Double free vulnerability in PostgreSQL before 9.0.20 9.1.x before 9.1.16 9.2.x before 9.2.11 9.3.x before 9.3.7 and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.


The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1 when unable to directly access passwords allows local users to enumerate usernames or cause a denial of service (hang) via a large password.


The NetKVM Windows Virtio driver allows remote attackers to cause a denial of service (guest crash) via a crafted length value in an IP packet as demonstrated by a value that does not account for the size of the IP options.


Multiple memory leaks in the x11_init_protocol function in epan/dissectors/packet-x11.c in the X11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 allow remote attackers to cause a denial of service (memory consumption) via a crafted packet.


libuser before 0.56.13-8 and 0.60 before 0.60-7 as used in the userhelper program in the usermode package directly modifies /etc/passwd which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.


SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause as demonstrated by COLLATE\\\\\\\\ at the end of a SELECT statement.


The ProcPutImage function in dix/dispatch.c in X.Org Server (aka xserver and xorg-server) before 1.16.4 allows attackers to cause a denial of service (divide-by-zero and crash) via a zero-height PutImage request.


Google Chrome before 42.0.2311.90 does not always ask the user before proceeding with CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK changes which allows user-assisted remote attackers to cause a denial of service (UI disruption) by constructing a crafted HTML document containing JavaScript code with requestFullScreen and requestPointerLock calls and arranging for the user to access this document with a file: URL.


The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40 5.5.x before 5.5.24 and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.


The IPsec SA establishment process on Innominate mGuard devices with firmware 8.x before 8.1.7 allows remote authenticated users to cause a denial of service (VPN service restart) by leveraging a peer relationship to send a crafted configuration with compression.


A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value which allow local users to cause a denial of service (system crash) via the Fast Open feature as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.


The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.


selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by creating a hardlink to /etc/passwd from a directory named .config and updating selinux-policy.


Application Store in Apple iOS before 8.4 does not ensure the uniqueness of bundle IDs which allows attackers to cause a denial of service (ID collision and launch outage) via a crafted universal provisioning profile app.


libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bits set in the IPSEC DOI value or (2) the next payload value set to ISAKMP_NEXT_SAK.


OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo) when using the IPTables firewall driver allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.


SysAid Help Desk before 15.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an XML document to (1) /agententry (2) /rdsmonitoringresponse or (3) /androidactions aka an XML Entity Expansion (XEE) attack.


The ssl-proxy-openssl.c function in Dovecot before 2.2.17 when SSLv3 is disabled allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.


The HTTP application on Mitsubishi Electric MELSEC FX3G PLC devices before April 2015 allows remote attackers to cause a denial of service (device outage) via a long parameter.


lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2 as used with Ruby on Rails 3.x and 4.x and other products allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.


The fragment_add_work function in epan/reassemble.c in the packet-reassembly feature in Wireshark 1.12.x before 1.12.5 does not properly determine the defragmentation state in a case of an insufficient snapshot length which allows remote attackers to cause a denial of service (memory consumption) via a crafted packet.


The ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350 RD450 RD550 RD650 and TD350 allows remote attackers to cause a denial of service (web interface crash) via a malformed HTTP request during authentication.


The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.


arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly determine when nested NMI processing is occurring which allows local users to cause a denial of service (skipped NMI) by modifying the rsp register issuing a syscall instruction and triggering an NMI.


The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.


OpenStack Glance before 2015.1.1 (kilo) allows remote authenticated users to cause a denial of service (disk consumption) by repeatedly using the import task flow API to create images and then deleting them.


Hospira LifeCare PCA Infusion System 5.0 and earlier and possibly other versions allows remote attackers to cause a denial of service (forced manual reboot) via a flood of TCP packets.


The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboot) via a crafted ICMP request message.


The ldb_wildcard_compare function in ldb_match.c in ldb before 1.1.24 as used in the AD LDAP server in Samba 4.x before 4.1.22 4.2.x before 4.2.7 and 4.3.x before 4.3.3 mishandles certain zero values which allows remote attackers to cause a denial of service (infinite loop) via crafted packets.


OpenStack Compute (nova) 2015.1 through 2015.1.1 2014.2.3 and earlier does not stop the migration process when the instance is deleted which allows remote authenticated users to cause a denial of service (disk network and other resource consumption) by resizing and then deleting an instance.


The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not properly track the current offset which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2 when JDOM or REXML is enabled allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.


epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 improperly refers to previously processed bytes which allows remote attackers to cause a denial of service (application crash) via a crafted packet a different vulnerability than CVE-2015-2188.


Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file as demonstrated by an HTML VIDEO element that references H.264 data.


Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7 as used in the userhelper program in the usermode package allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field.


The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol and then making a connect system call after a disconnect.


OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.


The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45 when built with NSS allows remote attackers to cause a denial of service (assertion failure and daemon restart) via a zero DH g^x value in a KE payload in a IKE packet.


The (1) dissect_tfs_request and (2) dissect_tfs_response functions in epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 interpret a zero value as a length rather than an error condition which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not reject a zero length which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


The updateMessageStatus function in Android 5.1.1 and earlier allows local users to cause a denial of service (NULL pointer exception and process crash).


Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.


epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.


openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory which allows local users when quotas are not properly setup to fill the filesystem hosting /var/lib and cause a denial of service (disk consumption).


bitcoind and Bitcoin-Qt prior to 0.10.2 allow attackers to cause a denial of service (disabled functionality such as a client application crash) via an \Easy\ attack.


The Bluetooth subsystem in Apple OS X before 10.10.5 allows remote attackers to cause a denial of service via malformed Bluetooth ACL packets.


mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero.


print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash).


epan/dissectors/packet-dec-dnart.c in the DECnet NSP/RT dissector in Wireshark 1.10.12 through 1.10.14 mishandles a certain strdup return value which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.


A vulnerability classified as problematic has been found in Kiddoware Kids Place. This affects the Home Button Protection. A repeated pressing of the button causes a local denial of service. It is recommended to upgrade the affected component.


lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.


TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1 VMware Player 6.x before 6.0.6 and 7.x before 7.1.1 and VMware Horizon Client 3.2.x before 3.2.1 3.3.x and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory which allows guest OS users to cause a host OS denial of service via unspecified vectors a different vulnerability than CVE-2015-2339.


node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption).


The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to cause a denial of service (database lock or license corruption) via unspecified vectors.


ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file.


Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.


Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.


The user authentication module in Huawei Campus switches S5700 S5300 S6300 and S6700 with software before V200R001SPH012 and S7700 S9300 and S9700 with software before V200R001SPH015 allows remote attackers to cause a denial of service (device restart) via vectors involving authentication which trigger an array access violation.


PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror.


MediaWiki before 1.19.24 1.2x before 1.23.9 and 1.24.x before 1.24.2 when using HHVM or Zend PHP allows remote attackers to cause a denial of service (\quadratic blowup\ and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity a different vulnerability than CVE-2015-2942.


The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.


ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file.


IBM WebSphere MQ 7.0.1 before 7.0.1.13 allows remote attackers to cause a denial of service (channel-agent abend and process outage) via a crafted selection string in an MQI call.


Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via crafted packets on (1) TCP port 102 or (2) Profibus.


Active Directory in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service outage) by creating multiple machine accounts aka \Active Directory Denial of Service Vulnerability.\


Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message.


Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors involving a large amount of traffic from the GE port to the FE port.


The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the rest_proxy_call_get_url function which allows remote attackers to cause a denial of service (application crash) via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interface on an object representing a Flickr account.


SAP Sybase SQL Anywhere 11 and 16 allows remote attackers to cause a denial of service (crash) via a crafted request aka SAP Security Note 2108161.


Huawei Ascend P7 allows remote attackers to cause a denial of service (phone process crash).


The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x when using a PCI passthrough device is not preemptible which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).


Zhone GPON 2520 with firmware R4.0.2.566b allows remote attackers to cause a denial of service via a long string in the oldpassword parameter.


TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1 VMware Player 6.x before 6.0.6 and 7.x before 7.1.1 and VMware Horizon Client 3.2.x before 3.2.1 3.3.x and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory which allows guest OS users to cause a host OS denial of service via unspecified vectors a different vulnerability than CVE-2015-2338.


The Multicast DNS (mDNS) responder in Synology DiskStation Manager (DSM) before 3.1 inadvertently responds to unicast queries with source addresses that are not link-local which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets to the Avahi component.


The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code cause a denial of service (out-of-bounds heap read and crash) or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.


QEMU as used in Xen 3.3.x through 4.5.x does not properly restrict access to PCI command registers which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device which triggers an Unsupported Request (UR) response.


filter/urltolink/filter.php in Moodle through 2.5.9 2.6.x before 2.6.9 2.7.x before 2.7.6 and 2.8.x before 2.8.4 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression.


buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.


The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file.


The Hidden Service (HS) server implementation in Tor before 0.2.4.27 0.2.5.x before 0.2.5.12 and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.


lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.


Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general resource consumption) via a list with a large number of elements.


VMware Workstation 10.x before 10.0.5 VMware Player 6.x before 6.0.6 and VMware Fusion 6.x before 6.0.6 and 7.x before 7.0.1 allow attackers to cause a denial of service against a 32-bit guest OS or 64-bit host OS via a crafted RPC command.


The utils.html.strip_tags function in Django 1.6.x before 1.6.11 1.7.x before 1.7.7 and 1.8.x before 1.8c1 when using certain versions of Python allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.


MediaWiki before 1.19.24 1.2x before 1.23.9 and 1.24.x before 1.24.2 when using HHVM allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file aka a \billion laughs attack \ a different vulnerability than CVE-2015-2937.


PCRE before 8.36 mishandles the /(((a\\2)|(a*)\\g<-1>))*/ pattern and related patterns with certain internal recursive back references which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror.


ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.


epan/proto.c in Wireshark 1.12.x before 1.12.4 does not properly handle integer data types greater than 32 bits in size which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet that is improperly handled by the LLDP dissector.


Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2 when an application invokes the totalSize method on an object reader allows remote peers to cause a denial of service (CPU consumption) via a crafted small message which triggers a \tight\ for loop. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-2312.


Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers which might allow local guest OS users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device which triggers an Unsupported Request (UR) response.


Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.


TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1 VMware Player 6.x before 6.0.6 and 7.x before 7.1.1 and VMware Horizon Client 3.2.x before 3.2.1 3.3.x and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory which allows guest OS users to cause a host OS denial of service via unspecified vectors.


The REST layer on HP SDN VAN Controller devices 2.5 and earlier allows remote attackers to cause a denial of service via network traffic to the REST port.


The Hidden Service (HS) client implementation in Tor before 0.2.4.27 0.2.5.x before 0.2.5.12 and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.


atmfd.dll in the Adobe Type Manager Library in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1 and Windows 10 allows remote attackers to cause a denial of service (system crash) via a crafted OpenType font aka \OpenType Font Parsing Vulnerability.\


The AddUserFinding add_userfinding2 function in Medicomp MEDCIN Engine before 2.22.20153.226 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted packet on port 8190.


The xsave/xrstor implementation in arch/x86/include/asm/xsave.h in the Linux kernel before 3.19.2 creates certain .altinstr_replacement pointers and consequently does not provide any protection against instruction faulting which allows local users to cause a denial of service (panic) by triggering a fault as demonstrated by an unaligned memory operand or a non-canonical address memory operand.


Huawei eSpace 7910 and 7950 IP phones with software before V200R002C00SPC800 allow remote attackers with established sessions to cause a denial of service (device restart) via unspecified packets.


The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image as demonstrated by libtiff5.tif.


bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself.


ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted MIFF file.


An unspecified module in Huawei eSpace U1910 U1911 U1930 U1960 U1980 and U1981 unified gateways with software before V200R003C00SPC300 does not properly initialize memory when processing timeout messages which allows remote attackers to cause a denial of service (out-of-bounds memory access and device restart) via unknown vectors.


The dissect_sdp function in epan/dissectors/packet-sdp.c in the SDP dissector in Wireshark 1.12.x before 1.12.9 does not prevent use of a negative media count which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Huawei eSpace U2980 unified gateway with software before V100R001C10 and U2990 with software before V200R001C10 allow remote authenticated users to cause a denial of service via crafted signaling packets from a registered device.


The HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B220SP01 GRA-CL00 before GRA-CL00C92B220 GRA-CL10 before GRA-CL10C92B220 GRA-UL00 before GRA-UL00C00B220 GRA-UL10 before GRA-UL10C00B220 and Mate7 phones with software MT7-UL00 before MT7-UL00C17B354 MT7-TL10 before MT7-TL10C00B354 MT7-TL00 before MT7-TL00C01B354 and MT7-CL00 before MT7-CL00C92B354 allows remote attackers to cause a denial of service (invalid memory access and reboot) via unspecified vectors related to \input null pointer as parameter.\


The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data.


PCRE before 8.38 mishandles certain references which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror a related issue to CVE-2015-8384 and CVE-2015-8392.


The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux kernel before 4.6 mishandles xattr block caching which allows local users to cause a denial of service (soft lockup) via filesystem operations in environments that use many attributes as demonstrated by Ceph and Samba.


The Video0 driver in Huawei P8 smartphones with software GRA-UL00 before GRA-UL00C00B350 GRA-UL10 before GRA-UL10C00B350 GRA-TL00 before GRA-TL00C01B350 GRA-CL00 before GRA-CL00C92B350 and GRA-CL10 before GRA-CL10C92B350 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01 CRR-UL00 before CRR-UL00C00B160 and CRR-CL00 before CRR-CL00C92B161 allows attackers to obtain sensitive information from stack memory or cause a denial of service (system crash) via a crafted application which triggers an invalid memory access.


The lha_read_file_extended_header function in archive_read_support_format_lha.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted (1) lzh or (2) lha file.


PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror.


epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.9 does not properly reserve memory for channel ID mappings which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet.


Memory leak in Huawei S5300EI S5300SI S5310HI and S6300EI Campus series switches with software V200R003C00 before V200R003SPH011 and V200R005C00 before V200R005SPH008; S2350EI and S5300LI Campus series switches with software V200R003C00 before V200R003SPH011 V200R005C00 before V200R005SPH008 and V200R006C00 before V200R006SPH002; S9300 S7700 and S9700 Campus series switches with software V200R003C00 before V200R003SPH011 V200R005C00 before V200R005SPH009 and V200R006C00 before V200R006SPH003; S5720HI and S5720EI Campus series switches with software V200R006C00 before V200R006SPH002; and S2300 and S3300 Campus series switches with software V100R006C05 before V100R006SPH022 allows remote authenticated users to cause a denial of service (memory consumption and device restart) by logging in and out of the (1) HTTPS or (2) SFTP server related to SSL session information.


The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted rar file.


The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain : nesting which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror.


The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table.


Xen when used on a system providing PV backends allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend aka a double fetch vulnerability.


The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).


The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file.


The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.


db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute.


The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.


The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash).


The ff_get_buffer function in libavcodec/utils.c in FFmpeg before 2.8.4 preserves width and height values after a failure which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .mov file.


bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file.


The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.


The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.


The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission a different vulnerability than CVE-2015-8226.


The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.


ISC DHCP 4.x before 4.1-ESV-R12-P1 4.2.x and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.


The chunked upload API (ApiUpload) in MediaWiki before 1.23.11 1.24.x before 1.24.4 and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size.


The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.


The mp2t_open function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not validate the bit rate which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.


The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in FFmpeg before 2.8.4 does not validate the number of decomposition levels before proceeding with Discrete Wavelet Transform decoding which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.


The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure which allows physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device.


Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.


The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response as demonstrated by a \\\032\ (whitespace) character in a hostname.


Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.


net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product.


Memory leak in QEMU when built with a VMWARE VMXNET3 paravirtual NIC emulator support allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly.


The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a link-local source address.


The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file related to newline parsing.


The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors related to XENMEM_exchange error handling.


The dissect_rsvp_common function in epan/dissectors/packet-rsvp.c in the RSVP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not properly maintain request-key data which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet.


Memory leak in Huawei eSpace 8950 IP phones with software before V200R003C00SPC300 allows remote attackers to cause a denial of service (memory consumption and restart) via a large number of crafted ARP packets.


The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov.


The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file.


The init_t38_info_conv function in epan/dissectors/packet-t38.c in the T.38 dissector in Wireshark 1.12.x before 1.12.9 does not ensure that a conversation exists which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The presentation transmission permission management mechanism in Huawei TE30 TE40 TE50 and TE60 multimedia video conferencing endpoints with software before V100R001C10SPC100 allows remote attackers to cause a denial of service (wired presentation outage) via unspecified vectors involving a wireless presentation.


The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5 2.7.x before 2.7.3 and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.


The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230 GRA-CL00 before GRA-CL00C92B230 GRA-CL10 before GRA-CL10C92B230 GRA-UL00 before GRA-UL00C00B230 and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01 CRR-UL00 before CRR-UL00C00B160 and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application with the graphics permission aka an \interface access control vulnerability \ a different vulnerability than CVE-2015-8680.


The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on tile coordinates which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.


The archive_string_append function in archive_string.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted cab files related to \overlapping memcpy.\


fs/overlayfs/copy_up.c in the Linux kernel before 4.2.6 uses an incorrect cleanup code path which allows local users to cause a denial of service (dentry reference leak) via filesystem operations on a large file in a lower overlayfs layer.


The dissect_hsdsch_channel_info function in epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.9 does not validate the number of PDUs which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Memory

leak

in

Huawei

and

Campus

series

switches

with

software

before

before

and

before

and

Campus

series

switches

with

software

before

before

and

before

and

and

Campus

series

switches

with

software

before

allows

remote

attackers

to

cause

a

denial

of

service

(memory

consumption

and

reboot)

via

a

large

number

of

packets.


tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds write) via an invalid number of samples per pixel in a LogL compressed TIFF image a different vulnerability than CVE-2015-8782.


The dissect_ppi function in epan/dissectors/packet-ppi.c in the PPI dissector in Wireshark 2.0.x before 2.0.1 does not initialize a packet-header data structure which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets with incorrect values.


PCRE before 8.38 mishandles the : and \\\\ substrings in character classes which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression as demonstrated by a JavaScript RegExp object encountered by Konqueror.


The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect integer data type which allows remote attackers to cause a denial of service (invalid write operation and application crash) via a crafted packet.


The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset which allows remote attackers to cause a denial of service (crash) via a crafted zip file.


coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.


apl_42.c in ISC BIND 9.x before 9.9.8-P3 9.9.x and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record.


The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the \/op *\ command in a query.


The ION driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230 GRA-CL00 before GRA-CL00C92B230 GRA-CL10 before GRA-CL10C92B230 GRA-UL00 before GRA-UL00C00B230 and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01 CRR-UL00 before CRR-UL00C00B160 and CRR-CL00 before CRR-CL00C92B161 allows remote attackers to cause a denial of service (crash) via a crafted application.


The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM AAM AFM Analytics APM ASM GTM Link Controller and BIG-IP PEM before 11.4.1 HF10 11.5.x before 11.5.4 and 11.6.x before 11.6.0 HF6 and BIG-IP PSM before 11.4.1 HF10 does not properly handle TCP options which allows remote attackers to cause a denial of service via unspecified vectors related to the tm.minpathmtu database variable.


The kea-dhcp4 and kea-dhcp6 servers 0.9.2 and 1.0.0-beta in ISC Kea when certain debugging settings are used allow remote attackers to cause a denial of service (daemon crash) via a malformed packet.


The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data.


Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation (2) XENMEM_populate_physmap (3) XENMEM_exchange and possibly other HYPERVISOR_memory_op suboperations which allows ARM guest OS administrators to cause a denial of service (CPU consumption guest reboot or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.


The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission a different vulnerability than CVE-2015-8225.


The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.


The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.


The trad_enc_decrypt_update function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted zip file related to reading the password.


Double free vulnerability in epan/dissectors/packet-nlm.c in the NLM dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 when the \Match MSG/RES packets for async NLM\ option is enabled allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The

match

function

in

in

PCRE

before

mishandles

the

/(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/

pattern

and

related

patterns

involving

(*ACCEPT)

which

allows

remote

attackers

to

obtain

sensitive

information

from

process

memory

or

cause

a

denial

of

service

(partially

initialized

memory

and

application

crash)

via

a

crafted

regular

expression

as

demonstrated

by

a

JavaScript

RegExp

object

encountered

by

Konqueror

aka


The

KEYS

subsystem

in

the

Linux

kernel

before

allows

local

users

to

gain

privileges

or

cause

a

denial

of

service

(BUG)

via

crafted

keyctl

commands

that

negatively

instantiate

a

key

related

to

and


The networking implementation in the Linux kernel through 4.3.3 as used in Android and other products does not validate protocol identifiers for certain protocol families which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application.


Qemu when built with VNC display driver support allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.


customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service (excessive database locking) via a crafted CSV file a different vulnerability than CVE-2016-1153.


The dissect_dcom_OBJREF function in epan/dissectors/packet-dcom.c in the DCOM dissector in Wireshark 1.12.x before 1.12.9 does not initialize a certain IPv4 data structure which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Huawei LogCenter V100R001C10 could allow an authenticated attacker to add abnormal device information to the log collection module causing denial of service.


The ReadBlobByte function in coders/pdb.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted PDB file.


The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value.


Huawei Sophia-L10 smartphones with software before P7-L10C900B852 allow attackers to cause a denial of service (system panic) via a crafted application with the system or camera privilege.


The ovisp driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230 GRA-CL00 before GRA-CL00C92B230 GRA-CL10 before GRA-CL10C92B230 GRA-UL00 before GRA-UL00C00B230 and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01 CRR-UL00 before CRR-UL00C00B160 and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application with the camera permission aka an \interface access control vulnerability.\


The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file.


Huawei USG5500 USG2100 USG2200 and USG5100 unified security gateways with software before V300R001C10SPC600 when \DHCP Snooping\ is enabled and either \option82 insert\ or \option82 rebuild\ is enabled on an interface allow remote attackers to cause a denial of service (reboot) via crafted DHCP packets.


Unspecified vulnerability in the NVAPI support layer in the NVIDIA GPU graphics driver R340 before 341.92 R352 before 354.35 and R358 before 358.87 on Windows allows local users to obtain sensitive information cause a denial of service (crash) or possibly gain privileges via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-7869 per ADT2 and ADT3 due to different vulnerability types and affected versions.


The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5 2.7.x before 2.7.3 and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers.


The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information cause a denial of service (out-of-bounds heap memory access and application crash) or possibly have unspecified other impact via an unclosed HTML comment.


The (1) S_reghop3 (2) S_reghop4 and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data as demonstrated by \a\\x80.\


The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.


arch/arm64/kernel/perf_event.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via vectors involving events that are mishandled during a span of multiple HW PMUs.


The ipmi_fmt_udpport function in epan/dissectors/packet-ipmi.c in the IPMI dissector in Wireshark 2.0.x before 2.0.1 improperly attempts to access a packet scope which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.


McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.


Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collator_sort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.


lldpd before 0.8.0 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via a malformed packet.


The Management plugin in RabbitMQ before 3.6.1 allows remote authenticated users with certain privileges to cause a denial of service (resource consumption) via the (1) lengths_age or (2) lengths_incr parameter.


The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file which triggers an invalid left shift.


epan/dissectors/packet-alljoyn.c in the AllJoyn dissector in Wireshark 1.12.x before 1.12.9 does not check for empty arguments which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


CA Release Automation (formerly LISA Release Automation) 5.0.2 before 5.0.2-227 5.5.1 before 5.5.1-1616 5.5.2 before 5.5.2-434 and 6.1.0 before 6.1.0-1026 allows remote attackers to read arbitrary files or cause a denial of service via a request containing an XML external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


The ReadVICARImage function in coders/vicar.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted VICAR file.


The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel before 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field.


The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230 GRA-CL00 before GRA-CL00C92B230 GRA-CL10 before GRA-CL10C92B230 GRA-UL00 before GRA-UL00C00B230 and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01 CRR-UL00 before CRR-UL00C00B160 and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application with the graphics permission aka an \interface access control vulnerability \ a different vulnerability than CVE-2015-8307.


Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).


BIG-IP

LTM

AFM

Analytics

APM

ASM

Link

Controller

and

PEM

before

before

before

and

before

BIG-IP

AAM

before

before

before

and

before

BIG-IP

DNS

before

BIG-IP

Edge

Gateway

WebAccelerator

and

WOM

BIG-IP

GTM

before

before

and

before

BIG-IP

PSM

and

before

Enterprise

Manager

through

BIG-IQ

Cloud

and

BIG-IQ

Security

through

BIG-IQ

Device

through

BIG-IQ

ADC

BIG-IQ

Centralized

Management

and

BIG-IQ

Cloud

and

Orchestration

on

the

and

platforms

when

software

SYN

cookies

are

configured

on

virtual

servers

allow

remote

attackers

to

cause

a

denial

of

service

(High-Speed

Bridge

hang)

via

an

invalid

TCP

segment.


Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.


Node.js 0.12.x before 0.12.9 4.x before 4.2.3 and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.


tif_luv.c in libtiff allows attackers to cause a denial of service (out-of-bounds writes) via a crafted TIFF image a different vulnerability than CVE-2015-8781.


The dissect_ber_GeneralizedTime function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 improperly checks an sscanf return value which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.1 does not validate the column size which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.


The

function

in

in

the

dissector

in

Wireshark

before

does

not

validate

the

list

count

in

an

SZL

response

which

allows

remote

attackers

to

cause

a

denial

of

service

(divide-by-zero

error

and

application

crash)

via

a

crafted

packet.


The PCI backend driver in Xen when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations aka \Linux pciback missing sanity checks.\


The dissect_nwp function in epan/dissectors/packet-nwp.c in the NWP dissector in Wireshark 2.0.x before 2.0.1 mishandles the packet type which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Huawei P7 before P7-L00C17B851 P7-L05C00B851 and P7-L09C92B85 and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash) by leveraging camera permissions and via crafted input to the camera driver.


The chunked upload API (ApiUpload) in MediaWiki before 1.23.11 1.24.x before 1.24.4 and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.


The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0 as used in PHP before 5.6.12 uses inconsistent allocate and free approaches which allows remote attackers to cause a denial of service (memory consumption) via a crafted call as demonstrated by a call to the PHP imagescale function.


buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3 when debug logging is enabled allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.


The h264_slice_header_init function in libavcodec/h264_slice.c in FFmpeg before 2.8.3 does not validate the relationship between the number of threads and the number of slices which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted H.264 data.


The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).


net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does not properly manage the relationship between a lock and a socket which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call.


The VideoFramePool::PoolImpl::CreateFrame function in media/base/video_frame_pool.cc in Google Chrome before 47.0.2526.73 does not initialize memory for a video-frame data structure which might allow remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact by leveraging improper interaction with the vp3_h_loop_filter_c function in libavcodec/vp3dsp.c in FFmpeg.


The GPU driver in Huawei P7 phones with software P7-L00 before P7-L00C17B851 P7-L05 before P7-L05C00B851 and P7-L09 before P7-L09C92B851 allows local users to read or write to arbitrary kernel memory locations and consequently cause a denial of service (system crash) or gain privileges via a crafted application.


The Maxim_smartpa_dev driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230 GRA-CL00 before GRA-CL00C92B230 GRA-CL10 before GRA-CL10C92B230 GRA-UL00 before GRA-UL00C00B230 and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01 CRR-UL00 before CRR-UL00C00B160 and CRR-CL00 before CRR-CL00C92B161 allow attackers to cause a denial of service (system crash) via a crafted application which triggers an invalid memory access.


The KVM subsystem in the Linux kernel through 4.2.6 and Xen 4.3.x through 4.6.x allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions related to svm.c.


The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.


The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.


epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the number of items which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted packet.


The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a denial of service via a crafted message.


The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.


The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.


The dissect_dns_answer function in epan/dissectors/packet-dns.c in the DNS dissector in Wireshark 1.12.x before 1.12.9 mishandles the EDNS0 Client Subnet option which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).


_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.


An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed.


Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header.


The lame_init_params function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file with a negative sample rate.


HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling related to hb-ot-layout-gpos-table.hh hb-ot-layout-gsub-table.hh and hb-ot-layout-gsubgpos-private.hh.


Mozilla Firefox 1.5.0.4 and earlier allows remote user-assisted attackers to cause a denial of service (crash) via a form with a multipart/form-data encoding and a user-uploaded file. NOTE: a third party has claimed that this issue might be related to the LiveHTTPHeaders extension.


Unspecified vulnerability in NIS server on Sun Solaris 8 9 and 10 allows local and remote attackers to cause a denial of service (ypserv hang) via unknown vectors.


TippingPoint IPS running the TippingPoint Operating System (TOS) before 2.2.4.6519 allows remote attackers to \force the device into layer 2 fallback (L2FB)\ causing a denial of service (page fault) via a malformed packet.


Yahoo! Messenger 7.5.0.814 and 7.0.438 allows remote attackers to cause a denial of service (crash) via messages that contain non-ASCII characters which triggers the crash in jscript.dll.


Linux kernel 2.6.x when using both NFS and EXT3 allows remote attackers to cause a denial of service (file system panic) via a crafted UDP packet with a V2 lookup procedure that specifies a bad file handle (inode number) which triggers an error and causes an exported directory to be remounted read-only.


** DISPUTED ** EMC VMware Player allows user-assisted attackers to cause a denial of service (unrecoverable application failure) via a long value of the ide1:0.fileName parameter in the .vmx file of a virtual machine. NOTE: third parties have disputed this issue saying that write access to the .vmx file enables other ways of stopping the virtual machine so no privilege boundaries are crossed.


Sun Solaris 10 allows local users to cause a denial of service (panic) via unspecified vectors involving (1) the /net mount point and (2) the \-hosts\ map in a mount point.


Internet Key Exchange (IKE) version 1 protocol as implemented on Cisco IOS VPN 3000 Concentrators and PIX firewalls allows remote attackers to cause a denial of service (resource exhaustion) via a flood of IKE Phase-1 packets that exceed the session expiration rate. NOTE: it has been argued that this is due to a design weakness of the IKE version 1 protocol in which case other vendors and implementations would also be affected.


nNetObject.cpp in Armagetron Advanced 2.8.2 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a large number handled by the id_req_handler function.


Memory leak in Juniper JUNOS 6.4 through 8.0 built before May 10 2006 allows remote attackers to cause a denial of service (kernel packet memory consumption and crash) via crafted IPv6 packets whose buffers are not released after they are processed.


The TOSRFBD.SYS driver for Toshiba Bluetooth Stack 4.00.29 and earlier on Windows allows remote attackers to cause a denial of service (reboot) via a L2CAP echo request that triggers an out-of-bounds memory access similar to \Ping o' Death\ and as demonstrated by BlueSmack. NOTE: this issue was originally reported for 4.00.23.


The TIFFFetchAnyArray function in ImageIO in Apple OS X 10.4.7 and earlier allows remote user-assisted attackers to cause a denial of service (application crash) via an invalid tag value in a TIFF image possibly triggering a null dereference. NOTE: This is a different issue than CVE-2006-1469.


Norton

Personal

Firewall

allows

local

users

to

cause

a

denial

of

service

(crash)

via

certain

RegSaveKey

RegRestoreKey

and

RegDeleteKey

operations

on

the

HKLM\\SYSTEM\\CurrentControlSet\\Services\\SNDSrvc

and

HKLM\\SYSTEM\\CurrentControlSet\\Services\\SymEvent

registry

keys.


kpf4ss.exe in Sunbelt Kerio Personal Firewall 4.3.x before 4.3.268 does not properly hook the CreateRemoteThread API function which allows local users to cause a denial of service (crash) and bypass protection mechanisms by calling CreateRemoteThread.


Siemens SpeedStream 2624 allows remote attackers to cause a denial of service (device hang) by sending a crafted packet to the web administrative interface.


xt_sctp in netfilter for Linux kernel before 2.6.17.1 allows attackers to cause a denial of service (infinite loop) via an SCTP chunk with a 0 length.


The peel_netstring function in cl_netstring.c in the heartbeat subsystem in High-Availability Linux before 1.2.5 and 2.0 before 2.0.7 allows remote attackers to cause a denial of service (crash) via the length parameter in a heartbeat message.


Papyrus NASCAR Racing 4 4.1.3.1.6 and earlier 2002 Season 1.1.0.2 and earlier and 2003 Season 1.2.0.1 and earlier allows remote attackers to cause a denial of service (CPU consumption) by sending an empty UDP datagram which is not properly discarded due to use of the FIONREAD asynchronous socket.


klif.sys in Kaspersky Internet Security 6.0 and 7.0 Kaspersky Anti-Virus (KAV) 6.0 and 7.0 KAV 6.0 for Windows Workstations and KAV 6.0 for Windows Servers does not validate certain parameters to the (1) NtCreateKey (2) NtCreateProcess (3) NtCreateProcessEx (4) NtCreateSection (5) NtCreateSymbolicLinkObject (6) NtCreateThread (7) NtDeleteValueKey (8) NtLoadKey2 (9) NtOpenKey (10) NtOpenProcess (11) NtOpenSection and (12) NtQueryValueKey hooked system calls which allows local users to cause a denial of service (reboot) via an invalid parameter as demonstrated by the ClientId parameter to NtOpenProcess.


The device driver for Intel-based gigabit network adapters in Cisco Intrusion Prevention System (IPS) 5.1(1) through 5.1(p1) as installed on various Cisco Intrusion Prevention System 42xx appliances allows remote attackers to cause a denial of service (kernel panic and possibly network outage) via a crafted IP packet.


The ip6_savecontrol function in NetBSD 2.0 through 3.0 under certain configurations does not check to see if IPv4-mapped sockets are being used before processing IPv6 socket options which allows local users to cause a denial of service (crash) by creating an IPv4-mapped IPv6 socket with the SO_TIMESTAMP socket option set then sending an IPv4 packet through the socket.


mysqld in MySQL 4.1.x before 4.1.18 5.0.x before 5.0.19 and 5.1.x before 5.1.6 allows remote authorized users to cause a denial of service (crash) via a NULL second argument to the str_to_date function.


The smdb daemon (smbd/service.c) in Samba 3.0.1 through 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of share connection requests.


Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the fonts property of the HtmlDlgSafeHelper object which triggers a null dereference.


Apple Safari 2.0.4/419.3 allows remote attackers to cause a denial of service (application crash) via a DHTML setAttributeNode function call with zero arguments which triggers a null dereference.


Clearswift MAILsweeper for SMTP before 4.3.20 and MAILsweeper for Exchange before 4.3.20 allows remote attackers to cause a denial of service via (1) non-ASCII characters in a reverse DNS lookup result from a Received header which leads to a Receiver service stop and (2) unspecified vectors involving malformed messages which causes \unpredictable behavior\ that prevents the Security service from processing more messages.


Unspecified vulnerability in the kernel in Solaris 10 with patch 118822-29 (118844-29 on x86) and without patch 118833-11 (118855-08) allows remote authenticated users to cause a denial of service via unspecified vectors that lead to \kernel data structure corruption\ that can trigger a system panic application failure or \data corruption.\


Microsoft Internet Explorer 6 on Windows XP allows remote attackers to cause a denial of service (crash) via a table with a frameset as a child which triggers a null dereference as demonstrated using the appendChild method.


Patrice Freydiere ImgSvr (aka ADA Image Server) allows remote attackers to cause a denial of service (daemon crash) via a long HTTP POST request. NOTE: this might be the same issue as CVE-2004-2463.


Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the first parameter to the date_format function which is later used in a formatted print call to display the error message.


heartbeat.c in heartbeat before 2.0.6 sets insecure permissions in a shmget call for shared memory which allows local users to cause an unspecified denial of service via unknown vectors possibly during a short time window on startup.


Unspecified vulnerability in SYSEXESMPUTIL.EXE in HP OpenVMS 7.3-2 allows local users and \remote users\ to cause a denial of service (crash).


Unspecified versions of Internet Explorer allow remote attackers to cause a denial of service (crash) via an IFRAME with a src tag containing a \File://\ URI followed by an 8-bit character. NOTE: some third parties were unable to verify this issue.


nNetObject.cpp in Armagetron Advanced 2.8.2 and earlier allows remote attackers to cause a denial of service (application crash) via a large owner value which causes an assert error.


The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short when iterating over an unsigned 32-bit value which allows context-dependent attackers to cause a denial of service via a large td_nstrips value which triggers an infinite loop.


parse_notice (TiCPU) in EnergyMech (emech) before 3.0.2 allows remote attackers to cause a denial of service (crash) via empty IRC CTCP NOTICE messages.


The RSA Crypto-C before 6.3.1 and Cert-C before 2.8 libraries as used by RSA BSAFE multiple Cisco products and other products allows remote attackers to cause a denial of service via malformed ASN.1 objects.


The CORBA::ORBInvokeRec::set_answer_invoke function in orb.cc in MICO (Mico Is CORBA) 2.3.12 and earlier allows remote attackers to cause a denial of service (application crash) via a message with an incorrect \object key\ which triggers an assert error.


Memory leak in Network Security Services (NSS) 3.11 as used in Sun Java Enterprise System 2003Q4 through 2005Q1 and Java System Directory Server 5.2 allows remote attackers to cause a denial of service (memory consumption) by performing a large number of RSA cryptographic operations.


The SMB Mailslot parsing functionality in PAM in multiple ISS products with XPU (24.39/1.78/epj/x.x.x.1780) including Proventia A G M Server and Desktop BlackICE PC and Server Protection 3.6 and RealSecure 7.0 allows remote attackers to cause a denial of service (infinite loop) via a crafted SMB packet that is not properly handled by the SMB_Mailslot_Heap_Overflow decode.


Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by iterating over any native function as demonstrated with the window.alert function which triggers a null dereference.


Unspecified vulnerability in Support Tools Manager (xstm cstm and stm) on HP-UX B.11.11 and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors.


Microsoft Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to cause a denial of service (application crash) by calling the Click method of the Internet.HHCtrl.1 ActiveX object before initializing the URL which triggers a null dereference.


Check

Point

Zone

Labs

ZoneAlarm

Internet

Security

Suite

and

possibly

other

versions

do

not

properly

validate

RegSaveKey

RegRestoreKey

and

RegDeleteKey

function

calls

which

allows

local

users

to

cause

a

denial

of

service

(system

crash)

via

a

certain

combination

of

these

function

calls

with

an

HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\VETFDDNT\\Enum

argument.


** DISPUTED ** Microsoft Windows NT 4.0 Windows 2000 Windows XP and Windows Small Business Server 2003 allow remote attackers to cause a denial of service (IP stack hang) via a continuous stream of packets on TCP port 135 that have incorrect TCP header checksums and random numbers in certain TCP header fields as demonstrated by the Achilles Windows Attack Tool. NOTE: the researcher reports that the Microsoft Security Response Center has stated \Our investigation which has included code review review of the TCPDump and attempts on reproing the issue on multiple fresh installs of various Windows Operating Systems have all resulted in non confirmation.\


The (1) __futex_atomic_op and (2) futex_atomic_cmpxchg_inatomic functions in Linux kernel 2.6.17-rc4 to 2.6.18-rc2 perform the atomic futex operation in the kernel address space instead of the user address space which allows local users to cause a denial of service (crash).


filtnt.sys in Outpost Firewall Pro before 3.51.759.6511 (462) allows local users to cause a denial of service (crash) via long arguments to mshta.exe.


The TCP implementation in Sun Solaris 8 9 and 10 before 20060726 allows remote attackers to cause a denial of service (resource exhaustion) via a TCP packet with an incorrect sequence number which triggers an ACK storm.


Apple Safari 2.0.3 (417.9.3) on Mac OS X 10.4.6 allows remote attackers to cause a denial of service (CPU consumption) via Javascript with an infinite for loop. NOTE: it could be argued that this is not a vulnerability unless it interferes with the operation of the system outside of the scope of Safari itself.


The JPEG library in media-libs/jpeg before 6b-r7 on Gentoo Linux is built without the -maxmem feature which could allow context-dependent attackers to cause a denial of service (memory exhaustion) via a crafted JPEG file that exceeds the intended memory limits.


The decode_stringmap function in server_transport.cpp for UFO2000 svn 1057 allows remote attackers to cause a denial of service (daemon termination) via a large keysize or valsize which causes a crash when the resize function cannot allocate sufficient memory.


Internet Explorer 6 on Windows XP allows remote attackers to cause a denial of service (crash) by setting the Enabled property of a DXTFilter ActiveX object to true which triggers a null dereference.


Clearswift MIMEsweeper for Web before 5.1.15 Hotfix allows remote attackers to cause a denial of service (crash) via an encrypted archived .RAR file which triggers a scan error and causes the Web Policy Engine service to terminate.


Microsoft Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to cause a denial of service (application crash) by calling the stringToBinary function of the CEnroll.CEnroll.2 ActiveX object with a long second argument which triggers an invalid memory access inside the SysAllocStringLen function.


The SMTP service of MailEnable Standard 1.92 and earlier Professional 2.0 and earlier and Enterprise 2.0 and earlier before the MESMTPC hotfix allows remote attackers to cause a denial of service (application crash) via a HELO command with a null byte in the argument possibly triggering a length inconsistency or a missing argument.


The ia64 subsystem in the Linux kernel before 2.6.26 allows local users to cause a denial of service (stack consumption and system crash) via a crafted application that leverages the mishandling of invalid Register Stack Engine (RSE) state.


Internet Explorer 6 on Windows XP SP2 when Outlook is installed allows remote attackers to cause a denial of service (crash) by calling the NewDefaultItem function of an OVCtl (OVCtl.OVCtl.1) ActiveX object which triggers a null dereference.


wksss.exe 8.4.702.0 in Microsoft Works Spreadsheet 8.0 allows remote attackers to cause a denial of service (CPU consumption or crash) via crafted (1) Works (2) Excel and (3) Lotus 1-2-3 files.


Microsoft Internet Explorer 6.0 and 6.0 SP1 allows remote attackers to cause a denial of service via an HTML page with an A tag containing a long title attribute. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Format string vulnerability in the flush_output function in ConsoleStreambuf.cpp in Game Network Engine (GNE) 0.70 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute code via format string specifiers in unspecified vectors involving output to the gout console.


** DISPUTED ** Microsoft Internet Explorer 7.0 Beta allows remote attackers to cause a denial of service (application crash) via a web page with multiple empty APPLET start tags. NOTE: a third party has disputed this issue stating that the crash does not occur with Microsoft Internet Explorer 7.0 Beta3.


The supersede_lease function in memory.c in ISC DHCP (dhcpd) server 2.0pl5 allows remote attackers to cause a denial of service (application crash) via a DHCPDISCOVER packet with a 32 byte client-identifier which causes the packet to be interpreted as a corrupt uid and causes the server to exit with \corrupt lease uid.\


The perfmonctl system call (sys_perfmonctl) in Linux kernel 2.4.x and 2.6 before 2.6.18 when running on Itanium systems does not properly track the reference count for file descriptors which allows local users to cause a denial of service (file descriptor consumption).


KDE Konqueror 3.5.1 and earlier allows remote attackers to cause a denial of service (application crash) by calling the replaceChild method on a DOM object which triggers a null dereference as demonstrated by calling document.replaceChild with a 0 (zero) argument.


Unspecified vulnerability in the sctp_make_abort_user function in the SCTP implementation in Linux 2.6.x before 2.6.17.10 and 2.4.23 up to 2.4.33 allows local users to cause a denial of service (panic) and possibly gain root privileges via unknown attack vectors.


OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled error condition.


The LZW decoding in the gdImageCreateFromGifPtr function in the Thomas Boutell graphics draw (GD) library (aka libgd) 2.0.33 allows remote attackers to cause a denial of service (CPU consumption) via malformed GIF data that causes an infinite loop.


Unspecified vulnerability in MyDNS 1.1.0 allows remote attackers to cause a denial of service via a crafted DNS message aka \Query-of-death \ as demonstrated by the OUSPG PROTOS DNS test suite.


The recursor in PowerDNS before 3.0.1 allows remote attackers to cause a denial of service (application crash) via malformed EDNS0 packets.


The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4 and 2.6.16 before 2.6.16.24 allows a local user to cause a denial of service (disk consumption) and possibly gain privileges via the PR_SET_DUMPABLE argument of the prctl function and a program that causes a core dump file to be created in a directory for which the user does not have permissions.


libs/comverp.c in Courier MTA before 0.53.2 allows attackers to cause a denial of service (CPU consumption) via unknown vectors involving usernames that contain the \=\ (equals) character which is not properly handled during encoding.


Avahi before 0.6.10 allows local users to cause a denial of service (mDNS/DNS-SD service disconnect) via unspecified mDNS name conflicts.


3Com Baseline Switch 2848-SFP Plus Model #3C16486 with firmware before 1.0.2.0 allows remote attackers to cause a denial of service (unstable operation) via long DHCP packets.


Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver application that cannot process the messages quickly enough which leads to \spillover of the receive buffer.\


Pioneers meta-server before 0.9.55 when the server-console is not installed allows remote attackers to cause a denial of service (crash) via certain requests from an older gnocatan client to create a new game.


Mailman before 2.1.9rc1 allows remote attackers to cause a denial of service via unspecified vectors involving \standards-breaking RFC 2231 formatted headers\.


The Internet Key Exchange version 1 (IKEv1) implementation in the libike library in Solaris 9 and 10 allows remote attackers to cause a denial of service (in.iked daemon crash) via crafted IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.


The ECNE chunk handling in Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (kernel panic) via an unexpected chunk when the session is in CLOSED state.


The snmp_trap_decode function in the SNMP NAT helper for Linux kernel before 2.6.16.18 allows remote attackers to cause a denial of service (crash) via unspecified remote attack vectors that cause failures in snmp_trap_decode that trigger (1) frees of random memory or (2) frees of previously-freed memory (double-free) by snmp_trap_decode as well as its calling function as demonstrated via certain test cases of the PROTOS SNMP test suite.


Phex before 2.8.6 allows remote attackers to cause a denial of service (application hang) by initiating multiple chat requests to a single user and then logging off.


xmcdconfig in xmcd for Debian GNU/Linux 2.6-17.1 creates /var/lib/cddb and /var/lib/xmcd/discog with world writable permissions which allows local users to cause a denial of service (disk consumption).


Sun Java Runtime Environment (JRE) 1.5.0_6 and earlier JDK 1.5.0_6 and earlier and SDK 1.5.0_6 and earlier allows remote attackers to cause a denial of service (disk consumption) by using the Font.createFont function to create temporary files of arbitrary size in the %temp% directory.


Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (infinite recursion and crash) via a packet that contains two or more DATA fragments which causes an skb pointer to refer back to itself when the full message is reassembled leading to infinite recursion in the sctp_skb_pull function.


IE Tab 1.0.9 plugin for Mozilla Firefox 1.5.0.3 allows remote user-assisted attackers to cause a denial of service (application crash) possibly due to a null dereference via certain Javascript as demonstrated using a url parameter to the content/reloaded.html page in a chrome:// URI. Some third-party researchers claim that they are unable to reproduce this vulnerability.


Multiple unspecified vulnerabilities in multiple FITELnet products including FITELnet-F40 F80 F100 F120 F1000 and E20/E30 allow remote attackers to cause a denial of service via crafted DNS messages that trigger errors in (1) ProxyDNS or (2) PKI-Resolver as demonstrated by the OUSPG PROTOS DNS test suite.


ftutil.c in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a crafted font file that triggers a null dereference.


Eitsop My Web Server 1.0 allows remote attackers to cause a denial of service (application crash) via a long GET request. NOTE: CVE analysis suggests that this is a different product and therefore a different vulnerability than CVE-2002-1897.


GNUnet before SVN revision 2781 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an empty UDP datagram possibly involving FIONREAD errors.


OpenSSL 0.9.7 before 0.9.7l 0.9.8 before 0.9.8d and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) \public exponent\ or (2) \public modulus\ values in X.509 certificates that require extra time to process when using RSA signature verification.


The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to 2.6.17 and possibly later versions allows local users to cause a denial of service (memory consumption) by writing more data to the serial port than the hardware can handle which causes the data to be queued.


The client_cmd function in Empire 4.3.2 and earlier allows remote attackers to cause a denial of service (application crash) by causing long text strings to be appended to the player->client buffer which causes an invalid memory access.


A regression error in the restore_all code path of the 4/4GB split support for non-hugemem Linux kernels on Red Hat Linux Desktop and Enterprise Linux 4 allows local users to cause a denial of service (panic) via unspecified vectors.


Linux kernel before 2.6.16.21 and 2.6.17 when running on PowerPC does not perform certain required access_ok checks which allows local users to read arbitrary kernel memory on 64-bit systems (signal_64.c) and cause a denial of service (crash) and possibly read kernel memory on 32-bit systems (signal_32.c).


Ingate Firewall in the SIP module before 4.4.1 and SIParator before 4.4.1 when TLS is enabled or when SSL/TLS is enabled in the web server allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake.


bgpd in Quagga 0.98 and 0.99 before 20060504 allows local users to cause a denial of service (CPU consumption) via a certain sh ip bgp command entered in the telnet interface.


The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4 XP SP1 and SP2 and Server 2003 SP1 and earlier allows local users to cause a denial of service (hang) by calling the MrxSmbCscIoctlCloseForCopyChunk with the file handle of the shadow device which results in a deadlock aka the \SMB Invalid Handle Vulnerability.\


Nessus before 2.2.8 and 3.x before 3.0.3 allows user-assisted attackers to cause a denial of service (memory consumption) via a NASL script that calls split with an invalid sep parameter. NOTE: a design goal of the NASL language is to facilitate sharing of security tests by guaranteeing that a script \can not do anything nasty.\ This issue is appropriate for CVE only if Nessus users have an expectation that a split statement will not use excessive memory.


A third-party installer generation tool possibly BitRock InstallBuilder as used in products including Process-one ejabberd 1.1.1_1 and earlier generates an installer that allows local users to cause a denial of service via a symlink attack on the bitrock_installer.log temporary file. NOTE: it is possible that this vulnerability is present in other products that use this installer.


The setFrame function in Lib/2D/Surface.hpp for NetPanzer 0.8 and earlier allows remote attackers to cause a denial of service (crash) via a client flag (frameNum) that is greater than 41 which triggers an assert error.


Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (kernel panic) via incoming IP fragmented (1) COOKIE_ECHO and (2) HEARTBEAT SCTP control chunks.


S24EvMon.exe in the Intel PROset/Wireless software possibly 10.1.0.33 uses a S24EventManagerSharedMemory shared memory section with weak permissions which allows local users to read or modify passwords or other data or cause a denial of service.


SCTP conntrack (ip_conntrack_proto_sctp.c) in netfilter for Linux kernel 2.6.17 before 2.6.17.3 and 2.6.16 before 2.6.16.23 allows remote attackers to cause a denial of service (crash) via a packet without any chunks which causes a variable to contain an invalid value that is later used to dereference a pointer.


Memory leak in Paul Rombouts pdnsd before 1.2.4 allows remote attackers to cause a denial of service (memory consumption) via a DNS query with an unsupported (1) QTYPE or (2) QCLASS as demonstrated by the OUSPG PROTOS DNS test suite.


OpenVPN 2.0.7 and earlier when configured to use the --management option with an IP that is not 127.0.0.1 uses a cleartext password for TCP sessions to the management interface which might allow remote attackers to view sensitive information or cause a denial of service.


Unspecified versions of Mozilla Firefox allow remote attackers to cause a denial of service (crash) via a web page that contains a large number of nested marquee tags. NOTE: a followup post indicated that the initial report could not be verified.


Multiple vulnerabilities in libtiff before 3.8.1 allow context-dependent attackers to cause a denial of service via a TIFF image that triggers errors in (1) the TIFFFetchAnyArray function in (a) tif_dirread.c; (2) certain \codec cleanup methods\ in (b) tif_lzw.c (c) tif_pixarlog.c and (d) tif_zip.c; (3) and improper restoration of setfield and getfield methods in cleanup functions within (e) tif_jpeg.c tif_pixarlog.c (f) tif_fax3.c and tif_zip.c.


The audio_write function in NetBSD 3.0 allows local users to cause a denial of service (kernel crash) by using the audiosetinfo ioctl to change the sample rate of an audio device.


Kerio WinRoute Firewall before 6.2.1 allows remote attackers to cause a denial of service (application crash) via unknown vectors in the \email protocol inspectors \ possibly (1) SMTP and (2) POP3.


Mozilla Firefox 1.5.0.3 allows remote attackers to cause a denial of service via a web page with a large number of IMG elements in which the SRC attribute is a mailto URI. NOTE: another researcher found that the web page caused a temporary browser slowdown instead of a crash.


The embedded HTTP server in Fuji Xerox Printing Systems (FXPS) print engine as used in products including (1) Dell 3000cn through 5110cn and (2) Fuji Xerox DocuPrint firmware before 20060628 and Network Option Card firmware before 5.13 does not properly perform authentication for HTTP requests which allows remote attackers to modify system configuration via crafted requests including changing the administrator password or causing a denial of service to the print server.


Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 might allow attackers to cause a denial of service via format string specifiers in an MP3 filename specified on the command line. NOTE: this is a different vulnerability than CVE-2006-1905. In addition if the only attack vectors involve a user-assisted local command line argument of a non-setuid program this issue might not be a vulnerability.


Unspecified vulnerability in ISC BIND allows remote attackers to cause a denial of service via a crafted DNS message with a \broken\ TSIG as demonstrated by the OUSPG PROTOS DNS test suite.


The leetnet functions (leetnet/rudp.cpp) in Outgun 1.0.3 bot 2 and earlier allow remote attackers to cause a denial of service (game interruption) via large packets which cause an exception to be thrown.


The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a long argument to the MAIL command.


The parse_command function in Genecys 0.2 and earlier allows remote attackers to cause a denial of service (crash) via a command with a missing \:\ (colon) separator which triggers a null dereference.


Multiple Apple Mac OS X 10.4 applications might allow context-dependent attackers to cause a denial of service (application crash) via a crafted OpenEXR (.exr) image file which triggers the crash when opening a folder using Finder displaying the image in Safari or using Preview to open the file.


Evolution 2.2.x and 2.3.x in GNOME 2.7 and 2.8 when \load images if sender in addressbook\ is enabled allows remote attackers to cause a denial of service (persistent crash) via a crafted \From\ header that triggers an assert error in camel-internet-address.c when a null pointer is used.


The Allied Telesyn AT-9724TS switch allows remote attackers to cause a denial of service via a large amount of UDP data to the switch which leads to unstable operation and possibly failure of the management interface or routing.


raydium_network_netcall_exec function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to cause a denial of service (application crash) via a packet of type 0xFF which causes a null dereference.


Memory leak in Microsoft Internet Explorer 6 for Windows XP Service Pack 2 allows remote attackers to cause a denial of service (memory consumption) via JavaScript that uses setInterval to repeatedly call a function to set the value of window.status.


OpenSSH on FreeBSD 5.3 and 5.4 when used with OpenPAM does not properly handle when a forked child process terminates during PAM authentication which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server waiting for the password prompt then disconnecting.


The Internet Key Exchange version 1 (IKEv1) implementation in Avaya VSU 100 2000 7500 10000 and CSU 5000 when running IPSec allows remote attackers to cause a denial of service (crash) via certain IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


Cerulean Trillian 3.1.0.120 allows remote attackers to cause a denial of service (client crash) via an AIM message containing the Mac encoded Rich Text Format (RTF) escape sequences (1) \\'d1 (2) \\'d2 (3) \\'d3 (4) \\'d4 and (5) \\'d5. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The ipfw firewall in FreeBSD 6.0-RELEASE allows remote attackers to cause a denial of service (firewall crash) via ICMP IP fragments that match a reset reject or unreach action which leads to an access of an uninitialized pointer.


Multiple unspecified vulnerabilities in IBM Lotus Notes and Domino Server before 6.5.5 have unknown impact and attack vectors due to \potential security issues\ as identified by SPR numbers (1) GPKS6C9J67 in Agents (2) JGAN6B6TZ3 and (3) KSPR699NBP in the Router (4) GPKS5YQGPT in Security or (5) HSAO6BNL6Y in the Web Server. NOTE: vector 3 is related to an issue in NROUTER in IBM Lotus Notes and Domino Server before 6.5.4 FP1 6.5.5 and 7.0 which allows remote attackers to cause a denial of service (CPU consumption) via a crafted vCal meeting request sent via SMTP (aka SPR# KSPR699NBP).


RockLiffe MailSite HTTP Mail management agent (httpma) 7.0.3.1 allows remote attackers to cause a denial of service (CPU consumption and crash) via a malformed query string containing special characters such as \|\.


Linksys BEFVP41 VPN Router 2.0 with firmware 1.01.04 allows remote attackers on the local network to cause a denial of service via IP packets with a null IP option length.


PostgreSQL 7.3.x before 7.3.14 7.4.x before 7.4.12 8.0.x before 8.0.7 and 8.1.x before 8.1.3 when compiled with Asserts enabled allows local users to cause a denial of service (server crash) via a crafted SET SESSION AUTHORIZATION command a different vulnerability than CVE-2006-0553.