Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold allow remote attackers to cause a denial of service (iSCSI service outage) by sending many crafted packets aka \iSCSI Target Remote Denial of Service Vulnerability.\


The SSLSocket implementation in the (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service (memory consumption) by triggering application-data processing during the TLS handshake a time at which the data is internally buffered.


WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4 Android 4.2.2 as used in the LG D806 Android 4.2.2 as used in the Samsung SM-T310 Android 4.1.2 as used in the Motorola RAZR HD and potentially other unspecified Android releases before 5.0.1 and 5.0.2 does not properly handle exceptions which allows remote attackers to cause a denial of service (reboot) via a crafted 802.11 probe response frame.


The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6 9.7 and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2 and 9.6-ESV before 9.6-ESV-R10-P2 allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver that uses the NSEC3 signing feature.


The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4 4.3.5 and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests.


The futex_wait function in kernel/futex.c in the Linux kernel before 2.6.37 does not properly maintain a certain reference count during requeue operations which allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that triggers a zero count.


The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10 when a reverse proxy is enabled allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.


Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface which allows local users to cause a denial of service (shutdown) by sending a shutdown command to all listening high ports.


in

Action

View

in

Ruby

on

Rails

before

converts

MIME

type

strings

to

symbols

during

use

of

the

:text

option

to

the

render

method

which

allows

remote

attackers

to

cause

a

denial

of

service

(memory

consumption)

by

including

these

strings

in

headers.


The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.


Multiple XML external entity (XXE) vulnerabilities in the (1) CCRC WAN Server / CM Server (2) Perl CC/CQ integration trigger scripts (3) CMAPI Java interface (4) ClearCase remote client and (5) CMI and OSLC-based ClearQuest integrations components in IBM Rational ClearCase 7.1.0.x 7.1.1.x 7.1.2 through 7.1.2.13 8.0 through 8.0.0.10 and 8.0.1 through 8.0.1.3 allow remote attackers to cause a denial of service or access other servers via crafted XML data. IBM X-Force ID: 92263.


Apache Tomcat 6.x before 6.0.44 7.x before 7.0.55 and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.


The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark 1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to represent an error condition which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


IBM Unified Extensible Firmware Interface (UEFI) on Flex System x880 X6 System x3850 X6 and System x3950 X6 devices allows remote authenticated users to cause an unspecified temporary denial of service by using privileged access to enable a legacy boot mode.


mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call.


sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.


The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites as demonstrated using the Codenomicon Defensics toolkit.


The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet.


Microsoft .NET Framework 1.1 SP1 2.0 SP2 3.0 SP2 3.5 3.5.1 4 4.5 4.5.1 and 4.5.2 does not properly use a hash table for request data which allows remote attackers to cause a denial of service (resource consumption and ASP.NET performance degradation) via crafted requests aka \.NET Framework Denial of Service Vulnerability.\


Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\\0' character.


Asterisk Open Source 1.8.x before 1.8.28.1 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections.


IBM WebSphere MQ 7.0.1 before 7.0.1.13 7.1 before 7.1.0.6 7.5 before 7.5.0.5 and 8 before 8.0.0.1 allows remote authenticated users to cause a denial of service (queue-slot exhaustion) by leveraging PCF query privileges for a crafted query.


The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call.


The WebSEAL component in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005 when e-community SSO is enabled allows remote attackers to cause a denial of service (component hang) via unspecified vectors.


IBM

WebSphere

Portal

through

through

through

through

and

before

allows

remote

authenticated

users

to

cause

a

denial

of

service

(disk

consumption)

by

uploading

large

files.


IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 does not properly detect recursion during entity expansion which allows remote attackers to cause a denial of service (memory and CPU consumption and application crash) via a crafted XML document containing a large number of nested entity references a similar issue to CVE-2003-1564.


Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting environments.


The Response Group Service in Microsoft Lync Server 2010 and 2013 and the Core Components in Lync Server 2013 do not properly handle exceptions which allows remote attackers to cause a denial of service (daemon hang) via a crafted call aka \Lync Denial of Service Vulnerability.\


The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets as demonstrated by an a3 01 5b ff byte sequence.


The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1 when sub_min_expiry is set to zero allows remote attackers to cause a denial of service (assertion failure and crash) via an unsubscribe request when not subscribed to the device.


Email::Address module before 1.904 for Perl uses an inefficient regular expression which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to \backtracking into the phrase \ a different vulnerability than CVE-2014-0477.


Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments.


The Dumper method in Data::Dumper before 2.154 as used in Perl 5.20.1 and earlier allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References which triggers a large number of recursive calls to the DD_dump function.


Microsoft SQL Server 2008 SP3 2008 R2 SP2 and 2012 SP1 does not properly control use of stack memory for processing of T-SQL batch commands which allows remote authenticated users to cause a denial of service (daemon hang) via a crafted T-SQL statement aka \Microsoft SQL Server Stack Overrun Vulnerability.\


IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27 6.1.5 through 6.1.5.3 CF27 7.0 through 7.0.0.2 CF28 8.0 through 8.0.0.1 CF14 and 8.5.0 before CF03 does not properly detect recursion during entity expansion which allows remote authenticated users to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references a similar issue to CVE-2003-1564.


The L3-agent in OpenStack Neutron before 2013.2.4 2014.x before 2014.1.2 and Juno before Juno-2 allows remote authenticated users to cause a denial of service (IPv4 address attachment outage) by attaching an IPv6 private subnet to a L3 router.


The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (deadlock) by terminating a subscription request before it is complete which triggers a SIP transaction timeout.


arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms when syscall auditing is enabled and the sep CPU feature flag is set allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number as demonstrated by number 1000.


Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry.


MatrikonOPC OPC Server for DNP3 1.2.3 and earlier allows remote attackers to cause a denial of service (unhandled exception and DNP3 process crash) via a crafted message.


DOMPDF before 0.6.2 allows denial of service.


The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount system call in conjunction with a symlink which allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have unspecified other impact via the umount program.


The

function

in

in

MIT

Kerberos

(aka

before

when

the

KDC

uses

LDAP

allows

remote

authenticated

users

to

cause

a

denial

of

service

(daemon

crash)

via

a

successful

LDAP

query

with

no

results

as

demonstrated

by

using

an

incorrect

object

type

for

a

password

policy.


Certain MMU virtualization operations in Xen 4.2.x through 4.4.x before the xsa97-hap patch when using Hardware Assisted Paging (HAP) are not preemptible which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations which process every page assigned to a guest a different vulnerability than CVE-2014-5149.


OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4 2014.x before 2014.1.3 and Juno before Juno-3 when using the V2 API does not properly enforce the image_size_cap configuration option which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.


The Incutio XML-RPC (IXR) Library as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31 permits entity declarations without considering recursion during entity expansion which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references a similar issue to CVE-2003-1564.


XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference.


fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV MNT_NOSUID and MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount which allows local users to gain privileges interfere with backups and auditing on systems that had atime enabled or cause a denial of service (excessive filesystem updating) on systems that had atime disabled via a \mount -o remount\ command within a user namespace.


The APN decode functionality in (1) epan/dissectors/packet-gtp.c and (2) epan/dissectors/packet-gsm_a_gm.c in the GTP and GSM Management dissectors in Wireshark 1.10.x before 1.10.9 does not completely initialize a certain buffer which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Monkey HTTP Server before 1.5.3 when the File Descriptor Table (FDT) is enabled and custom error messages are set allows remote attackers to cause a denial of service (file descriptor consumption) via an HTTP request that triggers an error message.


GE Multilink ML800 ML1200 ML1600 and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810 ML3000 and ML3100 switches with firmware 5.2.0 and earlier allow remote attackers to cause a denial of service (resource consumption or reboot) via crafted packets.


DNP Master Driver 3.02 and earlier in Elipse SCADA 2.29 build 141 and earlier E3 1.0 through 4.6 and Elipse Power 1.0 through 4.6 allows remote attackers to cause a denial of service (CPU consumption) via malformed packets.


The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed packets over (1) an Ethernet network or (2) a serial line.


The VIQR module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (out-of-bounds array access) via a crafted argument to the iconv_open function. NOTE: this issue was SPLIT from CVE-2014-3951 per ADT2 due to different vulnerability types.


The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header related to determining which configuration file to use.


The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry.


Xen 4.4.x when running on an ARM system and \handling an unknown system register access from 64-bit userspace \ returns to an instruction of the trap handler for kernel space faults instead of an instruction that is associated with faults in 64-bit userspace which allows local guest users to cause a denial of service (crash) and possibly gain privileges via a crafted process.


Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


The rlc_decode_li function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.10.x before 1.10.9 initializes a certain structure member only after this member is used which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Certain MMU virtualization operations in Xen 4.2.x through 4.4.x when using shadow pagetables are not preemptible which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations which process every page assigned to a guest a different vulnerability than CVE-2014-5146.


The Incutio XML-RPC (IXR) Library as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31 does not limit the number of elements in an XML document which allows remote attackers to cause a denial of service (CPU consumption) via a large document a different vulnerability than CVE-2014-5265.


Use-after-free vulnerability in core/events/TreeScopeEventContext.cpp in the DOM implementation in Blink as used in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of TreeScope data.


Use-after-free vulnerability in the DOM implementation in Blink as used in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to unexpected absence of document data structures.


jscript.c in Exuberant Ctags 5.8 allows remote attackers to cause a denial of service (infinite loop and CPU and disk consumption) via a crafted JavaScript file.


Algorithmic complexity vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x through 3.1.2 allows remote attackers to cause a denial of service (CPU consumption) via vectors that trigger colliding hash-table keys. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1983.


The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 4.4.x and earlier does not properly check supervisor mode permissions which allows local HVM users to cause a denial of service (guest crash) or gain guest kernel mode privileges via vectors involving an (1) HLT (2) LGDT (3) LIDT or (4) LMSW instruction.


The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel before 3.14.2 does not properly compare btree hash values which allows local users to cause a denial of service (filesystem corruption and OOPS or panic) via operations on directories that have hash collisions as demonstrated by rmdir operations.


The Fonts implementation in Google Chrome before 40.0.2214.91 does not initialize memory for a data structure which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application.


effects/SkDashPathEffect.cpp in Skia as used in Google Chrome before 39.0.2171.65 computes a hash key using uninitialized integer values which might allow remote attackers to cause a denial of service by rendering crafted data.


Use-after-free

vulnerability

in

the

IndexedDB

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

by

triggering

duplicate

BLOB

references

related

to

and


The qs module before 1.0.0 in Node.js does not call the compact function for array data which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.


Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym rails function and lack of garbage collection of inserted symbols.


The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call as demonstrated by use of a file descriptor associated with an ext4 filesystem.


Use-after-free vulnerability in the WebAudio implementation in Blink as used in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an audio-rendering thread in which AudioNode data is improperly maintained.


The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation which allows local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.


The Core Server in OpenAM 9.5.3 through 9.5.5 10.0.0 through 10.0.2 10.1.0-Xpress and 11.0.0 through 11.0.2 when deployed on a multi-server network allows remote authenticated users to cause a denial of service (infinite loop) via a crafted cookie in a request.


Use-after-free

vulnerability

in

the

function

in

in

PDFium

as

used

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

PDF

document.


Use-after-free

vulnerability

in

the

HTMLScriptElement::didMoveToNewDocument

function

in

in

the

DOM

implementation

in

Blink

as

used

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

involving

movement

of

a

SCRIPT

element

across

documents.


The DHCP implementation in Cisco IOS on Aironet access points does not properly handle error conditions with short leases and unsuccessful lease-renewal attempts which allows remote attackers to cause a denial of service (device restart) by triggering a transition into a recovery state that was intended to involve a network-interface restart but actually involves a full device restart aka Bug ID CSCtn16281.


Use-after-free vulnerability in browser/speech/tts_message_filter.cc in the Speech implementation in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving utterances from a closed tab.


The (1) PPP Access Concentrator (PPPAC) and (2) Dial-Up Networking Internet Initiative Japan Inc. SEIL series routers SEIL/x86 Fuji 1.00 through 3.22; SEIL/X1 SEIL/X2 and SEIL/B1 1.00 through 4.62; SEIL/Turbo 1.82 through 2.18; and SEIL/neu 2FE Plus 1.82 through 2.18 allow remote attackers to cause a denial of service (restart) via crafted (a) GRE or (b) MPPE packets.


The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 3.3.x through 4.4.x does not check the supervisor mode permissions for instructions that generate software interrupts which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors.


iplookup/index.php in Moodle through 2.4.11 2.5.x before 2.5.9 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to cause a denial of service (resource consumption) by triggering the calculation of an estimated latitude and longitude for an IP address.


The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.


The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary.


OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.


Use-after-free vulnerability in the matroska_read_seek function in libavformat/matroskadec.c in FFmpeg before 2.5.1 as used in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Matroska file that triggers improper maintenance of tracks data.


The TCP stack in 4.3BSD Net/2 as used in FreeBSD 5.4 NetBSD possibly 2.0 and OpenBSD possibly 3.6 does not properly implement the session timer which allows remote attackers to cause a denial of service (resource consumption) via crafted packets.


The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents aka the \redir_stack\ issue.


Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2 as used in Google Chrome before 40.0.2214.91 allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Vorbis I data.


The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.


Use-after-free vulnerability in the Pepper plugins in Google Chrome before 39.0.2171.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Flash content that triggers an attempted PepperMediaDeviceManager access outside of the object's lifetime.


Use-after-free vulnerability in the Element::detach function in core/dom/Element.cpp in the DOM implementation in Blink as used in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving pending updates of detached elements.


The login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00(AADY.4)C0 and earlier allows remote attackers to cause a denial of service (persistent web-interface outage) via JavaScript code within unspecified \welcome message\ form data that is improperly handled during use for the loginMsg variable's value a different vulnerability than CVE-2014-7277.


Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops aka the \word_lineno\ issue.


Use-after-free

vulnerability

in

the

ZoomBubbleView::Close

function

in

in

the

Views

implementation

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

a

crafted

document

that

triggers

improper

maintenance

of

a

zoom

bubble.


Multiple

use-after-free

vulnerabilities

in

in

Blink

as

used

in

Google

Chrome

before

allow

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

that

trigger

improper

handling

of

a

detached

frame

related

to

the

lock

and

unlock

methods.


Internet Initiative Japan Inc. SEIL Series routers SEIL/X1 2.50 through 4.62 SEIL/X2 2.50 through 4.62 SEIL/B1 2.50 through 4.62 and SEIL/x86 Fuji 1.70 through 3.22 allow remote attackers to cause a denial of service (CPU and traffic consumption) via a large number of NTP requests within a short time which causes unnecessary NTP responses to be sent.


The collator implementation in i18n/ucol.cpp in International Components for Unicode (ICU) 52 through SVN revision 293126 as used in Google Chrome before 40.0.2214.91 does not initialize memory for a data structure which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted character sequence.


D-Bus 1.3.0 through 1.6.x before 1.6.26 1.8.x before 1.8.10 and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.


The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.


Cisco IOS on Aironet access points when \dot11 aaa authenticator\ debugging is enabled allows remote attackers to cause a denial of service via a malformed EAP packet aka Bug ID CSCul15509.


The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls clearing the / MNT_LOCKED flag and making an MNT_FORCE umount system call.


IBM DB2 9.7 before FP10 9.8 through FP5 10.1 through FT4 and 10.5 through FP4 on Linux UNIX and Windows when immediate AUTO_REVAL is enabled allows remote authenticated users to cause a denial of service (daemon crash) via a crafted ALTER TABLE statement.


Juniper

Junos

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(router

protocol

daemon

crash)

via

a

crafted

RSVP

PATH

message.


The HTTP Server Adapter in IBM Sterling B2B Integrator 5.1 and 5.2.x and Sterling File Gateway 2.1 and 2.2 allows remote attackers to cause a denial of service (connection-slot exhaustion) via a crafted HTTP request.


The dissect_spdu function in epan/dissectors/packet-ses.c in the SES dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not initialize a certain ID value which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.


The dissect_v9_v10_pdu_data function in epan/dissectors/packet-netflow.c in the Netflow dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 refers to incorrect offset and start variables which allows remote attackers to cause a denial of service (uninitialized memory read and application crash) via a crafted packet.


Juniper WLC devices with WLAN Software releases 8.0.x before 8.0.4 9.0.x before 9.0.2.11 9.0.3.x before 9.0.3.5 and 9.1.x before 9.1.1 when \Proxy ARP\ or \No Broadcast\ features are enabled in a clustered setup allows remote attackers to cause a denial of service (device disconnect) via unspecified vectors.


IBM DB2 9.7 before FP10 and 9.8 through FP5 on Linux UNIX and Windows allows remote authenticated users to cause a denial of service (daemon crash) via a crafted ALTER TABLE statement.


Juniper

Junos

before

before

before

before

before

before

before

before

before

before

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(kernel

crash

and

restart)

via

a

crafted

fragmented

packet

with

an

IPsec

Authentication

Header

(AH).


The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc.


IBM DB2 9.7 through FP10 9.8 through FP5 10.1 through FP4 and 10.5 before FP5 on Linux UNIX and Windows allows remote authenticated users to cause a denial of service (daemon crash) by specifying the same column within multiple ALTER TABLE statements.


The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking resource consumption or application crash) via a crafted string.


Juniper

Junos

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

when

using

an

em

interface

to

connect

to

a

certain

internal

network

allows

remote

attackers

to

cause

a

denial

of

service

(em

driver

bock

and

FPC

reset

or

\go

offline\)

via

a

series

of

crafted

CLNP

fragmented

packets

when

clns-routing

or

ESIS

is

configured

or

or

fragmented

packets.


IBM DB2 9.5 through FP10 9.7 through FP10 9.8 through FP5 10.1 through FP4 and 10.5 before FP5 on Linux UNIX and Windows allows remote authenticated users to cause a denial of service (daemon crash) by specifying an identity column within a crafted ALTER TABLE statement.


The __udf_read_inode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection which allows physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode.


Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows remote attackers to cause a denial of service (reboot) via a crafted TrueType font aka \Denial of Service in Windows Kernel Mode Driver Vulnerability.\


IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6 6.0 SP2 before EP26 6.0.4 before 6.0.4.6 and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts which makes it easier for remote attackers to cause a denial of service (web-service outage) by making many login attempts with a valid caseworker account name.


The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 do not properly detect recursion during entity expansion which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document containing a large number of nested entity references a similar issue to CVE-2003-1564.


cgi-bin/AZ_Retrain.cgi in Aztech ADSL DSL5018EN (1T1R) DSL705E and DSL705EU devices does not check for authentication which allows remote attackers to cause a denial of service (WAN connectivity reset) via a direct request.


Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6 when using the res_fax_spandsp module allows remote authenticated users to cause a denial of service (crash) via an out of call message which is not properly handled in the ReceiveFax dialplan application.


net/ceph/auth_x.c in Ceph as used in the Linux kernel before 3.16.3 does not properly validate auth replies which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via crafted data from the IP address of a Ceph Monitor.


Off-by-one error in the is_rtsp_request_or_reply function in epan/dissectors/packet-rtsp.c in the RTSP dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet that triggers parsing of a token located one position beyond the current position.


The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier allows remote attackers to cause a denial of service (divide-by-zero error and server crash) via a zero value in the scaling factor in a (1) PalmVNCSetScaleFactor or (2) SetScale message.


The Juniper MX Series routers with Junos 13.3R3 through 13.3Rx before 13.3R6 14.1 before 14.1R4 14.1X50 before 14.1X50-D70 and 14.2 before 14.2R2 when configured as a broadband edge (BBE) router allows remote attackers to cause a denial of service (jpppd crash and restart) by sending a crafted PAP Authenticate-Request after the PPPoE Discovery and LCP phase are complete.


Juniper

Junos

before

before

before

before

before

before

before

before

before

and

before

allows

remote

attackers

to

cause

a

denial

of

service

(assertion

failure

and

rpd

restart)

via

a

crafted

BGP

FlowSpec

prefix.


The tvb_raw_text_add function in epan/dissectors/packet-megaco.c in the MEGACO dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (infinite loop) via an empty line.


Juniper JunosE before 13.3.3p0-1 14.x before 14.3.2 and 15.x before 15.1.0 when DEBUG severity icmpTraffic logging is enabled allows remote attackers to cause a denial of service (SRP reset) via a crafted ICMP packet to the (1) interface or (2) loopback IP address which triggers a processor exception in ip_RxData_8.


An unspecified endpoint in Zenoss Core through 5 Beta 3 allows remote attackers to cause a denial of service (CPU consumption) by triggering an arbitrary regular-expression match attempt aka ZEN-15411.


Multiple XML External Entity (XXE) vulnerabilities in the Configuration utility in F5 BIG-IP LTM ASM GTM and Link Controller 11.0 through 11.6.0 and 10.0.0 through 10.2.4 AAM 11.4.0 through 11.6.0 ARM 11.3.0 through 11.6.0 Analytics 11.0.0 through 11.6.0 APM and Edge Gateway 11.0.0 through 11.6.0 and 10.1.0 through 10.2.4 PEM 11.3.0 through 11.6.0 PSM 11.0.0 through 11.4.1 and 10.0.0 through 10.2.4 and WOM 11.0.0 through 11.3.0 and 10.0.0 through 10.2.4 and Enterprise Manager 3.0.0 through 3.1.1 and 2.1.0 through 2.3.0 allow remote authenticated users to read arbitrary files and cause a denial of service via a crafted request as demonstrated using (1) viewList or (2) deal elements.


Juniper Junos OS before 12.1X44-D50 12.1X46 before 12.1X46-D35 12.1X47 before 12.1X47-D25 12.3 before 12.3R10 12.3X48 before 12.3X48-D15 13.2 before 13.2R8 13.3 before 13.3R7 14.1 before 14.1R5 and 14.2 before 14.2R1 do not properly handle TCP packet reassembly which allows remote attackers to cause a denial of service (buffer consumption) via a crafted sequence of packets \destined to the device.\


J-Web in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service (system reboot) via unspecified vectors.


Juniper

Junos

OS

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before

when

configured

for

allow

remote

attackers

to

cause

a

denial

of

service

(mbuf

chain

corruption

and

kernel

panic)

via

crafted

packets.


The dissect_hip_tlv function in epan/dissectors/packet-hip.c in the HIP dissector in Wireshark 1.12.x before 1.12.1 does not properly handle a NULL tree which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


net/ceph/auth_x.c in Ceph as used in the Linux kernel before 3.16.3 does not properly consider the possibility of kmalloc failure which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a long unencrypted auth ticket.


The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of service by resetting the DHO_OPTIONSOVERLOADED option in the (1) bootfile or (2) servername section which triggers the option to be processed again.


Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3 11.2.0.4 12.1.0.1 and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the original researcher's claim that this is an XML external entity (XXE) vulnerability in the XML parser which allows attackers to conduct internal port scanning perform SSRF attacks or cause a denial of service via a crafted (1) http: or (2) ftp: URI.


IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote authenticated users to cause a denial of service (disrupted system operations) by uploading a file to a protected area.


The SSHParseBanner function in SSH parser (app-layer-ssh.c) in Suricata before 2.0.4 allows remote attackers to bypass SSH rules cause a denial of service (crash) or possibly have unspecified other impact via a crafted banner which triggers a large memory allocation or an out-of-bounds write.


The SDP dissector in Wireshark 1.10.x before 1.10.10 creates duplicate hashtables for a media channel which allows remote attackers to cause a denial of service (application crash) via a crafted packet to the RTP dissector.


Zenoss Core through 5 Beta 3 does not properly detect recursion during entity expansion which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references aka ZEN-15414 a similar issue to CVE-2003-1564.


The evtchn_fifo_set_pending function in Xen 4.4.x allows local guest users to cause a denial of service (host crash) via vectors involving an uninitialized FIFO-based event channel control block when (1) binding or (2) moving an event to a different VCPU.


Unspecified vulnerability in OpenConnect before 2.23 allows remote AnyConnect SSL VPN servers to cause a denial of service (application crash) via a 404 HTTP status code.


The KVM implementation in the Linux kernel before 2.6.36 does not properly reload the FS and GS segment registers which allows host OS users to cause a denial of service (host OS crash) via a KVM_RUN ioctl call in conjunction with a modified Local Descriptor Table (LDT).


named in ISC BIND 9.6.2 before 9.6.2-P3 9.6-ESV before 9.6-ESV-R3 and 9.7.x before 9.7.2-P3 does not properly handle the combination of signed negative responses and corresponding RRSIG records in the cache which allows remote attackers to cause a denial of service (daemon crash) via a query for cached data.


The sctp_packet_config function in net/sctp/output.c in the Linux kernel before 2.6.35.6 performs extraneous initializations of packet data structures which allows remote attackers to cause a denial of service (panic) via a certain sequence of SCTP traffic.


Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by creating temporary tables with nullable columns while using InnoDB which triggers an assertion failure.


drivers/platform/x86/thinkpad_acpi.c in the Linux kernel before 2.6.34 on ThinkPad devices when the X.Org X server is used does not properly restrict access to the video output control state which allows local users to cause a denial of service (system hang) via a (1) read or (2) write operation.


Unspecified vulnerability in MySQL 5.0 before 5.0.92 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via vectors related to \materializing a derived table that required a temporary table for grouping\ and \user variable assignments.\


MySQL 5.0 before 5.0.92 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a query that uses the (1) GREATEST or (2) LEAST function with a mixed list of numeric and LONGBLOB arguments which is not properly handled when the function's result is \processed using an intermediate temporary table.\


lib/MessageStoreImpl.cpp in Red Hat Enterprise MRG before 1.2.2 allows remote authenticated users to cause a denial of service (stack memory exhaustion and broker crash) via a large persistent message.


Dswsbobje in SAP BusinessObjects Enterprise XI 3.2 does not limit the number of CUIDs that may be requested which allows remote authenticated users to cause a denial of service via a large numCuids value in a GenerateCuids SOAPAction to the dswsbobje/services/biplatform URI.


The GetStringAMSHandler function in prgxhndl.dll in hndlrsvc.exe in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (AMS) as used in Symantec Antivirus Corporate Edition 10.1.4.4010 on Windows 2000 SP4 and Symantec Endpoint Protection before 11.x does not properly validate the CommandLine field of an AMS request which allows remote attackers to cause a denial of service (application crash) via a crafted request.


Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot).


The _CalcHashValueWithLength function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 does not properly validate an unspecified length value which allows remote attackers to cause a denial of service (daemon crash) by sending data over TCP. NOTE: this might overlap CVE-2010-3060.


Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via certain arguments to the BINLOG command which triggers an access of uninitialized memory as demonstrated by valgrind.


MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (infinite loop) via multiple invocations of a (1) prepared statement or (2) stored procedure that creates a query with nested JOIN statements.


Unspecified vulnerability in FreeType 2.3.9 and other versions before 2.4.2 allows remote attackers to cause a denial of service via vectors involving nested Standard Encoding Accented Character (aka seac) calls related to psaux.h cffgload.c cffgload.h and t1decode.c.


ISC BIND before 9.7.2-P2 when DNSSEC validation is enabled does not properly handle certain bad signatures if multiple trust anchors exist for a single zone which allows remote attackers to cause a denial of service (daemon crash) via a DNS query.


The \Query Compiler Rewrite Optimizer\ component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted query involving certain UNION ALL views leading to an indefinitely large amount of compilation time.


Cisco Unified Personal Communicator 7.0 (1.13056) does not free allocated memory for received data and does not perform validation if memory allocation is successful causing a remote denial of service condition.


Cisco IOS before 12.2(33)SXI allows remote authenticated users to cause a denial of service (device reboot).


IBM DB2 9.7 before FP2 when AUTO_REVAL is IMMEDIATE allows remote authenticated users to cause a denial of service (loss of privileges) to a view owner by defining a dependent view.


Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (crash) via (1) IN or (2) CASE operations with NULL arguments that are explicitly specified or indirectly provided by the WITH ROLLUP modifier.


Memory leak in Adobe Flash Media Server (FMS) 3.0.x before 3.0.7 3.5.x before 3.5.5 and 4.0.x before 4.0.1 allows attackers to cause a denial of service (memory consumption) via unspecified vectors.


Unspecified vulnerability in the message-protocol implementation in the Mount service in IBM Tivoli Storage Manager (TSM) FastBack 5.x.x before 5.5.7 and 6.1.0.0 allows remote attackers to cause a denial of service (recovery failure) and possibly trigger loss of data via unknown vectors.


Stack consumption vulnerability in the filter_var function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 when FILTER_VALIDATE_EMAIL mode is used allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string.


The

org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run

method

in

JBoss

Remoting

before

and

before

in

Red

Hat

JBoss

Enterprise

Application

Platform

(aka

JBoss

EAP

or

JBEAP)

through

and

and

JBoss

Enterprise

Web

Platform

(aka

JBEWP)

allows

remote

attackers

to

cause

a

denial

of

service

(daemon

outage)

by

establishing

a

bisocket

control

connection

TCP

session

and

then

not

sending

any

application

data.


Microsoft Exchange Server 2007 SP2 on the x64 platform allows remote authenticated users to cause a denial of service (infinite loop and MSExchangeIS outage) via a crafted RPC request aka \Exchange Server Infinite Loop Vulnerability.\


The WebSockets implementation in Google Chrome before 6.0.472.53 does not properly handle integer values which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


ISC DHCP server 4.2 before 4.2.0-P2 when configured to use failover partnerships allows remote attackers to cause a denial of service (communications-interrupted state and DHCP client service loss) by connecting to a port that is only intended for a failover peer as demonstrated by a Nagios check_tcp process check to TCP port 520.


Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl call.


Double free vulnerability in the snd_seq_oss_open function in sound/core/seq/oss/seq_oss_init.c in the Linux kernel before 2.6.36-rc4 might allow local users to cause a denial of service or possibly have unspecified other impact via an unsuccessful attempt to open the /dev/sequencer device.


The backend driver in Xen 3.x allows guest OS users to cause a denial of service via a kernel thread leak which prevents the device and guest OS from being shut down or create a zombie domain causes a hang in zenwatch or prevents unspecified xm commands from working properly related to (1) netback (2) blkback or (3) blktap.


Hyper-V in Microsoft Windows Server 2008 Gold SP2 and R2 allows guest OS users to cause a denial of service (host OS hang) by sending a crafted encapsulated packet over the VMBus aka \Hyper-V VMBus Vulnerability.\


Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using the HANDLER interface and performing \alternate reads from two indexes on a table \ which triggers an assertion failure.


MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (mysqld server crash) by performing a user-variable assignment in a logical expression that is calculated and stored in a temporary table for GROUP BY then causing the expression value to be used after the table is created which causes the expression to be re-evaluated instead of accessing its value from the table.


IBM OmniFind Enterprise Edition 8.x and 9.x performs web crawls with an unlimited recursion depth which allows remote web servers to cause a denial of service (infinite loop) via a crafted series of documents.


The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5 poppler 0.8.7 and possibly other versions up to 0.15.1 CUPS kdegraphics and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference.


Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages which allows remote attackers to cause a denial of service (CPU consumption) via a large message a different vulnerability than CVE-2010-2080.


The wait_for_child_to_die function in main/event.c in FreeRADIUS 2.1.x before 2.1.10 in certain circumstances involving long-term database outages does not properly handle long queue times for requests which allows remote attackers to cause a denial of service (daemon crash) by sending many requests.


Memory leak in the Relational Data Services component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service (heap memory consumption) by executing a (1) user-defined function (UDF) or (2) stored procedure while using a different code page than the database server.


ctcphandler.cpp in Quassel before 0.6.3 and 0.7.x before 0.7.1 allows remote attackers to cause a denial of service (unresponsive IRC) via multiple Client-To-Client Protocol (CTCP) requests in a PRIVMSG message.


A certain ActiveX control in ienipp.ocx in the browser plugin in Novell iPrint Client before 5.42 does not properly restrict the set of files to be deleted which allows remote attackers to cause a denial of service (recursive file deletion) via unspecified vectors related to a \logic flaw\ in the CleanUploadFiles method in the nipplib.dll module.


storage/innobase/dict/dict0crea.c in mysqld in Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (assertion failure) by modifying the (1) innodb_file_format or (2) innodb_file_per_table configuration parameters for the InnoDB storage engine then executing a DDL statement.


include/asm-x86/futex.h in the Linux kernel before 2.6.25 does not properly implement exception fixup which allows local users to cause a denial of service (panic) via an invalid application that triggers a page fault.


ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service (crash of worker threads) via vectors that trigger uncaught exceptions.


MySQL 5.0 before 5.0.92 5.1 before 5.1.51 and 5.5 before 5.5.6 does not properly propagate type errors which allows remote attackers to cause a denial of service (server crash) via crafted arguments to extreme-value functions such as (1) LEAST and (2) GREATEST related to KILL_BAD_DATA and a \CREATE TABLE ... SELECT.\


named in ISC BIND 9.x before 9.6.2-P3 9.7.x before 9.7.2-P3 9.4-ESV before 9.4-ESV-R4 and 9.6-ESV before 9.6-ESV-R3 does not properly determine the security status of an NS RRset during a DNSKEY algorithm rollover which might allow remote attackers to cause a denial of service (DNSSEC validation error) by triggering a rollover.


Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 sends an OK packet when a LOAD DATA INFILE request generates SQL errors which allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a crafted request.


MySQL 5.0 before 5.0.92 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a prepared statement that uses GROUP_CONCAT with the WITH ROLLUP modifier probably triggering a use-after-free error when a copied object is modified in a way that also affects the original object.


Unspecified vulnerability in the Oracle Communications Messaging Server (Sun Java System Messaging Server) component in Oracle Sun Products Suite 7.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Webmail. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that the Kerberos implementation does not properly check AP-REQ requests which allows attackers to cause a denial of service in the JVM. NOTE: CVE has not investigated the apparent discrepancy between the two vendors regarding the consequences of this issue.


Google Chrome before 5.0.375.127 does not properly implement the notifications feature which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via unknown vectors.


Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a join query that uses a table with a unique SET column.


Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by simultaneously disconnecting many (1) IMAP or (2) POP3 sessions.


The Net Search Extender (NSE) implementation in the Text Search component in IBM DB2 UDB 9.5 before FP6a does not properly handle an alphanumeric Fuzzy search which allows remote authenticated users to cause a denial of service (memory consumption and system hang) via the db2ext.textSearch function.


The extension parser in slp_v2message.c in OpenSLP 1.2.1 and other versions before SVN revision 1647 as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1 allows remote attackers to cause a denial of service (infinite loop) via a packet with a \next extension offset\ that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.


sys/ssl/SslSocket.cpp in qpidd in Apache Qpid as used in Red Hat Enterprise MRG before 1.2.2 and other products when SSL is enabled allows remote attackers to cause a denial of service (daemon outage) by connecting to the SSL port but not participating in an SSL handshake.


The t3lib_div::validEmail function in TYPO3 4.2.x before 4.2.15 4.3.x before 4.3.7 and 4.4.x before 4.4.4 does not properly restrict input to filter_var FILTER_VALIDATE_EMAIL operations in PHP which allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string a related issue to CVE-2010-3710.


Unspecified vulnerability in HP Data Protector Express and Data Protector Express Single Server Edition (SSE) 3.x before build 56936 and 4.x before build 56906 on Windows allows local users to gain privileges or cause a denial of service via unknown vectors a different vulnerability than CVE-2010-3007.


The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function and does not have accompanying documentation describing how daemon applications should handle unsuccessful calls to the accept function which makes it easier for remote attackers to conduct denial of service attacks that terminate these applications via network connections.


The Secure Channel (aka SChannel) security package in Microsoft Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 when IIS 7.x is used does not properly process client certificates during SSL and TLS handshakes which allows remote attackers to cause a denial of service (LSASS outage and reboot) via a crafted packet aka \TLSv1 Denial of Service Vulnerability.\


MySQL 5.0 before 5.0.92 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (assertion failure and server crash) via vectors related to view preparation pre-evaluation of LIKE predicates and IN Optimizers.


The PostScriptFunction::PostScriptFunction function in poppler/Function.cc in the PDF parser in poppler 0.8.7 and possibly other versions up to 0.15.1 and possibly other products allows context-dependent attackers to cause a denial of service (crash) via a PDF file that triggers an uninitialized pointer dereference.


Cisco IOS XR 3.4.0 through 3.9.1 when BGP is enabled does not properly handle unrecognized transitive attributes which allows remote attackers to cause a denial of service (peering reset) via a crafted prefix announcement as demonstrated in the wild in August 2010 with attribute type code 99 aka Bug ID CSCti62211.


The Gis_line_string::init_from_wkb function in sql/spatial.cc in MySQL 5.1 before 5.1.51 allows remote authenticated users to cause a denial of service (server crash) by calling the PolyFromWKB function with Well-Known Binary (WKB) data containing a crafted number of (1) line strings or (2) line points.


The DRDA Services component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service (database server ABEND) by using the client CLI on Linux UNIX or Windows for executing a prepared statement with a large number of parameter markers.


The fr_dhcp_decode function in lib/dhcp.c in FreeRADIUS 2.1.9 in certain non-default builds does not properly handle the DHCP Relay Agent Information option which allows remote attackers to cause a denial of service (infinite loop and daemon outage) via a packet that has more than one sub-option. NOTE: some of these details are obtained from third party information.


net/ipv4/inet_diag.c in the Linux kernel before 2.6.37-rc2 does not properly audit INET_DIAG bytecode which allows local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message that contains multiple attribute elements as demonstrated by INET_DIAG_BC_JMP instructions.


The setup_arg_pages function in fs/exec.c in the Linux kernel before 2.6.36 when CONFIG_STACK_GROWSDOWN is used does not properly restrict the stack memory consumption of the (1) arguments and (2) environment for a 32-bit application on a 64-bit platform which allows local users to cause a denial of service (system crash) via a crafted exec system call a related issue to CVE-2010-2240.


Memory leak in the Relational Data Services component in IBM DB2 UDB 9.5 before FP6a when the connection concentrator is enabled allows remote authenticated users to cause a denial of service (heap memory consumption) by using a different code page than the database server.


bdf/bdflib.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) via a crafted BDF font file related to an attempted modification of a value in a static string.


Google Chrome before 6.0.472.59 on Linux does not properly handle cursors which might allow attackers to cause a denial of service (assertion failure) via unspecified vectors.


Unspecified vulnerability in the FTP Server in Oracle Solaris 8 9 10 and 11 Express allows remote attackers to affect availability. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable researcher that this is an issue in the glob implementation in libc that allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames.


Unspecified vulnerability on the Cisco Application Control Engine (ACE) Module with software A2(1.x) before A2(1.6) A2(2.x) before A2(2.3) and A2(3.x) before A2(3.1) for Catalyst 6500 series switches and 7600 series routers allows remote attackers to cause a denial of service (device reload) via a sequence of SSL packets aka Bug ID CSCta20756.


Unspecified vulnerability in the Transport Layer Security (TLS) implementation on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 before 7.2(5) 8.0 before 8.0(5.15) 8.1 before 8.1(2.44) 8.2 before 8.2(2.17) and 8.3 before 8.3(1.6) and Cisco PIX Security Appliances 500 series devices allows remote attackers to cause a denial of service (device reload) via a sequence of crafted TLS packets aka Bug ID CSCtf55259.


Virtual Desktop Server Manager (VDSM) in Red Hat Enterprise Virtualization (RHEV) 2.2 does not properly accept TCP connections for SSL sessions which allows remote attackers to cause a denial of service (daemon outage) via crafted SSL traffic.


SolarWinds TFTP Server 10.4.0.13 allows remote attackers to cause a denial of service (crash) via a long write request.


Unspecified vulnerability in the SunRPC inspection feature on the Cisco Firewall Services Module (FWSM) with software 3.1 before 3.1(17.2) 3.2 before 3.2(16.1) 4.0 before 4.0(10.1) and 4.1 before 4.1(1.1) for Catalyst 6500 series switches and 7600 series routers allows remote attackers to cause a denial of service (device reload) via crafted SunRPC messages aka Bug ID CSCte61662.


Apache Tomcat 5.5.0 through 5.5.29 6.0.0 through 6.0.27 and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with \recycling of a buffer.\


Microsoft Internet Explorer 6.0.2900.2180 and 8.0.7600.16385 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid news:// URIs.


The SendCombinedStatusInfo implementation in Cisco Unified Communications Manager (aka CUCM formerly CallManager) 7.0SU before 7.0(2a)SU3 7.1 before 7.1(5) and 8.0 before 8.0(3) allows remote attackers to cause a denial of service (process failure) via a malformed SIP REGISTER message aka Bug ID CSCtf66305.


Cisco IOS 12.2 through 12.4 and 15.0 through 15.1 Cisco IOS XE 2.5.x and 2.6.x before 2.6.1 and Cisco Unified Communications Manager (aka CUCM formerly CallManager) 6.x before 6.1(5)SU1 7.x before 7.1(5) and 8.0 before 8.0(2) allow remote attackers to cause a denial of service (device reload or voice-services outage) via crafted SIP registration traffic over UDP aka Bug IDs CSCtf72678 and CSCtf14987.


arch/ia64/xen/faults.c in Xen 3.4 and 4.0 in Linux kernel 2.6.18 and possibly other kernel versions when running on IA-64 architectures allows local users to cause a denial of service and \turn on BE by modifying the user mask of the PSR \ as demonstrated via exploitation of CVE-2006-0742.


The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4 when HAVE_GSSAPI is omitted does not properly handle a demand for authorization which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTP_UNAUTHORIZED responses.


The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2 as used in tiff2ps allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image related to \downsampled OJPEG input.\


Memory leak in pngrutil.c in libpng before 1.2.44 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks.


transports/appendfile.c in Exim before 4.72 when a world-writable sticky-bit mail directory is used does not verify the st_nlink field of mailbox files which allows local users to cause a denial of service or possibly gain privileges by creating a hard link to another user's file.


The NetworkSyncCommandQueue function in network/network_command.cpp in OpenTTD before 1.0.3 does not properly clear a pointer in a linked list which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted request related to the client command queue.


Soft SaschArt SasCAM Webcam Server 2.6.5 2.7 and earlier allows remote attackers to cause a denial of service (crash) via a large number of requests with a long line as demonstrated using a long GET request.


Stack consumption vulnerability in the SMB Server in Microsoft Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 allows remote attackers to cause a denial of service (system hang) via a malformed SMBv2 compounded request aka \SMB Stack Exhaustion Vulnerability.\


The IGMPv3 implementation in Cisco IOS 12.2 12.3 12.4 and 15.0 and IOS XE 2.5.x before 2.5.2 when PIM is enabled allows remote attackers to cause a denial of service (device reload) via a malformed IGMP packet aka Bug ID CSCte14603.


Adobe Flash Player 9 before 9.0.277.0 on unspecified UNIX platforms allows attackers to cause a denial of service via unknown vectors.


Unspecified vulnerability in the SunRPC inspection feature on the Cisco Firewall Services Module (FWSM) with software 3.1 before 3.1(17.2) 3.2 before 3.2(16.1) 4.0 before 4.0(10.1) and 4.1 before 4.1(1.1) for Catalyst 6500 series switches and 7600 series routers allows remote attackers to cause a denial of service (device reload) via crafted SunRPC messages aka Bug ID CSCte61622.


Multiple integer signedness errors in smb_subr.c in the netsmb module in the kernel in NetBSD 5.0.2 and earlier FreeBSD and Apple Mac OS X allow local users to cause a denial of service (panic) via a negative size value in a /dev/nsmb ioctl operation as demonstrated by a (1) SMBIOC_LOOKUP or (2) SMBIOC_OPENSESSION ioctl call.


Unspecified vulnerability in the H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 and IOS XE 2.5.x before 2.5.2 and 2.6.x before 2.6.1 allows remote attackers to cause a denial of service (device reload) via crafted H.323 packets aka Bug ID CSCtc73759.


SolarWinds TFTP Server 10.4.0.10 allows remote attackers to cause a denial of service (no new connections) via a crafted read request.


Cisco IOS 12.2 through 12.4 and 15.0 through 15.1 Cisco IOS XE 2.5.x and 2.6.x before 2.6.1 and Cisco Unified Communications Manager (aka CUCM formerly CallManager) 6.x before 6.1(5) 7.0 before 7.0(2a)su3 7.1su before 7.1(3b)su2 7.1 before 7.1(5) and 8.0 before 8.0(1) allow remote attackers to cause a denial of service (device reload or voice-services outage) via a SIP REFER request with an invalid Refer-To header aka Bug IDs CSCta20040 and CSCta31358.


dns_internal.cc in Squid 3.1.6 when IPv6 DNS resolution is not enabled accesses an invalid socket during an IPv4 TCP DNS query which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via vectors that trigger an IPv4 DNS response with the TC bit set.


fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel before 2.6.34-rc4 allows remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value as demonstrated by a response from an OS/2 server related to the CIFSSMBWrite and CIFSSMBWrite2 functions.


The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2 makes incorrect calls to the TIFFGetField function which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image related to \downsampled OJPEG input\ and possibly related to a compiler optimization that triggers a divide-by-zero error.


Google Chrome 1.0.154.48 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid news:// URIs.


The MS-ZIP decompressor in cabextract before 1.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed MSZIP archive in a .cab file during a (1) test or (2) extract action related to the libmspack library.


Unspecified vulnerability in ping.c in iputils 20020927 20070202 20071127 and 20100214 on Mandriva Linux allows remote attackers to cause a denial of service (hang) via a crafted echo response.


The ReadMetaFromId3v2 function in taglib.cpp in the TagLib plugin in VideoLAN VLC media player 0.9.0 through 1.1.2 does not properly process ID3v2 tags which allows remote attackers to cause a denial of service (application crash) via a crafted media file.


Unspecified vulnerability in the SunRPC inspection feature on the Cisco Firewall Services Module (FWSM) with software 3.1 before 3.1(17.2) 3.2 before 3.2(16.1) 4.0 before 4.0(10.1) and 4.1 before 4.1(1.1) for Catalyst 6500 series switches and 7600 series routers allows remote attackers to cause a denial of service (device reload) via crafted SunRPC messages aka Bug ID CSCte61710.


The HTTP Channel in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 allows remote attackers to cause a denial of service (NullPointerException) via a large amount of chunked data that uses gzip compression.


Unspecified vulnerability in the H.323 implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 and IOS XE 2.5.x before 2.5.2 and 2.6.x before 2.6.1 allows remote attackers to cause a denial of service (traceback and device reload) via crafted H.323 packets aka Bug ID CSCtd33567.


Unspecified vulnerability in the SIP inspection feature on the Cisco Application Control Engine (ACE) Module with software A2(1.x) before A2(1.6) A2(2.x) before A2(2.3) and A2(3.x) before A2(3.1) for Catalyst 6500 series switches and 7600 series routers and the Cisco Application Control Engine (ACE) 4710 appliance with software before A3(2.4) allows remote attackers to cause a denial of service (device reload) via crafted SIP packets over (1) TCP or (2) UDP aka Bug IDs CSCta65603 and CSCta71569.


Unspecified vulnerability in the Transport Layer Security (TLS) implementation on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 before 7.2(5) 8.0 before 8.0(5.15) 8.1 before 8.1(2.44) 8.2 before 8.2(2.17) and 8.3 before 8.3(1.6) and Cisco PIX Security Appliances 500 series devices allows remote attackers to cause a denial of service (device reload) via a sequence of crafted TLS packets aka Bug ID CSCtf37506.


ISC DHCP 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1 allows remote attackers to cause a denial of service (server exit) via a zero-length client ID.


The npb_protocol_error function in sna V5router64 in IBM Communications Server for Windows 6.1.3 and Communications Server for AIX (aka CSAIX or CS/AIX) in sna.rte before 6.3.1.2 allows remote attackers to cause a denial of service (daemon crash) via APPC data containing a GDSID variable with a GDS length that is too small.


The AvahiDnsPacket function in avahi-core/socket.c in avahi-daemon in Avahi 0.6.16 and 0.6.25 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNS packet with an invalid checksum followed by a DNS packet with a valid checksum a different vulnerability than CVE-2008-5081.


Unspecified vulnerability on the Cisco Firewall Services Module (FWSM) with software 3.2 before 3.2(17.2) 4.0 before 4.0(11.1) and 4.1 before 4.1(1.2) for Catalyst 6500 series switches and 7600 series routers when multi-mode is enabled allows remote attackers to cause a denial of service (device reload) via crafted (1) Telnet (2) SSH or (3) ASDM traffic over TCP aka Bug ID CSCtg68694.


The slapi_printmessage function in IBM Tivoli Directory Server (ITDS) before 6.0.0.8-TIV-ITDS-IF0006 allows remote attackers to cause a denial of service (daemon crash) via multiple incomplete DIGEST-MD5 connection attempts.


Microsoft Internet Explorer 6.0.2900.2180 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid nntp:// URIs.


Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via certain HTML content that has an unclosed SPAN element with absolute positioning.


The QSslSocketBackendPrivate::transmit function in src_network_ssl_qsslsocket_openssl.cpp in Qt 4.6.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a malformed request.


The SIPStationInit implementation in Cisco Unified Communications Manager (aka CUCM formerly CallManager) 6.1SU before 6.1(5)SU1 7.0SU before 7.0(2a)SU3 7.1SU before 7.1(3b)SU2 7.1 before 7.1(5) and 8.0 before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SIP message aka Bug ID CSCtd17310.


The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2 as used in ImageMagick does not properly handle invalid ReferenceBlackWhite values which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers an array index error related to \downsampled OJPEG input.\


The IPMI dissector in Wireshark 1.2.0 through 1.2.9 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.


The SMB Server in Microsoft Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 does not properly validate an internal variable in an SMB packet which allows remote attackers to cause a denial of service (system hang) via a crafted (1) SMBv1 or (2) SMBv2 packet aka \SMB Variable Validation Vulnerability.\


Weborf HTTP Server 0.12.1 and earlier allows remote attackers to cause a denial of service (crash) via Unicode characters in a Connection HTTP header and possibly other headers.


Impact Financials Inc. Impact PDF Reader 2.0 1.2 and other versions for iPhone and iPod touch allows remote attackers to cause a denial of service (server crash) via a \...\ body in a POST request.


Unspecified vulnerability in the Client Service for DPM in Hitachi ServerConductor / Deployment Manager 01-00 01-01 and 06-00 through 06-00-/A; ServerConductor / Deployment Manager Standard Edition and Enterprise Edition 07-50 through 07-55 and 07-57 through 07-59; and JP1/ServerConductor/Deployment Manager Standard and Enterprise Edition 07-50 through 07-56-/F 08-00 through 08-09-/E 08-50 through 08-80-/A 08-06 through 08-07 and 08-51 through 08-70; allows attackers to cause a denial of service (shutdown and reboot) via unknown vectors.


Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2 and Server 2008 Gold and SP2 allows local users to gain privileges or cause a denial of service (system crash) by using a large number of calls to the NtUserCheckAccessForIntegrityLevel function to trigger a failure in the LockProcessByClientId function leading to deletion of an in-use process object aka \Win32k Reference Count Vulnerability.\


transports/appendfile.c in Exim before 4.72 when MBX locking is enabled allows local users to change permissions of arbitrary files or create arbitrary files and cause a denial of service or possibly gain privileges via a symlink attack on a lockfile in /tmp/.


Bugzilla 2.23.1 through 3.2.7 3.3.1 through 3.4.7 3.5.1 through 3.6.1 and 3.7 through 3.7.2 when PostgreSQL is used does not properly handle large integers in (1) bug and (2) attachment phrases which allows remote authenticated users to cause a denial of service (bug invisibility) via a crafted comment.


FreeBSD 7.1 through 8.1-PRERELEASE does not copy the read-only flag when creating a duplicate mbuf buffer reference which allows local users to cause a denial of service (system file corruption) and gain privileges via the sendfile system call.


Cisco IOS 15.1(2)T allows remote attackers to cause a denial of service (resource consumption and TCP outage) via spoofed TCP packets related to embryonic TCP connections that remain in the SYN_RCVD or SYN_SENT state aka Bug ID CSCti18193.


LibTIFF 3.9.0 ignores tags in certain situations during the first stage of TIFF file processing and does not properly handle this during the second stage which allows remote attackers to cause a denial of service (application crash) via a crafted file a different vulnerability than CVE-2010-2481.


Unspecified vulnerability in the SIP inspection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.0 before 8.0(5.17) 8.1 before 8.1(2.45) and 8.2 before 8.2(2.13) allows remote attackers to cause a denial of service (device reload) via crafted SIP packets aka Bug ID CSCtd32106.


The workgroup bridge (aka WGB) functionality in Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 allows remote attackers to cause a denial of service (dropped connection) via a series of spoofed EAPoL-Logoff frames related to an \EAPoL logoff attack \ aka Bug ID CSCte43374.


Client.cpp in ZNC 0.092 allows remote attackers to cause a denial of service (exception and daemon crash) via a PING command that lacks an argument.


Unspecified vulnerability in the deep packet inspection feature on the Cisco Application Control Engine (ACE) 4710 appliance with software before A3(2.6) allows remote attackers to cause a denial of service (device reload) via crafted HTTP packets related to HTTP RTSP and SIP inspection aka Bug ID CSCtb54493.


Unspecified vulnerability in Research In Motion (RIM) BlackBerry Device Software before 6.0.0 allows remote attackers to cause a denial of service (browser hang) via a crafted web page.


The SigComp Universal Decompressor Virtual Machine dissector in Wireshark 0.10.7 through 1.0.13 and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.


Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 4.2 before 4.2.209.0; 4.2M before 4.2.207.54M; 5.0 5.1 and 6.0 before 6.0.196.0; and 5.2 before 5.2.193.11 allows remote authenticated users to cause a denial of service (device reload) via crafted HTTP packets that trigger invalid arguments to the emweb component aka Bug ID CSCtd16938.


The TIFFReadDirectory function in LibTIFF 3.9.0 does not properly validate the data types of codec-specific tags that have an out-of-order position in a TIFF file which allows remote attackers to cause a denial of service (application crash) via a crafted file a different vulnerability than CVE-2010-2481.


mod_ibm_ssl in IBM HTTP Server 6.0 before 6.0.2.43 6.1 before 6.1.0.33 and 7.0 before 7.0.0.11 as used in IBM WebSphere Application Server (WAS) on z/OS does not properly handle a large HTTP request body in uploading over SSL which might allow remote attackers to cause a denial of service (daemon fail) via an upload.


bozotic HTTP server (aka bozohttpd) 20090522 through 20100512 allows attackers to cause a denial of service via vectors related to a \wrong code generation interaction with GCC.\


Unspecified vulnerability in the IKE implementation on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.0 before 7.0(8.11) 7.1 and 7.2 before 7.2(5) 8.0 before 8.0(5.15) 8.1 before 8.1(2.44) 8.2 before 8.2(2.10) and 8.3 before 8.3(1.1) and Cisco PIX Security Appliances 500 series devices allows remote attackers to cause a denial of service (device reload) via a crafted IKE message aka Bug ID CSCte46507.


arch/x86/hvm/vmx/vmcs.c in the virtual-machine control structure (VMCS) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 when an Intel platform without Extended Page Tables (EPT) functionality is used accesses VMCS fields without verifying hardware support for these fields which allows local users to cause a denial of service (host OS crash) by requesting a VMCS dump for a fully virtualized Xen guest.


Use-after-free vulnerability in the request shutdown functionality in PHP 5.2 before 5.2.13 and 5.3 before 5.3.2 allows context-dependent attackers to cause a denial of service (crash) via a stream context structure that is freed before destruction occurs.


Opera before 10.60 allows remote attackers to cause a denial of service (application hang) via an ended event handler that changes the SRC attribute of an AUDIO element.


The cluster logical volume manager daemon (clvmd) in lvm2-cluster in LVM2 before 2.02.72 as used in Red Hat Global File System (GFS) and other products does not verify client credentials upon a socket connection which allows local users to cause a denial of service (daemon exit or logical-volume change) or possibly have unspecified other impact via crafted control commands.


Citrix XenServer 5.0 Update 2 and earlier and 5.5 Update 1 and earlier when using a pvops kernel allows guest users to cause a denial of service in the host via unspecified vectors that trigger \incorrectly set flags.\


Google Chrome before 5.0.375.99 does not properly implement modal dialogs which allows attackers to cause a denial of service (application crash) via unspecified vectors.


functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames leading to the creation of many preferences files.


Unspecified vulnerability in the RTSP inspection feature on the Cisco Application Control Engine (ACE) Module with software before A2(3.2) for Catalyst 6500 series switches and 7600 series routers and the Cisco Application Control Engine (ACE) 4710 appliance with software before A3(2.6) allows remote attackers to cause a denial of service (device reload) via crafted RTSP packets over TCP aka Bug IDs CSCta85227 and CSCtg14858.


LibTIFF in Red Hat Enterprise Linux (RHEL) 3 on x86_64 platforms as used in tiff2rgba attempts to process image data even when the required compression functionality is not configured which allows remote attackers to cause a denial of service via a crafted TIFF image related to \downsampled OJPEG input.\


RSA enVision before 3.7 SP1 allows remote authenticated users to cause a denial of service via unspecified vectors.


The Presence Engine (PE) service in Cisco Unified Presence 6.x before 6.0(7) and 7.x before 7.0(8) does not properly handle an erroneous Contact field in the header of a SIP SUBSCRIBE message which allows remote attackers to cause a denial of service (process failure) via a malformed message aka Bug ID CSCtd39629.


The SMTP service (MESMTPC.exe) in MailEnable 3.x and 4.25 does not properly perform a length check which allows remote attackers to cause a denial of service (crash) via a long (1) email address in the MAIL FROM command or (2) domain name in the RCPT TO command which triggers an \unhandled invalid parameter error.\


Pyftpd 0.8.4 creates log files with predictable names in a temporary directory which allows local users to cause a denial of service and obtain sensitive information.


Memory leak in the SSL VPN feature in Cisco IOS 12.4 15.0 and 15.1 when HTTP port redirection is enabled allows remote attackers to cause a denial of service (memory consumption) by improperly disconnecting SSL sessions leading to connections that remain in the CLOSE-WAIT state aka Bug ID CSCtg21685.


MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot) .. (dot dot) ../ (dot dot slash) or similar sequence and an UPGRADE DATA DIRECTORY NAME command which causes MySQL to move certain directories to the server data directory.


Galileo Students Team Weborf before 0.12.1 allows remote attackers to cause a denial of service (crash) via a crafted Range header.


The subpage MMIO initialization functionality in the subpage_register function in exec.c in QEMU-KVM as used in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and KVM 83 does not properly select the index for access to the callback array which allows guest OS users to cause a denial of service (guest OS crash) or possibly gain privileges via unspecified vectors.


The Ping tools web interface in Dlink Di-604 router allows remote authenticated users to cause a denial of service via a large \ip textfield\ size.


Apache CXF 2.0.x before 2.0.13 2.1.x before 2.1.10 and 2.2.x before 2.2.9 as used in Apache ServiceMix Apache Camel Apache Chemistry Apache jUDDI Apache Geronimo and other products does not properly reject DTDs in SOAP messages which allows remote attackers to read arbitrary files send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption) via a crafted DTD as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml a similar issue to CVE-2010-1632.


Stack

consumption

vulnerability

in

the

ChildProcessSecurityPolicy::CanRequestURL

function

in

browser/child_process_security_policy.cc

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

(memory

consumption

and

application

crash)

via

a

URL

that

specifies

multiple

protocols

as

demonstrated

by

a

URL

that

begins

with

many

repetitions

of

the

view-source:

substring.


Zeacom Chat Server before 5.1 uses too short a random string for the JSESSIONID value which makes it easier for remote attackers to hijack sessions or cause a denial of service (Chat Server crash or Tomcat daemon crash) via a brute-force attack.


The pit_ioport_read function in the Programmable Interval Timer (PIT) emulation in i8254.c in KVM 83 does not properly use the pit_state data structure which allows guest OS users to cause a denial of service (host OS crash or hang) by attempting to read the /dev/port file.


The embedded HTTP server in multiple Lexmark laser and inkjet printers and MarkNet devices including X94x W840 T656 N4000 E462 C935dn 25xxN and other models allows remote attackers to cause a denial of service (operating system halt) via a malformed HTTP Authorization header.


The kernel in Microsoft Windows Vista Gold SP1 and SP2 and Windows Server 2008 Gold and SP2 does not properly handle unspecified exceptions which allows local users to cause a denial of service (reboot) via a crafted application aka \Windows Kernel Exception Handler Vulnerability.\


The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386 platform when print-fatal-signals is enabled allows local users to discover the contents of arbitrary memory locations by jumping to an address and then reading a log file and might allow local users to cause a denial of service (system slowdown or crash) by jumping to an address.


Asterisk Open Source 1.6.0.x before 1.6.0.22 1.6.1.x before 1.6.1.14 and 1.6.2.x before 1.6.2.2 and Business Edition C.3 before C.3.3.2 allows remote attackers to cause a denial of service (daemon crash) via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is (1) missing (2) modified to contain a negative number or (3) modified to contain a large number.


Cisco Unified Communications Manager (aka CUCM formerly CallManager) 4.x before 4.3(2)SR2 6.x before 6.1(5) 7.x before 7.1(3a)su1 and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SCCP StationCapabilitiesRes message with an invalid MaxCap field aka Bug ID CSCtc38985.


BIND 9.7.1 and 9.7.1-P1 when a recursive validating server has a trust anchor that is configured statically or via DNSSEC Lookaside Validation (DLV) allows remote attackers to cause a denial of service (infinite loop) via a query for an RRSIG record whose answer is not in the cache which causes BIND to repeatedly send RRSIG queries to the authoritative servers.


gtkimhtml.c in Pidgin before 2.6.6 allows remote attackers to cause a denial of service (CPU consumption and application hang) by sending many smileys in a (1) IM or (2) chat.


client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters which allows local users to cause a denial of service (mtab corruption) via a crafted string.


The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3 code which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region a related issue to CVE-2010-0306.


The kernel in Microsoft Windows Vista Gold SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 does not properly translate a registry key's virtual path to its real path which allows local users to cause a denial of service (reboot) via a crafted application aka \Windows Virtual Path Parsing Vulnerability.\


Unspecified vulnerability in Cisco IOS 12.0 through 12.4 IOS XE 2.1.x through 2.3.x before 2.3.2 and IOS XR 3.2.x through 3.4.3 when Multiprotocol Label Switching (MPLS) and Label Distribution Protocol (LDP) are enabled allows remote attackers to cause a denial of service (device reload or process restart) via a crafted LDP packet aka Bug IDs CSCsz45567 and CSCsj25893.


The hfs implementation in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 supports hard links to directories and does not prevent certain deeply nested directory structures which allows local users to cause a denial of service (filesystem corruption) via a crafted application that calls the mkdir and link functions related to the fsck_hfs program in the diskdev_cmds component.


In xpdf the xref table contains an infinite loop which allows remote attackers to cause a denial of service (application crash) in xpdf-based PDF viewers.


The Hyper-V server implementation in Microsoft Windows Server 2008 Gold SP2 and R2 on the x64 platform allows guest OS users to cause a denial of service (host OS hang) via a crafted application that executes a malformed series of machine instructions aka \Hyper-V Instruction Set Validation Vulnerability.\


DBManager in Symantec Altiris Deployment Solution 6.9.x before DS 6.9 SP4 allows remote attackers to cause a denial of service via a crafted request.


Apple iTunes before 9.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted MP4 podcast file.


chronyd in Chrony before 1.23.1 and possibly 1.24-pre1 generates a syslog message for each unauthorized cmdmon packet which allows remote attackers to cause a denial of service (disk consumption) via a large number of invalid packets.


Event Monitor in Apple Mac OS X before 10.6.3 does not properly validate hostnames of SSH clients which allows remote attackers to cause a denial of service (arbitrary client blacklisting) via a crafted DNS PTR record related to a \plist injection issue.\


OpenTTD before 1.0.1 allows remote attackers to cause a denial of service (file-descriptor exhaustion and daemon crash) by performing incomplete downloads of the map.


Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3 0.9.5 and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions and are related to (a) client appearance and (b) client disappearance messages.


Multiple unspecified vulnerabilities in (1) ns-slapd and (2) slapd.exe in Sun Directory Server Enterprise Edition 7.0 Sun Java System Directory Server 5.2 and Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 allow remote attackers to cause a denial of service (daemon crash) via a crafted LDAP search request.


Unspecified vulnerability in Cisco Mediator Framework 1.5.1 before 1.5.1.build.14-eng 2.2 before 2.2.1.dev.1 and 3.0 before 3.0.9.release.1 on the Cisco Network Building Mediator NBM-2400 and NBM-4800 and the Richards-Zeta Mediator 2500 allows remote authenticated users to read or modify the device configuration and gain privileges or cause a denial of service (device reload) via a (1) XML RPC or (2) XML RPC over HTTPS request aka Bug ID CSCtb83618.


The SMB implementation in the Server service in Microsoft Windows 2000 SP4 Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista Gold SP1 and SP2 Windows Server 2008 Gold SP2 and R2 and Windows 7 does not properly validate the share and servername fields in SMB packets which allows remote attackers to cause a denial of service (system hang) via a crafted packet aka \SMB Null Pointer Vulnerability.\


ejabberd_c2s.erl in ejabberd before 2.1.3 allows remote attackers to cause a denial of service (daemon crash) via a large number of c2s (aka client2server) messages that trigger a queue overload.


The Web Container in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43 6.1 before 6.1.0.31 and 7.0 before 7.0.0.11 does not properly handle chunked transfer encoding during a call to response.sendRedirect which allows remote attackers to cause a denial of service via a GET request.


IBM Cognos Express 9.0 allows attackers to obtain unspecified access to the Tomcat Manager component and cause a denial of service by leveraging hardcoded credentials.


Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.0 before 7.0(8.10) 7.2 before 7.2(4.45) 8.0 before 8.0(4.44) 8.1 before 8.1(2.35) and 8.2 before 8.2(1.10) allows remote attackers to cause a denial of service (device reload) via a malformed TCP segment when certain NAT translation and Cisco AIP-SSM configurations are used aka Bug ID CSCtb37219.


The futex_lock_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly manage a certain reference count which allows local users to cause a denial of service (OOPS) via vectors involving an unmount of an ext3 filesystem.


The CTI Manager service in Cisco Unified Communications Manager (aka CUCM formerly CallManager) 4.x before 4.3(2)sr1a 6.x before 6.1(3) 7.0x before 7.0(2) 7.1x before 7.1(2) and 8.x before 8.0(1) allows remote attackers to cause a denial of service (service failure) via a malformed message aka Bug ID CSCsu31800.


lighttpd before 1.4.26 and 1.5.x allocates a buffer for each read operation that occurs for a request which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate.


The Web Services Security component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.13 does not properly implement the Java API for XML Web Services (aka JAX-WS) which allows remote attackers to cause a denial of service (data corruption) via a crafted JAX-WS request that leads to incorrectly encoded data.


A certain ActiveX control in msgsc.14.0.8089.726.dll in Microsoft Windows Live Messenger 2009 build 14.0.8089.726 on Windows Vista and Windows 7 allows remote attackers to cause a denial of service (msnmsgr.exe crash) by calling the ViewProfile method with a crafted argument during an MSN Messenger session.