


The IPv6 snooping functionality in the first-hop security subsystem in Cisco IOS 12.2 15.0 15.1 15.2 15.3 15.4 and 15.5 and IOS XE 3.2SE 3.3SE 3.3XO 3.4SG 3.5E and 3.6E before 3.6.3E; 3.7E before 3.7.2E; 3.9S and 3.10S before 3.10.6S; 3.11S before 3.11.4S; 3.12S and 3.13S before 3.13.3S; and 3.14S before 3.14.2S does not properly implement the Control Plane Protection (aka CPPr) feature which allows remote attackers to cause a denial of service (device reload) via a flood of ND packets aka Bug ID CSCus19794.


The REST interface in Cisco Unified Communications Manager IM and Presence Service 11.5(1) allows remote attackers to cause a denial of service (SIP proxy service restart) via a crafted HTTP request aka Bug ID CSCuw31632.


The IPv4 implementation on Cisco ASR 1000 devices with software 15.5(3)S allows remote attackers to cause a denial of service (ESP QFP CPU consumption) by triggering packet fragmentation and reassembly aka Bug ID CSCuv71273.


epan/dissectors/packet-gsm_rlcmac.c in the GSM RLC/MAC dissector in Wireshark 1.12.x before 1.12.7 uses incorrect integer data types which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


Cisco AsyncOS before 8.5.7-042 9.x before 9.1.0-032 9.1.x before 9.1.1-023 and 9.5.x and 9.6.x before 9.6.0-042 on Email Security Appliance (ESA) devices; before 9.1.0-032 9.1.1 before 9.1.1-005 and 9.5.x before 9.5.0-025 on Content Security Management Appliance (SMA) devices; and before 7.7.0-725 and 8.x before 8.0.8-113 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via a flood of TCP packets aka Bug IDs CSCus79774 CSCus79777 and CSCzv95795.


The ff_sbr_apply function in libavcodec/aacsbr.c in FFmpeg before 2.7.2 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted AAC data.


The xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x 4.4.x and earlier does not limit the number of printk console messages when reporting a failure to retrieve a reference on a foreign page which allows remote domains to cause a denial of service by leveraging permissions to map the memory of a foreign guest.


Cisco NX-OS 6.0(2)U6(0.46) on N3K devices allows remote authenticated users to cause a denial of service (temporary SNMP outage) via an SNMP request for an OID that does not exist aka Bug ID CSCuw36684.


The

decompose

function

in

in

Blink

as

used

in

Google

Chrome

before

does

not

verify

that

a

matrix

inversion

succeeded

which

allows

remote

attackers

to

cause

a

denial

of

service

(uninitialized

memory

access

and

application

crash)

or

possibly

have

unspecified

other

impact

via

a

crafted

web

site.


The proto_tree_add_bytes_item function in epan/proto.c in the protocol-tree implementation in Wireshark 1.12.x before 1.12.7 does not properly terminate a data structure after a failure to locate a number within a string which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Cisco

Adaptive

Security

Appliance

(ASA)

software

and

before

and

before

through

before

before

before

before

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(device

reload)

via

a

crafted

DNS

response

aka

Bug

ID


The sws_init_context function in libswscale/utils.c in FFmpeg before 2.7.2 does not initialize certain pixbuf data structures which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.


The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.


The self-service application in Cisco Unified Communications Domain Manager (CUCDM) 10.6(1) allows remote authenticated users to cause a denial of service (subapplication outage) via malformed requests aka Bug ID CSCuu10981.


The vCMP host in F5 BIG-IP Analytics APM ASM GTM Link Controller and LTM 11.0.0 before 11.6.0 BIG-IP AAM 11.4.0 before 11.6.0 BIG-IP AFM and PEM 11.3.0 before 11.6.0 BIG-IP Edge Gateway WebAccelerator and WOM 11.0.0 through 11.3.0 BIG-IP PSM 11.0.0 through 11.4.1 allows remote attackers to cause a denial of service via \malicious traffic.\


Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv6 packet aka Bug ID CSCsv98555.


Use-after-free

vulnerability

in

in

the

AppCache

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

by

leveraging

incorrect

pointer

maintenance

associated

with

certain

callbacks.


Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv4 UDP packet aka Bug ID CSCsw95482.


js/array.js in Google V8 as used in Google Chrome before 47.0.2526.73 improperly implements certain map and filter operations for arrays which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.


conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them which allows remote attackers to cause a denial of service (crash) via a (1) DCCP (2) SCTP or (3) ICMPv6 packet.


Cisco Unified SIP 3905 phones allow remote attackers to cause a denial of service (resource consumption and functionality loss) via a large amount of network traffic aka Bug ID CSCuh51331.


Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices with software 19.1.0.61559 and 19.2.0 allow remote attackers to cause a denial of service (BGP process restart) via a crafted header in a BGP packet aka Bug ID CSCuw65781.


The System V IPC implementation in the kernel in Android before 6.0 2016-01-01 allows attackers to cause a denial of service (global kernel resource consumption) by leveraging improper interaction between IPC resource allocation and the memory manager aka internal bug 22300191 a different vulnerability than CVE-2015-7613.


Use-after-free

vulnerability

in

the

Infobars

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

web

site

related

to


The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process reset) via crafted packets aka Bug ID CSCun36525.


The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets aka Bug ID CSCux00686.


The

function

in

in

PDFium

as

used

in

Google

Chrome

before

does

not

properly

perform

a

cast

of

a

dictionary

object

which

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

PDF

document.


sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices which allows local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device as demonstrated by writing an escape sequence.


fpdfsdk/src/jsapi/fxjs_v8.cpp in PDFium as used in Google Chrome before 47.0.2526.73 does not use signatures which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage \type confusion.\


The non-Domino web agents in CA Single Sign-On (aka SSO formerly SiteMinder) R6 R12.0 before SP3 CR13 R12.0J before SP3 CR1.2 and R12.5 before CR5 allow remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.


CodeWrights HART Comm DTM components as used with Endress+Hauser FieldCare allow remote attackers to read arbitrary files send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption) via a longtag XML schema containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


Cisco AsyncOS 8.x before 8.0.8-113 8.1.x and 8.5.x before 8.5.3-051 8.6.x and 8.7.x before 8.7.0-171-LD and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via multiple file-range requests aka Bug ID CSCur39155.


The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS 15.3(3)S0.1 on ASR devices mishandles internal tables which allows remote attackers to cause a denial of service (memory consumption or device crash) via a flood of crafted ND messages aka Bug ID CSCup28217.


Cisco TelePresence Server 3.1 on 7010 Mobility Services Engine (MSE) 8710 Multiparty Media 310 and 320 and Virtual Machine (VM) devices allows remote attackers to cause a denial of service (device reload) via malformed STUN packets aka Bug ID CSCuv01348.


The

ObjectBackedNativeHandler

class

in

in

the

extensions

subsystem

in

Google

Chrome

before

improperly

implements

handler

functions

which

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

that

leverage

\type

confusion.\


The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.


The dissect_openflow_tablemod_v5 function in epan/dissectors/packet-openflow_v5.c in the OpenFlow dissector in Wireshark 1.12.x before 1.12.7 does not validate a certain offset value which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolution delays aka Bug IDs CSCur32005 and CSCur07907.


The Web Management GUI on Cisco Wireless LAN Controller (WLC) devices with software 7.4(140.0) and 8.0(120.0) allows remote attackers to cause a denial of service (client disconnection) via unspecified vectors aka Bug ID CSCuw10610.


The Supervisor 1.0.0.0 and 1.0.0.1 in Cisco Integrated Management Controller (IMC) before 2.0(9) allows remote authenticated users to cause a denial of service (IP interface outage) via crafted parameters in an HTTP request aka Bug ID CSCuv38286.


The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.


The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table searches for empty strings which allows remote attackers to cause a denial of service (application crash) via a crafted packet related to the (1) dissector_get_string_handle and (2) dissector_get_default_string_handle functions.


The IKEv1 implementation in Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58) 8.3 and 8.4 before 8.4(7.29) 8.5 through 8.7 before 8.7(1.17) 9.0 before 9.0(4.37) 9.1 before 9.1(6.8) 9.2 before 9.2(4) and 9.3 before 9.3(3) allows remote attackers to cause a denial of service (device reload) via crafted ISAKMP UDP packets aka Bug ID CSCus94026.


Cisco IOS XE 2.1.0 through 2.2.3 and 2.3.0 on ASR 1000 devices when NAT Application Layer Gateway is used allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted H.323 packet aka Bug ID CSCsx35393 CSCsx07094 and CSCsw93064.


The perf_callchain_user_64 function in arch/powerpc/perf/callchain.c in the Linux kernel before 4.0.2 on ppc64 platforms allows local users to cause a denial of service (infinite loop) via a deep 64-bit userspace backtrace.


The Quiz extension for MediaWiki allows remote attackers to cause a denial of service via regex metacharacters in a regular expression.


Cisco TelePresence Server 4.1(2.29) through 4.2(4.17) on 7010; Mobility Services Engine (MSE) 8710; Multiparty Media 310 320 and 820; and Virtual Machine (VM) devices allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted HTTP requests that are not followed by an unspecified negotiation aka Bug ID CSCuv47565.


The ARP implementation in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 5.2(1)SV3(1.4) Nexus 3000 devices 7.3(0)ZD(0.47) Nexus 4000 devices 4.1(2)E1 Nexus 9000 devices 7.3(0)ZD(0.61) and MDS 9000 devices 7.0(0)HSK(0.353) and SAN-OS NX-OS on MDS 9000 devices 7.0(0)HSK(0.353) allows remote attackers to cause a denial of service (ARP process restart) via crafted packet-header fields aka Bug ID CSCut25292.


The Image11::map function in renderer/d3d/d3d11/Image11.cpp in libANGLE as used in Google Chrome before 46.0.2490.71 mishandles mapping failures after device-lost events which allows remote attackers to cause a denial of service (invalid read or write) or possibly have unspecified other impact via vectors involving a removed device.


Invision Power Services IPS Community Suite (aka Invision Power Board IPB or Power Board) before 4.0.12.1 allows remote attackers to cause a denial of service (loop and memory consumption) via a crafted URL.


The WebApplications Identity Management subsystem in Cisco Unified Communications Manager 10.5(0.98000.88) allows remote attackers to cause a denial of service (subsystem outage) via invalid session tokens aka Bug ID CSCul83786.


The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data.


The USB driver in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows physically proximate attackers to cause a denial of service via a crafted USB device that triggers invalid USB commands aka Bug ID CSCux10531.


The dissect_wa_payload function in epan/dissectors/packet-waveagent.c in the WaveAgent dissector in Wireshark 1.12.x before 1.12.7 mishandles large tag values which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Cisco Application Visibility and Control (AVC) 15.3(3)JA when FlexConnect is enabled allows remote attackers to cause a denial of service (access-point outage) via a crafted UDP packet aka Bug ID CSCuu47016.


wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or traffic amplification) via a crafted DTLS cookie in a ClientHello message.


The CJBig2_SymbolDict class in fxcodec/jbig2/JBig2_SymbolDict.cpp in PDFium as used in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a PDF document containing crafted data with JBIG2 compression.


The File Bookmark component in Apple OS X before 10.11.1 allows local users to cause a denial of service (application crash) via crafted bookmark metadata in a folder.


The Proxy Mobile IPv6 (PMIPv6) component in the CDMA implementation on Cisco ASR 5000 devices with software 19.0.M0.60737 allows remote attackers to cause a denial of service (hamgr process restart) via a crafted header in a PMIPv6 packet aka Bug ID CSCuv63280.


Cisco Nexus 9000 Application Centric Infrastructure (ACI) Mode switches with software before 11.0(1c) allow remote attackers to cause a denial of service (device reload) via an IPv4 ICMP packet with the IP Record Route option aka Bug ID CSCuq57512.


The SNAP Lite component in certain SISCO MMS-EASE and AX-S4 ICCP products allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.


The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data as demonstrated by an attack against slapd.


The wmem_block_split_free_chunk function in epan/wmem/wmem_allocator_block.c in the wmem block allocator in the memory manager in Wireshark 1.12.x before 1.12.7 does not properly consider a certain case of multiple realloc operations that restore a memory chunk to its original size which allows remote attackers to cause a denial of service (incorrect free operation and application crash) via a crafted packet.


Cisco

Adaptive

Security

Appliance

(ASA)

software

and

before

and

before

through

before

before

before

before

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(device

reload)

via

a

crafted

DNS

response

aka

Bug

ID


Cisco IOS XE before 3.1.2S on ASR 1000 devices mishandles the automatic setup of Virtual Fragment Reassembly (VFR) by certain firewall and NAT components which allows remote attackers to cause a denial of service (Embedded Services Processor crash) via crafted IP packets aka Bug IDs CSCtf87624 CSCte93229 CSCtd19103 and CSCti63623.


The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8 as used in Google Chrome before 47.0.2526.73 improperly loads array elements which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.


cifs-ao in the CIFS optimization functionality on Cisco Wide Area Application Service (WAAS) and Virtual WAAS (vWAAS) devices 5.x before 5.3.5d and 5.4 and 5.5 before 5.5.3 allows remote attackers to cause a denial of service (resource consumption and device reload) via crafted network traffic aka Bug ID CSCus85330.


Cisco IOS XE 2.x and 3.x before 3.10.6S 3.11.xS through 3.13.xS before 3.13.3S and 3.14.xS through 3.15.xS before 3.15.1S allows remote attackers to cause a denial of service (device reload) via IPv4 packets that require NAT and MPLS actions aka Bug ID CSCut96933.


EMC NetWorker before 8.0.4.5 8.1.x before 8.1.3.6 8.2.x before 8.2.2.2 and 9.0 before build 407 allows remote attackers to cause a denial of service (process outage) via malformed RPC authentication messages.


Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted L2TP packet aka Bug IDs CSCsw95722 and CSCsw95496.


Telephony in Android 5.x before 5.1.1 LMY48X allows attackers to gain privileges and consequently bypass intended network-interface restrictions perform expensive data transfers or cause a denial of service (call-reception outage or mute manipulation) via a crafted application aka internal bug 21900139.


Cisco ASR 5000 devices with software 19.0.M0.60828 allow remote attackers to cause a denial of service (OSPF process restart) via crafted length fields in headers of OSPF packets aka Bug ID CSCuv62820.


Cisco Prime Infrastructure 2.2 allows remote attackers to cause a denial of service (daemon hang) by sending many SSL renegotiation requests aka Bug ID CSCuv56830.


The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers permanent file-descriptor allocation.


The kernel in Cisco NX-OS 5.2(9)N1(1) on Nexus 5000 devices allows local users to cause a denial of service (device crash) via crafted USB parameters aka Bug ID CSCus89408.


The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.


Cisco IOS XE 16.1.1 allows remote attackers to cause a denial of service (device reload) via a packet with the 00-00-00-00-00-00 source MAC address aka Bug ID CSCux48405.


Cisco FirePOWER (formerly Sourcefire) 7000 and 8000 devices with software 5.4.0.1 allow remote attackers to cause a denial of service (inspection-engine outage) via crafted packets aka Bug ID CSCuu10871.


The RADIUS client implementation in Cisco IOS 15.4(3)M2.2 when a shared RADIUS secret is configured allows remote RADIUS servers to cause a denial of service (device reload) via malformed answers aka Bug ID CSCuu59324.


Use-after-free

vulnerability

in

the

GetLoadTimes

function

in

renderer/loadtimes_extension_bindings.cc

in

the

Extensions

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

crafted

JavaScript

code

that

modifies

a

pointer

used

for

reporting

loadTimes

data.


The proxy-cache implementation in Cisco AsyncOS 8.0.x before 8.0.7-151 8.1.x and 8.5.x before 8.5.2-004 8.6.x and 8.7.x before 8.7.0-171-LD and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via multiple proxy connections aka Bug ID CSCus10922.


The IKEv1 state machine in Cisco IOS 15.4 through 15.6 and IOS XE 3.15 through 3.17 allows remote attackers to cause a denial of service (IPsec connection termination) via a crafted IKEv1 packet to a tunnel endpoint aka Bug ID CSCuw08236.


hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive which triggers a divide-by-zero error and instance crash.


Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls which are not properly handled in the do_xenoprof_op function in common/xenoprof.c or (2) HYPERVISOR_xenpmu_op hypercalls which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.


Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of \teardowns\ of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall.


The

SSH

server

in

Juniper

Junos

OS

before

before

before

before

before

before

before

before

before

before

before

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(CPU

consumption)

via

unspecified

SSH

traffic.


The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7 2.10.x before 2.10.8 2.11.x before 2.11.8 2.12.x before 2.12.6 2.13.x before 2.13.3 2.14.x before 2.14.2 and 2.15.x before 2.15.2 when used in SSL mode allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.


fs/ext4/namei.c in the Linux kernel before 3.7 allows physically proximate attackers to cause a denial of service (system crash) via a crafted no-journal filesystem a related issue to CVE-2013-2015.


The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input which allows an attacker to cause a denial of service (application crash).


The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the JasPer decoder which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG 2000 image.


IBM Spectrum Scale 4.1.1.x before 4.1.1.3 and General Parallel File System (GPFS) 3.5.x before 3.5.0.29 and 4.1.x through 4.1.0.8 on AIX allow local users to cause a denial of service (incorrect pointer dereference and node crash) via unspecified vectors.


NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.


The pcapng_read_if_descr_block function in wiretap/pcapng.c in the pcapng parser in Wireshark 1.12.x before 1.12.8 uses too many levels of pointer indirection which allows remote attackers to cause a denial of service (incorrect free and application crash) via a crafted packet that triggers interface-filter copying.


hw/virtio/virtio.c in the Virtual Network Device (virtio-net) support in QEMU when big or mergeable receive buffers are not supported allows remote attackers to cause a denial of service (guest network consumption) via a flood of jumbo frames on the (1) tuntap or (2) macvtap interface.


ntpq in NTP 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.


Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (uninitialized pointer dereference and application crash) by including the / filename in a .zip PHAR archive.


The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.


NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command which triggers recursive traversal of the restriction list.


Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote attackers to cause a denial of service (Report Builder server outage) via a crafted request to a Report Builder instance URL.


The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags.


The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element which allows attackers to cause a denial of service via a crafted XML file related to a \type confusion\ issue.


The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x 3.5.x and 3.6.x is not preemptible which allows local x86 HVM guest administrators to cause a denial of service (CPU consumption and possibly reboot) via crafted memory contents that triggers a \time-consuming linear scan \ related to Populate-on-Demand.


botan before 1.11.22 improperly validates certificate paths which allows remote attackers to cause a denial of service (infinite loop and memory consumption) via a certificate with a loop in the certificate chain.


The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.


The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted \KOD\ messages.


AFP Workbench Viewer in IBM i Access 7.1 on Windows allows remote attackers to cause a denial of service (viewer crash) via a crafted workbench file.


The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands.


The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow assertion failure and application exit) via a malformed PushPromise frame that triggers decompressed-buffer length miscalculation and incorrect memory allocation.


Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).


The Lotus Mashups component in IBM Mashup Center 3.0.0.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an XML external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


The datastor kernel module in F5 BIG-IP Analytics APM ASM Link Controller and LTM 11.1.0 before 12.0.0 BIG-IP AAM 11.4.0 before 12.0.0 BIG-IP AFM PEM 11.3.0 before 12.0.0 BIG-IP Edge Gateway WebAccelerator and WOM 11.1.0 through 11.3.0 BIG-IP GTM 11.1.0 through 11.6.0 BIG-IP PSM 11.1.0 through 11.4.1 BIG-IQ Cloud and Security 4.0.0 through 4.5.0 BIG-IQ Device 4.2.0 through 4.5.0 BIG-IQ ADC 4.5.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to cause a denial of service or gain privileges by leveraging permission to upload and execute code.


The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.


The usbvision driver in the Linux kernel package 3.10.0-123.20.1.el7 through 3.10.0-229.14.1.el7 in Red Hat Enterprise Linux (RHEL) 7.1 allows physically proximate attackers to cause a denial of service (panic) via a nonzero bInterfaceNumber value in a USB device descriptor.


gifread.c in gif2png as used in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.


Dell SonicWall TotalSecure TZ 100 devices with firmware before 5.9.1.0-22o allow remote attackers to cause a denial of service via a crafted packet.


BIG-IP LTM AAM AFM Analytics APM ASM Link Controller and PEM 12.0.0 before HF1 when the TCP profile for a virtual server is configured with Congestion Metrics Cache enabled allow remote attackers to cause a denial of service (Traffic Management Microkernel (TMM) restart) via crafted ICMP packets related to Path MTU (PMTU) discovery.


Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might allow remote attackers to obtain sensitive information cause a denial of service or possibly have unspecified other impact by triggering a crafted WebRTC RTP packet.


The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not properly calculate the balloon size when using the populate-on-demand (PoD) system which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors related to \heavy memory pressure.\


Node.js 4.0.0 4.1.0 and 4.1.1 allows remote attackers to cause a denial of service.


The exception handling mechanism in the CLI Module in Huawei eSpace U1910 U1911 U1930 U1960 U1980 and U1981 unified gateways with software before V100R001C20SPH605 allows remote attackers to cause a denial of service (CLI outage) via crafted SSH packets.


Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive.


libxpc in launchd in Apple OS X before 10.11 does not restrict the creation of processes for network connections which allows remote attackers to cause a denial of service (resource consumption) by repeatedly connecting to the SSH port a different vulnerability than CVE-2015-7761.


The hypercall_create_continuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows local guest users to cause a denial of service (host crash) via a preemptible hypercall to the multicall interface.


ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to cause a denial of service via unspecified vectors.


The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.


in

Action

Pack

in

Ruby

on

Rails

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(superfluous

caching

and

memory

consumption)

by

leveraging

an

application's

use

of

a

wildcard

controller

route.


The PFE daemon in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service via an unspecified connection request to the \host-OS.\


Revive Adserver before 3.2.2 does not restrict access to run-mpe.php which allows remote attackers to run the Maintenance Priority Engine and possibly cause a denial of service (resource consumption) via a direct request.


Corega CG-WLNCM4G devices provide an open DNS resolver which allows remote attackers to cause a denial of service (traffic amplification) via crafted queries.


The L2TP packet processing functionality in Juniper Netscreen and ScreenOS Firewall products with ScreenOS before 6.3.0r13-dnd1 6.3.0r14 through 6.3.0r18 before 6.3.0r18-dnc1 and 6.3.0r19 allows remote attackers to cause a denial of service via a crafted L2TP packet.


The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.


Xen 4.4.x 4.5.x and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls which allows local guests to cause a denial of service via a sequence of (1) HYPERVISOR_physdev_op hypercalls which are not properly handled in the do_physdev_op function in arch/arm/physdev.c or (2) HYPERVISOR_hvm_op hypercalls which are not properly handled in the do_hvm_op function in arch/arm/hvm.c.


Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).


Juniper chassis with Trio (Trinity) chipset line cards and Junos OS 13.3 before 13.3R8 14.1 before 14.1R6 14.2 before 14.2R5 and 15.1 before 15.1R2 allow remote attackers to cause a denial of service (MPC line card crash) via a crafted uBFD packet.


librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop stack consumption and application crash) via cyclic references in an SVG document.


arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration which allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions.


The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allows attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image.


The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow assertion failure and application exit) via a single-byte header frame that triggers incorrect memory allocation.


SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file and consequently cause a denial of service (application crash) via unspecified vectors.


IBM WebSphere Portal 8.0.0.1 before CF19 and 8.5.0 before CF09 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.


Huawei P7 before P7-L00C17B851 P7-L05C00B851 and P7-L09C92B851 and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash) via vectors involving an application that passes crafted input to the GPU driver.