Northern Solutions Xeneo Web Server 2.1.0.0 2.0.759.6 and other versions before 2.1.5 allows remote attackers to cause a denial of service (crash) via a GET request for a \%\ URI.


IBM SecureWay Firewall before 4.2.2 performs extra processing before determining that a packet is invalid and dropping it which allows remote attackers to cause a denial of service (resource exhaustion) via a flood of malformed TCP packets without any flags set.


Cisco SN 5420 Storage Router 1.1(5) and earlier allows remote attackers to cause a denial of service (halt) via a fragmented packet to the Gigabit interface.


Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to cause a denial of service (crash) via an object of type \text/html\ with the DATA field that identifies the HTML document that contains the object which may cause infinite recursion.


Simple Web Server (SWS) 0.0.4 through 0.1.0 does not close file descriptors for 404 error messages which could allow remote attackers to cause a denial of service (file descriptor exhaustion) via multiple requests for pages that do not exist.


CGIForum 1.0 through 1.05 allows remote attackers to cause a denial of service (infinite recursion) by creating a message board post that is a child of an outdated parent.


Memory leak in ypdb_open in yp_db.c for ypserv before 2.5 in the NIS package 3.9 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of requests for a map that does not exist.


ZyXEL Prestige 642R allows remote attackers to cause a denial of service in the Telnet FTP and DHCP services (crash) via a TCP packet with both the SYN and ACK flags set.


HP-UX 11.11 and earlier allows local users to cause a denial of service (kernel deadlock) due to a \file system weakness\ that is possibly via an mmap() system call and performing an I/O operation using data from the mapped buffer on the file descriptor for the mapped file.


Kerio MailServer 5.0 allows remote attackers to cause a denial of service (hang) via SYN packets to the supported network services.


ArGoSoft Mail Server 1.8.1.7 and earlier allows a webmail user to cause a denial of service (CPU consumption) by forwarding the email to the user while autoresponse is enabled which creates an infinite loop.


Tiny Personal Firewall 3.0 through 3.0.6 allows remote attackers to cause a denial of service (crash) by via SYN UDP ICMP and TCP portscans when the administrator selects the Log tab of the Personal Firewall Agent module.


Simple Web Server (SWS) 0.0.4 through 0.1.0 does not properly handle when the recv function call fails which may allow remote attackers to overwrite program data or perform actions on an uninitialized heap leading to a denial of service and possibly code execution.


dump 0.4 b10 through b29 allows local users to cause a denial of service (execution prevention) by using flock() to lock the /etc/dumpdates file.


nullmailer 1.00RC5 and earlier allows local users to cause a denial of service via an email to a local user that does not exist which generates an error that causes nullmailer to stop sending mail to all users.


The

IRC

component

of

Trillian

and

allows

remote

malicious

IRC

servers

to

cause

a

denial

of

service

(crash)

by

sending

the

raw

messages

and


Linux kernel 2.2.x allows local users to cause a denial of service (crash) by using the mmap() function with a PROT_READ parameter to access non-readable memory pages through the /proc/pid/mem interface.


Macromedia Flash Player 4.0 r12 through 6.0.47.0 allows remote attackers to cause a denial of service (web browser crash) via malformed content in a Flash Shockwave (.SWF) file as demonstrated by by ROT13 encoding the body of the file but not the headers.


anlgform.pl in Analog before 5.23 does not restrict access to the PROGRESSFREQ progress update command which allows remote attackers to cause a denial of service (disk consumption) by using the command to report updates more frequently and fill the web server error log.


BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist with an OPT resource record with a large UDP payload size.


Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with a Host header that contains a large number of \/\ (forward slash) characters.


Sendmail 8.9.0 through 8.12.3 allows local users to cause a denial of service by obtaining an exclusive lock on the (1) alias (2) map (3) statistics and (4) pid files.


Thomas Hauck Jana Server 2.x through 2.2.1 and 1.4.6 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of FTP PASV requests which consumes all available FTP ports.


The BGP decoding routines in tcpdump 3.6.x before 3.7 do not properly copy data which allows remote attackers to cause a denial of service (application crash).


The Sun Microsystems RPC library Services for Unix 3.0 Interix SD as implemented on Microsoft Windows NT4 2000 and XP allows remote attackers to cause a denial of service (service hang) via malformed packet fragments aka \Improper parameter size check leading to denial of service.\


Microsoft Windows 2000 allows remote attackers to cause a denial of service (memory consumption) by sending a flood of empty TCP/IP packets with the ACK and FIN bits set to the NetBIOS port (TCP/139) as demonstrated by stream3.


ParaChat Server 4.0 does not log users off if the browser's back button is used which allows remote attackers to cause a denial of service by repeatedly logging into a chat room hitting the back button then logging into the same chat room as a different user which fills the chat room with invalid users.


IBM Web Traffic Express Caching Proxy Server 3.6 and 4.x before 4.0.1.26 allows remote attackers to cause a denial of service (crash) via an HTTP request to helpout.exe with a missing HTTP version number which causes ibmproxy.exe to crash.


Dynamic VPN Configuration Protocol service (DVCP) in Watchguard Firebox firmware 5.x.x allows remote attackers to cause a denial of service (crash) via a malformed packet containing tab characters to TCP port 4110.


Mac OS X 10.2.2 allows remote attackers to cause a denial of service by accessing the CUPS Printing Web Administration utility aka \CUPS Printing Web Administration is Remotely Accessible.\


Macromedia Flash Player 6 does not terminate connections when the user leaves the web page which allows remote attackers to cause a denial of service (bandwidth resource and CPU consumption) via the (1) loadMovie or (2) loadSound commands which continue to execute until the browser is closed.


IPSwitch IMail Web Calendaring service (iwebcal) allows remote attackers to cause a denial of service (crash) via an HTTP POST request without a Content-Length field.


IBM AIX 4.3.3 and AIX 5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a flood of malformed TCP packets without any flags set which prevents AIX from releasing the associated memory buffers.


The

Microsoft

Java

virtual

machine

(VM)

build

and

earlier

as

used

in

Internet

Explorer

allows

remote

attackers

to

extend

the

Standard

Security

Manager

(SSM)

class

(com.ms.security.StandardSecurityManager)

and

bypass

intended

StandardSecurityManager

restrictions

by

modifying

the

deniedDefinitionPackages

or

deniedAccessPackages

settings

causing

a

denial

of

service

by

adding

Java

applets

to

the

list

of

applets

that

are

prevented

from

running.


The getmxrecord function in Fetchmail 6.0.0 and earlier does not properly check the boundary of a particular malformed DNS packet from a malicious DNS server which allows remote attackers to cause a denial of service (crash) when Fetchmail attempts to read data beyond the expected boundary.


Unknown vulnerability in ping in HP Tru64 UNIX 5.1a 5.1 5.0a 4.0g and 4.0f allows local users to cause a denial of service.


mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr which results in a read/write deadlock between httpd and the CGI script.


The handle_var_requests function in snmp_agent.c for the SNMP daemon in the Net-SNMP (formerly ucd-snmp) package 5.0.1 through 5.0.5 allows remote attackers to cause a denial of service (crash) via a NULL dereference.


The administrative web interface (STEMWADM) for SurfControl SuperScout Email Filter allows remote attackers to cause a denial of service (resource exhaustion) via a GET request without the terminating /r/n/r/n (CRLF) sequence which causes the interface to wait for the sequence and blocks other users from accessing it.


SAP GUI (Sapgui) 4.6D allows remote attackers to cause a denial of service (crash) via a connection to a high-numbered port which generates an \unknown connection data\ error.


An input validation error in the Sun Microsystems RPC library Services for Unix 3.0 Interix SD as implemented on Microsoft Windows NT4 2000 and XP allows remote attackers to cause a denial of service via malformed fragmented RPC client packets aka \Denial of service by sending an invalid RPC request.\


The Web-Based Enterprise Management (WBEM) packages (1) SUNWwbdoc (2) SUNWwbcou (3) SUNWwbdev and (4) SUNWmgapp packages when installed using Solaris 8 Update 1/01 or later install files with world or group write permissions which allows local users to gain root privileges or cause a denial of service.


SCO UnixWare 7.1.1 and Open UNIX 8.0.0 allows local users to cause a denial of service via an rcp call on /proc.


PostgreSQL 7.2.1 and 7.2.2 allows local users to delete transaction log (pg_clog) data and cause a denial of service (data loss) via the VACUUM command.


Unreal Tournament 2003 (ut2003) clients and servers allow remote attackers to cause a denial of service via malformed messages containing a small number of characters to UDP ports 7778 or 10777.


Unknown vulnerability in inetd in HP Tru64 Unix 4.0f through 5.1a allows remote attackers to cause a denial of service via unknown attack vectors.


ZyXEL Prestige 642R 2.50(FA.1) and Prestige 310 V3.25(M.01) allows remote attackers to cause a denial of service via an oversized fragmented \jolt\ style ICMP packet.


Ultrafunk Popcorn 1.20 allows remote attackers to cause a denial of service (crash) via a malformed Subject (\\\t\\t\).


Linux kernel 2.4.1 through 2.4.19 sets root's NR_RESERVED_FILES limit to 10 files which allows local users to cause a denial of service (resource exhaustion) by opening 10 setuid binaries.


The virtual memory management system in FreeBSD 4.5-RELEASE and earlier does not properly check the existence of a VM object during page invalidation which allows local users to cause a denial of service (crash) by calling msync on an unaccessed memory map created with MAP_ANON and MAP_NOSYNC flags.


tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.


Omnicron OmniHTTPd 2.09 allows remote attackers to cause a denial of service (crash) via an HTTP request with a long malformed HTTP 1version number.


The Sabserv client component in Sabre Desktop Reservation Software 4.2 through 4.4 allows remote attackers to cause a denial of service via malformed input to TCP port 1001.


The LAN-to-LAN IPSEC capability for Cisco VPN 3000 Concentrator 2.2.x and 3.x before 3.5.4 allows remote attackers to cause a denial of service via an incoming LAN-to-LAN connection with an existing security association with another device on the remote network which causes the concentrator to remove the previous connection.


HTML interface for Cisco VPN 3000 Concentrator 2.x.x and 3.x.x before 3.0.3(B) allows remote attackers to cause a denial of service (CPU consumption) via a long URL request.


The Post_Method function in method.c for Monkey HTTP Daemon before 0.5.1 allows remote attackers to cause a denial of service (crash) via a POST request with an invalid or missing Content-Length header value.


ptrace on HP-UX 11.00 through 11.11 allows local users to cause a denial of service (data page fault panic) via \an incorrect reference to thread register state.\


BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times which are removed from the internal BIND database and later cause a null dereference.


Res Manager in Worldspan for Windows Gateway 4.1 allows remote attackers to cause a denial of service (crash) via a malformed request to TCP port 17990.


Imatix Xitami 2.5 b5 does not properly terminate certain Keep-Alive connections that have been broken or closed early which allows remote attackers to cause a denial of service (crash) via a large number of concurrent sessions.


Evolution 1.0.3 and 1.0.4 allows remote attackers to cause a denial of service (memory consumption and crash) via an email with a malformed MIME header.


The library feature for Adobe Content Server 3.0 does not verify if a customer has already checked out an eBook which allows remote attackers to cause a denial of service (resource exhaustion) by checking out the same book multiple times.


Norton Antivirus in Norton Internet Security 15.5.0.23 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2) e-mail messages with many \Content-type: message/rfc822;\ headers which allows remote attackers to cause a denial of service (stack consumption or other resource consumption) via a large e-mail message a related issue to CVE-2006-1173.


Memory leak in WebKit.dll in WebKit as used by Apple Safari 3.2 on Windows Vista SP1 allows remote attackers to cause a denial of service (memory consumption and browser crash) via a long ALINK attribute in a BODY element in an HTML document.


The PGPwded device driver (aka PGPwded.sys) in PGP Corporation PGP Desktop 9.0.6 build 6060 and 9.9.0 build 397 allows local users to cause a denial of service (system crash) and possibly gain privileges via a certain METHOD_BUFFERED IOCTL request that overwrites portions of memory related to a \Driver Collapse.\ NOTE: some of these details are obtained from third party information.


The web server in IEA Software RadiusNT and RadiusX 5.1.38 and other versions before 5.1.44 Emerald 5.0.49 and other versions before 5.0.52 Air Marshal 2.0.4 and other versions before 2.0.8 and Radius test client (aka Radlogin) 4.0.20 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP Content-Length header with a negative value which triggers a single byte overwrite of memory using a NULL terminator. NOTE: some of these details are obtained from third party information.


Multiple unspecified vulnerabilities in the UNIStim File Transfer Protocol (UFTP) processing in IP Client Manager (IPCM) in Nortel Multimedia Communication Server (MSC) 5100 3.0.13 allow remote attackers to cause a denial of service (device outage) via a UFTP message that has a negative block size or other crafted Connection Details values.


KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash or hang) via certain (1) APPE (2) CWD (3) DELE (4) MKD (5) RMD (6) RETR (7) RNFR (8) RNTO (9) SIZE and (10) STOR commands.


chm2pdf 0.9 uses temporary files in directories with fixed names which allows local users to cause a denial of service (chm2pdf failure) of other users by creating those directories ahead of time.


net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8 and earlier allows local users to cause a denial of service (kernel infinite loop) by making two calls to svc_listen for the same socket and then reading a /proc/net/atm/*vc file related to corruption of the vcc table.


Sun ScApp firmware 5.18.x 5.19.x and 5.20.0 through 5.20.10 on Sun Fire and Netra platforms allows remote attackers to access the System Controller (SC) the system console and possibly the host OS and cause a denial of service (shutdown or reboot) via spoofed IP packets.


Unspecified vulnerability in the socket function in Sun Solaris 10 and OpenSolaris snv_57 through snv_91 when InfiniBand hardware is not installed allows local users to cause a denial of service (panic) via unknown vectors related to the socksdpv_close function.


Multiple array index errors in the HTTP server in Darkwet Network webcamXP 3.72.440.0 and earlier and beta 4.05.280 and earlier allow remote attackers to cause a denial of service (device crash) and read portions of memory via (1) an invalid camnum parameter to the pocketpc component and (2) an invalid id parameter to the show_gallery_pic component.


xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via \MP3 files with metadata consisting only of separators.\


Linux kernel 2.6.28 allows local users to cause a denial of service (\soft lockup\ and process loss) via a large number of sendmsg function calls which does not block during AF_UNIX garbage collection and triggers an OOM condition a different vulnerability than CVE-2008-5029.


Unspecified vulnerability in the X Inter Client Exchange library (aka libICE) in Sun Solaris 8 through 10 and OpenSolaris before snv_85 allows context-dependent attackers to cause a denial of service (application crash) as demonstrated by a port scan that triggers a segmentation violation in the Gnome session manager (aka gnome-session).


Aruba Mobility Controller 2.4.8.x-FIPS 2.5.x 3.1.x 3.2.x 3.3.1.x and 3.3.2.x allows remote attackers to cause a denial of service (device crash) via a malformed Extensible Authentication Protocol (EAP) frame.


XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument to the NLST command as demonstrated by a -1 argument.


The layout engine in Mozilla Firefox 3.x before 3.0.5 Thunderbird 2.x before 2.0.0.19 and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service via vectors that trigger an assertion failure.


The layout engine in Mozilla Firefox 3.x before 3.0.4 Thunderbird 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an assertion failure or other consequences.


The

originates_from_local_legacy_unicast_socket

function

(avahi-core/server.c)

in

avahi-daemon

in

Avahi

before

allows

remote

attackers

to

cause

a

denial

of

service

(crash)

via

a

crafted

mDNS

packet

with

a

source

port

of

which

triggers

an

assertion

failure.


Mozilla Firefox 3.0.5 on Windows Vista allows remote attackers to cause a denial of service (application crash) via JavaScript code with a long string value for the hash property (aka location.hash). NOTE: it was later reported that earlier versions are also affected and that the impact is CPU consumption and application hang in unspecified circumstances perhaps involving other platforms.


HTMLTokenizer::scriptHandler in Konqueror in KDE 3.5.9 and 3.5.10 allows remote attackers to cause a denial of service (application crash) via an invalid document.load call that triggers use of a deleted object. NOTE: some of these details are obtained from third party information.


Kaspersky Internet Security Suite 2009 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2) e-mail messages with many \Content-type: message/rfc822;\ headers which allows remote attackers to cause a denial of service (stack consumption or other resource consumption) via a large e-mail message a related issue to CVE-2006-1173.


Array index error in arch/mips/kernel/scall64-o32.S in the Linux kernel before 2.6.28-rc8 on 64-bit MIPS platforms allows local users to cause a denial of service (system crash) via an o32 syscall with a small syscall number which leads to an attempted read operation outside the bounds of the syscall table.


Integer underflow in demux_qt.c in xine-lib 1.1.12 and other 1.1.15 and earlier versions allows remote attackers to cause a denial of service (crash) via a crafted media file that results in a small value of moov_atom_size in a compressed MOV (aka CMOV_ATOM).


The Kerberos credential renewal feature in Sun Solaris 8 9 and 10 and OpenSolaris build snv_01 through snv_104 allows local users to cause a denial of service (authentication failure) via unspecified vectors related to incorrect cache file permissions and lack of credential storage by the store_cred function in pam_krb5.


Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted JPEG file related to the cli_check_jpeg_exploit jpeg_check_photoshop and jpeg_check_photoshop_8bim functions.


The chip_command function in drivers/media/video/tvaudio.c in the Linux kernel 2.6.25.x before 2.6.25.19 2.6.26.x before 2.6.26.7 and 2.6.27.x before 2.6.27.3 allows attackers to cause a denial of service (NULL function pointer dereference and OOPS) via unknown vectors.


Microsoft Communicator allows remote attackers to cause a denial of service (application or device outage) via instant messages containing large numbers of emoticons.


webseald in WebSEAL 6.0.0.17 in IBM Tivoli Access Manager for e-business allows remote attackers to cause a denial of service (crash or hang) via HTTP requests as demonstrated by a McAfee vulnerability scan.


Unspecified vulnerability in Trac before 0.11.2 allows attackers to cause a denial of service via unknown attack vectors related to \certain wiki markup.\


The __qdisc_run function in net/sched/sch_generic.c in the Linux kernel before 2.6.25 on SMP machines allows local users to cause a denial of service (soft lockup) by sending a large amount of network traffic as demonstrated by multiple simultaneous invocations of the Netperf benchmark application in UDP_STREAM mode.


RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that are used to create a large quota image.


vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash) via a malformed FLV file.


The parisc_show_stack function in arch/parisc/kernel/traps.c in the Linux kernel before 2.6.28-rc7 on PA-RISC allows local users to cause a denial of service (system crash) via vectors associated with an attempt to unwind a stack that contains userspace addresses.


Mozilla Thunderbird 2.0.14 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2) e-mail messages with many \Content-type: message/rfc822;\ headers which might allow remote attackers to cause a denial of service (stack consumption or other resource consumption) via a large e-mail message a related issue to CVE-2006-1173.


The highlighting functionality in geshi.php in GeSHi before 1.0.8 allows remote attackers to cause a denial of service (infinite loop) via an XML sequence containing an opening delimiter without a closing delimiter as demonstrated using \<\.


in.dhcpd in the DHCP implementation in Sun Solaris 8 through 10 and OpenSolaris before snv_103 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unknown DHCP requests related to the \number of offers \ aka Bug ID 6713805.


Opera 9.51 on Windows XP does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2) e-mail messages with many \Content-type: message/rfc822;\ headers which allows remote attackers to cause a denial of service (stack consumption or other resource consumption) via a large e-mail message a related issue to CVE-2006-1173.


The MimeOleClearDirtyTree function in InetComm.dll in Microsoft Outlook Express 6.00.2900.5512 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2) e-mail messages with many \Content-type: message/rfc822;\ headers which allows remote attackers to cause a denial of service (infinite loop) via a large e-mail message a related issue to CVE-2006-1173.


Memory leak in Libxul as used in Mozilla Firefox 3.0.5 and other products allows remote attackers to cause a denial of service (memory consumption and browser hang) via a long CLASS attribute in an HR element in an HTML document.


PythonScripts in Zope 2 2.11.2 and earlier as used in Conga and other products allows remote authenticated users to cause a denial of service (resource consumption or application halt) via certain (1) raise or (2) import statements.


The real_parse_audio_specific_data function in demux_real.c in xine-lib 1.1.12 and other 1.1.15 and earlier versions uses an untrusted height (aka codec_data_length) value as a divisor which allow remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero value.


Unspecified vulnerability in MyServer 0.8.11 allows remote attackers to cause a denial of service (daemon crash) via multiple invalid requests with the HTTP GET DELETE OPTIONS and possibly other methods related to a \204 No Content error.\


Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5 when realtime IAX2 users are enabled allows remote attackers to cause a denial of service (crash) via authentication attempts involving (1) an unknown user or (2) a user using hostname matching.


The Resource Monitoring and Control (RMC) daemon in IBM Hardware Management Console (HMC) 7 release 3.2.0 SP1 and 3.3.0 SP2 allows remote attackers to cause a denial of service (daemon crash or hang) via a packet with an invalid length.


The Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware allows remote attackers to cause a denial of service (device crash) via (1) a large value in the payload length field in an NDEF record or a certain length for a (2) tel: or (3) sms: NDEF URI.


The __scm_destroy function in net/core/scm.c in the Linux kernel 2.6.27.4 2.6.26 and earlier makes indirect recursive calls to itself through calls to the fput function which allows local users to cause a denial of service (panic) via vectors related to sending an SCM_RIGHTS message through a UNIX domain socket and closing file descriptors.


The real_parse_headers function in demux_real.c in xine-lib 1.1.12 and other 1.1.15 and earlier versions relies on an untrusted input length value to \reindex into an allocated buffer \ which allows remote attackers to cause a denial of service (crash) via a crafted value probably an array index error.


The JavaScript engine in Mozilla Firefox 3.x before 3.0.4 Firefox 2.x before 2.0.0.18 Thunderbird 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via vectors related to \insufficient class checking\ in the Date class.


PowerDNS before 2.9.21.2 allows remote attackers to cause a denial of service (daemon crash) via a CH HINFO query.


Unspecified vulnerability in Microsoft Office Communications Server (OCS) Office Communicator and Windows Live Messenger allows remote attackers to cause a denial of service (crash) via a crafted Real-time Transport Control Protocol (RTCP) receiver report packet.


ESet NOD32 2.70.0039.0000 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2) e-mail messages with many \Content-type: message/rfc822;\ headers which allows remote attackers to cause a denial of service (stack consumption or other resource consumption) via a large e-mail message a related issue to CVE-2006-1173.


An ActiveX control in prtstb06.dll in Microsoft Money 2006 when used with WScript in Windows Script Host (WSH) on Windows Vista allows remote attackers to cause a denial of service (access violation and application crash) via a zero value for the Startup property.


FastStone Image Viewer 3.6 allows user-assisted attackers to cause a denial of service (application crash) via a malformed BMP image with large width and height values possibly a related issue to CVE-2007-1942.


The PK11_SESSION cache in the OpenSSL PKCS#11 engine in Sun Solaris 10 does not maintain reference counts for operations with asymmetric keys which allows context-dependent attackers to cause a denial of service (failed cryptographic operations) via unspecified vectors related to the (1) RSA_sign and (2) RSA_verify functions.


The SSL web administration service in NetWin SmsGate 1.1n and earlier allows remote attackers to cause a denial of service (hang) via (1) a large integer in the Content-Length HTTP header; (2) an invalid value in the Content-Length HTTP header as demonstrated by a negative integer; or (3) a missing Content-Length HTTP header.


imudp in rsyslog 4.x before 4.1.2 3.21 before 3.21.9 beta and 3.20 before 3.20.2 generates a message even when it is sent by an unauthorized sender which allows remote attackers to cause a denial of service (disk consumption) via a large number of spurious messages.


Unspecified vulnerability in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier when using Kerberos authentication allows remote attackers to cause a denial of service (OS resource consumption) via unknown vectors.


Microsoft Communicator and Communicator in Microsoft Office 2010 beta allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE requests which trigger the creation of many sessions.


Multiple unspecified vulnerabilities in the ModSecurity (aka mod_security) module 2.5.0 through 2.5.5 for the Apache HTTP Server when SecCacheTransformations is enabled allow remote attackers to cause a denial of service (daemon crash) or bypass the product's functionality via unknown vectors related to \transformation caching.\


The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via (1) a long COLOR attribute in an HR element; or a long (a) BGCOLOR or (b) BORDERCOLOR attribute in a (2) TABLE (3) TD or (4) TR element. NOTE: the FONT vector is already covered by CVE-2008-4514.


Teamtek Universal FTP Server 1.0.44 allows remote attackers to cause a denial of service via (1) a certain CWD command (2) a long LIST command or (3) a certain PORT command.


xend in Xen 3.3.0 does not properly restrict a guest VM's write access within the /local/domain xenstore directory tree which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty (2) console/limit or (3) image/device-model-pid. NOTE: this issue exists because of erroneous set_permissions calls in the fix for CVE-2008-4405.


Incredimail build 5853710 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2) e-mail messages with many \Content-type: message/rfc822;\ headers which allows remote attackers to cause a denial of service (stack consumption or other resource consumption) via a large e-mail message a related issue to CVE-2006-1173.


Use-after-free vulnerability in the dissect_q931_cause_ie function in packet-q931.c in the Q.931 dissector in Wireshark 0.10.3 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via certain packets that trigger an exception.


A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that are not async-signal-safe in the signal handler for login timeouts which allows remote attackers to cause a denial of service (connection slot exhaustion) via multiple login attempts. NOTE: this issue exists because of an incorrect fix for CVE-2006-5051.


Nortel Networks UNIStim IP Phone 0604DAS allows remote attackers to cause a denial of service (crash) via a long ping packet (\ping of death\). NOTE: this issue could not be reproduced by a third party who tested it on 0604DAD. In addition the original researcher was not able to reliably reproduce the issue.


The HTTP_Request_Parser method in the HTTP Transport component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 allows remote attackers to cause a denial of service (controller 0C4 abend and application hang) via a long HTTP Host header related to \storage overlay\ on the stack and a \parse failure.\


sctp in Linux kernel before 2.6.25.18 allows remote attackers to cause a denial of service (OOPS) via an INIT-ACK that states the peer does not support AUTH which causes the sctp_process_init function to clean up active transports and triggers the OOPS when the T1-Init timer expires.


Unspecified vulnerability in the SQLNLS_UNPADDEDCHARLEN function in the New Compiler (aka Starburst derived compiler) component in the server in IBM DB2 9.1 before FP6 allows attackers to cause a denial of service (segmentation violation and trap) via unknown vectors.


natd in network_cmds in Apple Mac OS X before 10.5.6 when Internet Sharing is enabled allows remote attackers to cause a denial of service (infinite loop) via a crafted TCP packet.


The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via a font tag with a long color value which triggers an assertion error.


Microsoft Office SharePoint Server 2007 Gold and SP1 and Microsoft Search Server 2008 do not properly perform authentication and authorization for administrative functions which allows remote attackers to cause a denial of service (server load) obtain sensitive information and \create scripts that would run in the context of the site\ via requests to administrative URIs aka \Access Control Vulnerability.\


The Marvell driver for the Linksys WAP4400N Wi-Fi access point with firmware 1.2.14 on the Marvell 88W8361P-BEM1 chipset when WEP mode is enabled does not properly parse malformed 802.11 frames which allows remote attackers to cause a denial of service (reboot or hang-up) via a malformed association request containing the WEP flag as demonstrated by a request that is too short a different vulnerability than CVE-2008-1144 and CVE-2008-1197.


Konqueror in KDE 3.5.9 allows remote attackers to cause a denial of service (application crash) via Javascript that calls the alert function with a URL-encoded string of a large number of invalid characters.


Cisco Unity 4.x before 4.2(1)ES161 5.x before 5.0(1)ES53 and 7.x before 7.0(2)ES8 when using anonymous authentication (aka native Unity authentication) allows remote attackers to cause a denial of service (session exhaustion) via a large number of connections.


Unspecified vulnerability in a guest virtual device driver in VMware Workstation before 5.5.9 build 126128 and 6.5.1 and earlier 6.x versions; VMware Player before 1.0.9 build 126128 and 2.5.1 and earlier 2.x versions; VMware ACE before 1.0.8 build 125922 and 2.5.1 and earlier 2.x versions; VMware Server 1.x before 1.0.8 build 126538 and 2.0.x before 2.0.1 build 156745; VMware Fusion before 2.0.1; VMware ESXi 3.5; and VMware ESX 3.0.2 3.0.3 and 3.5 allows guest OS users to cause a denial of service (host OS crash) via unknown vectors.


Unspecified vulnerability in ISC BIND 9.3.5-P2-W1 9.4.2-P2-W1 and 9.5.0-P2-W1 on Windows allows remote attackers to cause a denial of service (UDP client handler termination) via unknown vectors.


Microsoft Windows Media Player (WMP) 9.0 through 11 allows user-assisted attackers to cause a denial of service (application crash) via a malformed (1) MIDI or (2) DAT file related to \MThd Header Parsing.\ NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Microsoft Windows Vista Home and Ultimate Edition SP1 and earlier allows local users to cause a denial of service (page fault and system crash) via multiple attempts to access a virtual address in a PAGE_NOACCESS memory page.


A certain ActiveX control in the Microsoft Internet Authentication Service (IAS) Helper COM Component in iashlpr.dll allows remote attackers to cause a denial of service (browser crash) via a large integer value in the first argument to the PutProperty method. NOTE: this issue was disclosed by an unreliable researcher so it might be incorrect.


Symbian OS S60 3rd edition on the Nokia E90 Communicator 07.40.1.2 Ra-6 and Nseries N82 allows remote attackers to cause a denial of service (device crash) via multiple deauthentication (DeAuth) frames.


smbd in Samba 3.0.29 through 3.2.4 might allow remote attackers to read arbitrary memory and cause a denial of service via crafted (1) trans (2) trans2 and (3) nttrans requests related to a \cut&paste error\ that causes an improper bounds check to be performed.


httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5 as used in Red Hat Enterprise Linux 4 and 5 allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.


Unspecified vulnerability in the Performance Monitoring Infrastructure (PMI) feature in the Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19 when a component statistic is enabled allows attackers to cause a denial of service (daemon crash) via vectors related to \a gradual degradation in performance.\


The IMAP server in Softalk Mail Server (formerly WorkgroupMail) 8.5.1.431 allows remote authenticated users to cause a denial of service (resource consumption and daemon crash) via a long IMAP APPEND command with certain repeated parameters.


srv.sys in the Server service in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 and Server 2008 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via an SMB WRITE_ANDX packet with an offset that is inconsistent with the packet size related to \insufficiently validating the buffer size \ as demonstrated by a request to the \\PIPE\\lsarpc named pipe aka \SMB Validation Denial of Service Vulnerability.\


packet-usb.c in the USB dissector in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via a malformed USB Request Block (URB).


Unspecified vulnerability in IBM Lotus Quickr 8.1 before Fix pack 1 (8.1.0.1) might allow attackers to cause a denial of service (system crash) via a \nonstandard URL argument\ to the OpenDocument command. NOTE: due to lack of details from the vendor it is not clear whether this is a vulnerability.


packet-frame in Wireshark 0.99.2 through 1.0.3 does not properly handle exceptions thrown by post dissectors which allows remote attackers to cause a denial of service (application crash) via a certain series of packets as demonstrated by enabling the (1) PRP or (2) MATE post dissector.


XRunSabre in sabre (aka xsabre) 0.2.4b relies on the ability to create /tmp/sabre.log which allows local users to cause a denial of service (application unavailability) by creating a /tmp/sabre.log file that cannot be overwritten.


A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cause a denial of service (browser crash) via a long string in the second argument to the GetObject method. NOTE: this issue was disclosed by an unreliable researcher so it might be incorrect.


The Virtual Token driver (vdlptokn.sys) 1.0.2.43 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) via a crafted IOCTL request to \\Device\\DLPTokenWalter0.


The message parsing feature in Dovecot 1.1.4 and 1.1.5 when using the FETCH ENVELOPE command in the IMAP client allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address which triggers an assertion error aka \invalid message address parsing bug.\


Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth connection to a peer with a long name which allows remote attackers to cause a denial of service (device reboot) by configuring a Bluetooth device with a long hci name and (1) connecting directly to the Windows Mobile system or (2) waiting for the Windows Mobile system to scan for nearby devices.


The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an XML schema definition with a large maxOccurs value which triggers excessive memory consumption during validation of an XML file.


Unspecified vulnerability in an unspecified Microsoft API as used by Cisco Unity and possibly other products allows remote attackers to cause a denial of service by sending crafted packets to dynamic UDP ports related to a \processing error.\


gdiplus.dll in GDI+ in Microsoft Windows XP SP3 does not properly handle crafted .ico files which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a certain crash.ico file on a web site and allows user-assisted attackers to cause a denial of service (divide-by-zero error and persistent application crash) via this crash.ico file on the desktop a different vulnerability than CVE-2007-2237.


The RPC subsystem in Sun Solaris 9 allows remote attackers to cause a denial of service (daemon crash) via a crafted request to procedure 8 in program 100000 (rpcbind) related to the XDR_DECODE operation and the taddr2uaddr function. NOTE: this might be a duplicate of CVE-2007-0165.


libxml2 2.7.0 and 2.7.1 does not properly handle \predefined entities definitions\ in entities which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) as demonstrated by use of xmllint on a certain XML document a different vulnerability than CVE-2003-1564 and CVE-2008-3281.


FFmpeg 0.4.9 as used by MPlayer allows context-dependent attackers to cause a denial of service (memory consumption) via unknown vectors aka a \Tcp/udp memory leak.\


Windows Explorer in Microsoft Windows XP SP3 allows user-assisted attackers to cause a denial of service (application crash) via a crafted .ZIP file.


Unspecified vulnerability in the database engine service in asdbapi.dll in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to cause a denial of service (crash) via a crafted request related to \insufficient validation.\


Unspecified vulnerability in the VLAN Trunking Protocol (VTP) implementation on Cisco IOS and CatOS when the VTP operating mode is not transparent allows remote attackers to cause a denial of service (device reload or hang) via a crafted VTP packet sent to a switch interface configured as a trunk port.


Mshtml.dll in Microsoft Internet Explorer 7 Gold 7.0.5730 and 8 Beta 8.0.6001 on Windows XP SP2 allows remote attackers to cause a denial of service (failure of subsequent image rendering) via a crafted PNG file related to an infinite loop in the CDwnTaskExec::ThreadExec function.


wtap.c in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application abort) via a malformed Tamos CommView capture file (aka .ncf file) with an \unknown/unexpected packet type\ that triggers a failed assertion.


The TCP implementation in (1) Linux (2) platforms based on BSD Unix (3) Microsoft Windows (4) Cisco products and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table as demonstrated by sockstress.


xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree and does not properly restrict a guest VM's write access within this tree which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty (2) console/limit or (3) image/device-model-pid. NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore but CVE is considering the core issue to be related to Xen.


fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function and subsequently attempts to unlock a page that was not locked which allows local users to cause a denial of service (kernel BUG and system crash) as demonstrated by the fio I/O tool.


Unspecified vulnerability in Sun Integrated Lights-Out Manager (ILOM) 2.0.1.5 through 2.0.4.26 allows remote authenticated users to (1) access the service processor (SP) and cause a denial of service (shutdown or reboot) or (2) access the host operating system and have an unspecified impact via unknown vectors.


The hfsplus_block_allocate function in fs/hfsplus/bitmap.c in the Linux kernel before 2.6.28-rc1 does not check a certain return value from the read_mapping_page function before calling kmap which allows attackers to cause a denial of service (system crash) via a crafted hfsplus filesystem image.


MPlayer allows remote attackers to cause a denial of service (application crash) via (1) a malformed AAC file as demonstrated by lol-vlc.aac; or (2) a malformed Ogg Media (OGM) file as demonstrated by lol-ffplay.ogm different vectors than CVE-2007-6718.


The kernel in Apple Mac OS X before 10.5.6 allows local users to cause a denial of service (infinite loop and system halt) by running an application that is dynamically linked to libraries on an NFS server related to occurrence of an exception in this application.


The dissect_btacl function in packet-bthci_acl.c in the Bluetooth ACL dissector in Wireshark 0.99.2 through 1.0.3 allows remote attackers to cause a denial of service (application crash or abort) via a packet with an invalid length related to an erroneous tvb_memcpy call.


Unspecified vulnerability in asdbapi.dll in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to cause a denial of service (crash of multiple services) via crafted authentication credentials related to \insufficient validation.\


Unspecified vulnerability in SOURCENEXT Virus Security ZERO 9.5.0173 and earlier and Virus Security 9.5.0173 and earlier allows remote attackers to cause a denial of service (memory consumption or application crash) via malformed compressed files. NOTE: some of these details are obtained from third party information.


Unspecified vulnerability in DCE in HP HP-UX B.11.11 B.11.23 and B.11.31 allows remote attackers to cause a denial of service via unknown vectors.


The CGI scripts in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and earlier allow remote attackers to cause a denial of service (resource exhaustion) via an HTTP POST request with a large Content-Length.


The IPv6 Neighbor Discovery Protocol (NDP) implementation on IBM zSeries servers does not validate the origin of Neighbor Discovery messages which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB) a related issue to CVE-2008-2476.


The p_exec_query function in src/dns_query.c in pdnsd before 1.2.7-par allows remote attackers to cause a denial of service (daemon crash) via a long DNS reply with many entries in the answer section related to a \dangling pointer bug.\


Michael Roth Software Personal FTP Server (PFT) 6.0f allows remote attackers to cause a denial of service (service crash) via multiple RETR commands possibly involving long filenames.


The vmi_write_ldt_entry function in arch/x86/kernel/vmi_32.c in the Virtual Machine Interface (VMI) in the Linux kernel 2.6.26.5 invokes write_idt_entry where write_ldt_entry was intended which allows local users to cause a denial of service (persistent application failure) via crafted function calls related to the Java Runtime Environment (JRE) experiencing improper LDT selector state a different vulnerability than CVE-2008-3247.


The Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.27 does not properly handle a protocol violation in which a parameter has an invalid length which allows attackers to cause a denial of service (panic) via unspecified vectors related to sctp_sf_violation_paramlen sctp_sf_abort_violation sctp_make_abort_violation and incorrect data types in function calls.


Unspecified vulnerability in Denora IRC Stats Server before 1.4.1 allows remote IRC servers to cause a denial of service (application crash) via a crafted CTCP response.


Unspecified vulnerability in VMware ESXi 3.5 before ESXe350-200901401-I-SG and ESX 3.5 before ESX350-200901401-SG allows local administrators to cause a denial of service (host crash) via a snapshot with a malformed VMDK delta disk.


Google Chrome 0.2.149.29 and 0.2.149.30 allows remote attackers to cause a denial of service (memory consumption) via an HTML document containing a carriage return (\\\r\\n\\r\\n\) argument to the window.open function.


Unspecified vulnerability in the \session limitation technique\ in the FTP service on Nortel Communications Server 1000 (CS1K) 4.50.x when running on VGMC or signaling nodes allows remote attackers to cause a denial of service (resource exhaustion and failed updates) via unknown vectors that causes consumption of all available sessions.


cart_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to cause a denial of service (excessive shopping carts) via a flood of requests.


Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments overwrite arbitrary files and cause a denial of service via encoded spaces in an xmpp:// URI a different vector than CVE-2008-6935 and CVE-2008-6936. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error.


Sophos Anti-Virus for Windows before 7.6.3 Anti-Virus for Windows NT/9x before 4.7.18 Anti-Virus for OS X before 4.9.18 Anti-Virus for Linux before 6.4.5 Anti-Virus for UNIX before 7.0.5 Anti-Virus for Unix and Netware before 4.37.0 Sophos EM Library and Sophos small business solutions when CAB archive scanning is enabled allows remote attackers to cause a denial of service (segmentation fault) via a \fuzzed\ CAB archive file as demonstrated by the OUSPG PROTOS GENOME test suite for Archive Formats.


Vertex4 SunAge 1.08.1 and earlier allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted join packet to UDP port 27960.


Foxy P2P software allows remote attackers to cause a denial of service (memory consumption) via a foxy URI with a download action and a large fs value.


wp-admin/upgrade.php in WordPress probably 2.6.x allows remote attackers to upgrade the application and possibly cause a denial of service (application outage) via a direct request.


The MultipacketReciever::RecievePacket function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (server termination) via a crafted packet without an expected 0xe0 or 0xe1 value which triggers the INT3 instruction.


HTC Touch Pro and HTC Touch Cruise vCard allows remote attackers to cause denial of service (CPU consumption SMS consumption and connectivity loss) via a flood of vCards to UDP port 9204.


NoticeWare Email Server NG 5.1.2.2 allows remote attackers to cause a denial of service (crash) via multiple POP3 requests with a long PASS command.


Google Chrome BETA (0.2.149.27) does not prompt the user before saving an executable file which makes it easier for remote attackers or malware to cause a denial of service (disk consumption) or exploit other vulnerabilities via a URL that references an executable file possibly related to the \ask where to save each file before downloading\ setting.


Unspecified vulnerability in Avaya IP Softphone 6.0 SP4 and 6.01.85 allows remote attackers to cause a denial of service (crash) via a large amount of H.323 data.


Pi3Web 2.0.3 before PL2 when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3 allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL which triggers the crash when the DLL load fails as demonstrated using Isapi\\users.txt.


The GDTdiIcpt.sys driver in G DATA AntiVirus 2008 InternetSecurity 2008 and TotalCare 2008 populates kernel registers with IOCTL 0x8317001c input values which allows local users to cause a denial of service (system crash) or gain privileges via a crafted IOCTL request as demonstrated by execution of the KeSetEvent function with modified register contents.


Unspecified vulnerability in SIP Enablement Services (SES) in Avaya Communication Manager 3.1.x and 4.x allows remote attackers to gain privileges and cause a denial of service via unknown vectors related to reuse of valid credentials.


The (1) sys32_mremap function in arch/sparc64/kernel/sys_sparc32.c the (2) sparc_mmap_check function in arch/sparc/kernel/sys_sparc.c and the (3) sparc64_mmap_check function in arch/sparc64/kernel/sys_sparc.c in the Linux kernel before 2.6.25.4 omit some virtual-address range (aka span) checks when the mremap MREMAP_FIXED bit is not set which allows local users to cause a denial of service (panic) via unspecified mremap calls a related issue to CVE-2008-2137.


The WLCCP dissector in Wireshark 0.99.7 through 1.0.4 allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.


The unpack feature in ClamAV 0.93.3 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a corrupted LZH file.


PumpKIN TFTP Server 2.7.2.0 allows remote attackers to cause a denial of service via a write request with a long mode field.


S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (crash) via a long nickname which triggers an exception.


nsrexecd.exe in multiple EMC Networker products including EMC NetWorker Server Storage Node and Client 7.3.x and 7.4 7.4.1 7.4.2 Client and Storage Node for Open VMS 7.3.2 ECO6 and earlier Module for Microsoft Exchange 5.1 and earlier Module for Microsoft Applications 2.0 and earlier Module for Meditech 2.0 and earlier and PowerSnap 2.4 SP1 and earlier does not properly control the allocation of memory which allows remote attackers to cause a denial of service (memory exhaustion) via multiple crafted RPC requests.


Unspecified vulnerability in GraphicsMagick before 1.2.3 allows remote attackers to cause a denial of service (crash) via unspecified vectors in DPX images. NOTE: some of these details are obtained from third party information.


3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service (unstable service or crash) via unspecified vectors as demonstrated by vulnerability scans from Nessus or SAINT.


Vertex4 SunAge 1.08.1 and earlier allows remote attackers to cause a denial of service (\runtime error\) via a crafted join packet to UDP port 27960 probably related to an invalid nickname command.


Titan FTP Server 6.26 build 630 allows remote attackers to cause a denial of service (CPU consumption) via the SITE WHO command.


The Neostrada Livebox ADSL Router allows remote attackers to cause a denial of service (network outage) via multiple HTTP requests for the /- URI.


The password_checker function in config/multiconfig.py in MoinMoin 1.6.1 uses the cracklib and python-crack features even though they are not thread-safe which allows remote attackers to cause a denial of service (segmentation fault and crash) via unknown vectors.


Google Chrome 0.2.149.27 allows user-assisted remote attackers to cause a denial of service (browser crash) via an IMG tag with a long src attribute which triggers the crash when the victim performs an \Inspect Element\ action.


Unspecified vulnerability in the NFSv4 client module in the kernel on Sun Solaris 10 and OpenSolaris before snv_37 when automountd is used allows user-assisted remote attackers to cause a denial of service (unresponsive NFS filesystems) via unknown vectors.


NetService.dll in Baidu Hi IM allows remote servers to cause a denial of service (client crash) via a crafted login response that triggers a divide-by-zero error.


Valve Software Half-Life Counter-Strike 1.6 allows remote attackers to cause a denial of service (crash) via multiple crafted login packets.


The pr_data_xfer function in ProFTPD before 1.3.2rc3 allows remote authenticated users to cause a denial of service (CPU consumption) via an ABOR command during a data transfer.


The Jura Internet Connection Kit for the Jura Impressa F90 coffee maker does not properly restrict access to privileged functions which allows remote attackers to cause a denial of service (physical damage) modify coffee settings and possibly execute code via a crafted request. NOTE: this issue is being included in CVE because the denial of service may include financial loss or water damage.


The tooltip manager (chrome/views/tooltip_manager.cc) in Google Chrome 0.2.149.29 Build 1798 and possibly other versions before 0.2.149.30 allows remote attackers to cause a denial of service (CPU consumption or crash) via a tag with a long title attribute which is not properly handled when displaying a tooltip a different vulnerability than CVE-2008-6994. NOTE: there is inconsistent information about the environments under which this issue exists.


Sophos PureMessage for Microsoft Exchange 3.0 before 3.0.2 allows remote attackers to cause a denial of service (EdgeTransport.exe termination) via a TNEF-encoded message with a crafted rich text body that is not properly handled during conversion to plain text. NOTE: this might be related to CVE-2008-7104.


Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System (OTRS) before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters which allows remote attackers to cause a denial of service (e-mail retrieval outage) via a crafted message.


** DISPUTED ** The standardise function in Anibal Monsalve Salazar sSMTP 2.61 and 2.62 allows local users to cause a denial of service (application exit) via an e-mail message containing a long line that begins with a . (dot) character. NOTE: CVE disputes this issue because it is solely a usability problem for senders of messages with certain long lines and has no security impact.


Siemens C450 IP and C475 IP VoIP devices allow remote attackers to cause a denial of service (disconnected calls and device reboot) via a crafted SIP packet to UDP port 5060.


Campaign/CampaignListener in the listener server in Unica Affinium Campaign 7.2.1.0.55 allows remote attackers to cause a denial of service (server crash) via a crafted length field that triggers (1) connection exhaustion or (2) memory allocation failure.


IBM Lotus Quickr 8.1 before 8100.003 services for Lotus Domino allows remote authenticated users to cause a denial of service (daemon crash) by clicking a download link aka SPR QCAO7E6AM8.


toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a long argument to the IsChecked method a different vector than CVE-2008-7136.


mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.


Sophos PureMessage Scanner service (PMScanner.exe) in PureMessage for Microsoft Exchange 3.0 before 3.0.2 allows remote attackers to cause a denial of service (message queue delay and incomplete spam rule update) via a crafted (1) RTF or (2) PDF file.


XySSL before 0.9 allows remote attackers to cause a denial of service (infinite loop) via an X.509 certificate that does not pass the RSA signature check during verification.


IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 does not properly handle the simultaneous changing of multiple passwords which makes it easier for remote authenticated users to cause a denial of service (DB2 daemon deadlock) by making password changes that trigger updates to a DB2 password-history table.


The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file.


The ftp_QUIT function in ftpserver.py in pyftpdlib before 0.5.0 allows remote authenticated users to cause a denial of service (file descriptor exhaustion and daemon outage) by sending a QUIT command during a disallowed data-transfer attempt.


mm/filemap.c in the Linux kernel before 2.6.25 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers an iovec of zero length followed by a page fault for an iovec of nonzero length.


Unspecified vulnerability in Fujitsu Interstage HTTP Server as used in Interstage Application Server Enterprise Edition 7.0.1 for Solaris allows attackers to cause a denial of service via unknown vectors related to SSL.


WS-Proxy in Eye-Fi 1.1.2 allows remote attackers to cause a denial of service (crash) via an empty query string to port 59278 and other unspecified vectors.


The installation of Sophos PureMessage for Microsoft Exchange 3.0 before 3.0.2 when both anti-virus and anti-spam are supported does not create or launch the associated scan engines when the system is under heavy load which has unspecified impact probably remote bypass of scanner protection or a denial of service (message loss or delay).


Unspecified vulnerability in Polipo before 1.0.4 allows remote attackers to cause a denial of service (crash) via a long request URL.


Multiple memory leaks in the (1) ldap_init and (2) ldap_url_search_direct API functions in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 allow remote authenticated users to cause a denial of service (memory consumption) by making many function calls.


osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) via a crafted packet with a large string length value to UDP port 14000 which triggers a memory allocation failure that is not properly handled.


GNOME Rhythmbox 0.11.5 allows remote attackers to cause a denial of service (segmentation fault and crash) via a playlist (.pls) file with a long Title field possibly related to the g_hash_table_lookup function in b-playlist-manager.c.


The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to cause a denial of service (hang or crash) via invalid field length values in a malformed (1) document or (2) request.


TrueVector in Check Point ZoneAlarm 8.0.020.000 with vsmon.exe running allows remote HTTP proxies to cause a denial of service (crash) and disable the HIDS module via a crafted response.


Phoenix Contact FL IL 24 BK-PAC allows remote attackers to cause a denial of service (hang) via (1) unspecified manipulations as demonstrated by a Nessus scan or (2) malformed input to TCP port 502.


The Unreal engine as used in Unreal Tournament 3 1.3 Unreal Tournament 2003 and 2004 Dead Man's Hand Pariah WarPath Postal2 and Shadow Ops allows remote authenticated users to cause a denial of service (server exit) via multiple file downloads from the server which triggers an assertion failure when the Closing flag in UnChan.cpp is set.


Lantronix MSS485-T allows remote attackers to cause a denial of service (unstable performance and service loss) via certain vulnerability scans as demonstrated using (1) Nessus and (2) nmap.


Unspecified vulnerability in Fujitsu Interstage HTTP Server as used in Interstage Application Server 5.0 7.0 7.0.1 and 8.0.0 for Windows allows attackers to cause a denial of service via a crafted request.


toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a long argument to the (1) RequestURL (2) GetPropertyById or (3) SetPropertyById method different vectors than CVE-2008-7135.


easdrv.sys in ESET Smart Security 3.0.667.0 allows local users to cause a denial of service (crash) via a crafted IOCTL 0x222003 request to the \\\\.\\easdrv device interface.


The Image Manager in MOStlyCE before 2.4 as used in Mambo 4.6.3 and earlier allows remote attackers to rename arbitrary files and cause a denial of service via modified fileNewFilename fileNewFiletmp_name and fileNewFilesize parameters in a FileUpload command which are used to modify equivalent variables in $_FILES that are accessed when the is_uploaded_file check fails.


IBM Lotus Quickr 8.1 before 8.1.0.2 services for Lotus Domino does not properly handle URLs that request images which allows remote authenticated users to cause a denial of service (daemon crash) via a request to resources.nsf aka SPR XFXF7JDBCX.


sys/netinet6/icmp6.c in the kernel in FreeBSD 6.3 through 7.1 NetBSD 3.0 through 4.0 and possibly other operating systems does not properly check the proposed new MTU in an ICMPv6 Packet Too Big Message which allows remote attackers to cause a denial of service (panic) via a crafted Packet Too Big Message.


dnsserver in Cisco Application Control Engine Global Site Selector (GSS) before 3.0(1) allows remote attackers to cause a denial of service (daemon crash) via a series of crafted DNS requests aka Bug ID CSCsj70093.


The RTMPT dissector in Wireshark (formerly Ethereal) 0.99.8 through 1.0.0 allows remote attackers to cause a denial of service (crash) via unknown vectors. NOTE: this might be due to a use-after-free error.


The error-reporting functionality in (1) fs/ext2/dir.c (2) fs/ext3/dir.c and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that report directory corruption which allows physically proximate attackers to cause a denial of service (temporary system hang) by mounting a filesystem that has corrupted dir->i_size and dir->i_blocks values and performing (a) read or (b) write operations. NOTE: there are limited scenarios in which this crosses privilege boundaries.


Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1 when VoIP is configured allows remote attackers to cause a denial of service (device or process reload) via unspecified valid SIP messages aka Cisco Bug ID CSCsm46064 a different vulnerability than CVE-2008-3800 and CVE-2008-3802.


The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x 1.2.x before 1.2.30 and 1.4.x before 1.4.21.2; Business Edition A.x.x B.x.x before B.2.5.4 and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (traffic amplification) via an IAX2 FWDOWNL request.


Wireshark (formerly Ethereal) 0.9.7 through 1.0.2 allows attackers to cause a denial of service (hang) via a crafted NCP packet that triggers an infinite loop.


The shmem_delete_inode function in mm/shmem.c in the tmpfs implementation in the Linux kernel before 2.6.26.1 allows local users to cause a denial of service (system crash) via a certain sequence of file create remove and overwrite operations as demonstrated by the insserv program related to allocation of \useless pages\ and improper maintenance of the i_blocks count.


Cisco IOS 12.0 through 12.4 on Cisco 10000 uBR10012 and uBR7200 series devices handles external UDP packets that are sent to 127.0.0.0/8 addresses intended for IPC communication within the device which allows remote attackers to cause a denial of service (device or linecard reload) via crafted UDP packets a different vulnerability than CVE-2008-3806.


zypp-refresh-patches in zypper in SUSE openSUSE 10.2 10.3 and 11.0 does not ask the user before accepting repository keys which allows remote repositories to cause a denial of service (package data corruption) via a spoofed key.


The dbus_signature_validate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a denial of service (application abort) via a message containing a malformed signature which triggers a failed assertion error.


Unspecified vulnerability in the NFS Remote Procedure Calls (RPC) zones implementation in Sun Solaris 10 and OpenSolaris before snv_88 allows local administrators of non-global zones to read and modify NFS traffic for arbitrary non-global zones possibly leading to file modifications or a denial of service.


Cisco IOS 12.0 through 12.4 on Gigabit Switch Router (GSR) devices (aka 12000 Series routers) allows remote attackers to cause a denial of service (device crash) via a malformed Protocol Independent Multicast (PIM) packet.


The IMAP server in NoticeWare Email Server NG 4.6.3 and earlier allows remote attackers to cause a denial of service (daemon crash) via multiple long LOGIN commands.


Cisco IOS 12.2 and 12.4 when NAT Skinny Call Control Protocol (SCCP) Fragmentation Support is enabled allows remote attackers to cause a denial of service (device reload) via segmented SCCP messages aka Cisco Bug ID CSCsi17020 a different vulnerability than CVE-2008-3810.


Unspecified vulnerability in the Solaris Platform Information and Control Library daemon (picld) in Sun Solaris 8 through 10 and OpenSolaris builds snv_01 through snv_95 allows local users to cause a denial of service via unknown vectors that prevent operation of utilities such as prtdiag prtpicl and prtfru.


Swfdec 0.6 before 0.6.8 allows remote attackers to cause a denial of service (application crash) via a 1x1 JPEG image.


sockethandler.cpp in HTTP Antivirus Proxy (HAVP) 0.88 allows remote attackers to cause a denial of service (hang) by connecting to a non-responsive server which triggers an infinite loop due to an uninitialized variable.


IBM DB2 UDB 8 before Fixpak 17 allows remote attackers to cause a denial of service (instance crash) via a crafted CONNECT/ATTACH data stream that simulates a V7 client connect/attach request. NOTE: this may overlap CVE-2008-3858. NOTE: this issue exists because of an incomplete fix for CVE-2008-3959.


Nortel SIP Multimedia PC Client 4.x MCS5100 and MCS5200 does not limit the number of concurrent sessions which allows attackers to cause a denial of service (resource consumption) via a large number of sessions.


Soldner Secret Wars 33724 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a packet with a large numeric value in a 0x80 data block.


The files parsing engine in Grisoft AVG Anti-Virus before 8.0.156 allows remote attackers to cause a denial of service (engine crash) via a crafted UPX compressed file which triggers a divide-by-zero error.


Unspecified vulnerability in the NFS module in the kernel in Sun Solaris 10 and OpenSolaris snv_59 through snv_87 when configured as an NFS server without the nodevices option allows local users to cause a denial of service (panic) via unspecified vectors.


Unspecified vulnerability in Serv-U File Server 7.0.0.1 and other versions before 7.2.0.1 allows remote authenticated users to cause a denial of service (daemon crash) via an SSH session with SFTP commands for directory creation and logging.


The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a deleted (aka S_DEAD) directory which allows local users to cause a denial of service (\overflow\ of the UBIFS orphan area) via a series of attempted file creations within deleted directories.


Cisco IOS 12.2 and 12.4 when NAT Skinny Call Control Protocol (SCCP) Fragmentation Support is enabled allows remote attackers to cause a denial of service (device reload) via segmented SCCP messages aka CSCsg22426 a different vulnerability than CVE-2008-3811.


Memory leak in racoon/proposal.c in the racoon daemon in ipsec-tools before 0.7.1 allows remote authenticated users to cause a denial of service (memory consumption) via invalid proposals.


WRPCServer.exe in WinSoftMagic WinRemotePC (WRPC) Lite 2008 and Full 2008 allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet to TCP port 4321.


IBM DB2 UDB 8.1 before FixPak 16 8.2 before FixPak 9 and 9.1 before FixPak 4a allows remote attackers to cause a denial of service (instance crash) via a crafted SQLJRA packet within a CONNECT/ATTACH data stream that simulates a V7 client connect/attach request.


Realtime Internet Band Rehearsal Low-Latency (Internet) Connection tool (llcon) before 2.1.2 allows remote attackers to cause a denial of service (application crash) via malformed protocol messages.


Multiple unspecified vulnerabilities in GraphicsMagick before 1.2.4 allow remote attackers to cause a denial of service (crash infinite loop or memory consumption) via (a) unspecified vectors in the (1) AVI (2) AVS (3) DCM (4) EPT (5) FITS (6) MTV (7) PALM (8) RLA and (9) TGA decoder readers; and (b) the GetImageCharacteristics function in magick/image.c as reachable from a crafted (10) PNG (11) JPEG (12) BMP or (13) TIFF file.


Unspecified vulnerability in the JAX-WS client and service in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to access URLs or cause a denial of service via unknown vectors involving \processing of XML data\ by a trusted application.


The (1) PANA and (2) KISMET dissectors in Wireshark (formerly Ethereal) 0.99.3 through 1.0.0 allow remote attackers to cause a denial of service (application stop) via unknown vectors.


Cisco ONS 15310-CL 15310-MA 15327 15454 15454 SDH and 15600 with software 7.0.2 through 7.0.6 7.2.2 8.0.x 8.5.1 and 8.5.2 allows remote attackers to cause a denial of service (control-card reset) via a crafted TCP session.


Multiple off-by-one errors in libpng before 1.2.32beta01 and 1.4 before 1.4.0beta34 allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks related to (1) the png_push_read_zTXt function in pngread.c and possibly related to (2) pngtest.c.


Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1 when VoIP is configured allows remote attackers to cause a denial of service (device or process reload) via unspecified valid SIP messages aka Cisco Bug ID CSCsu38644 a different vulnerability than CVE-2008-3801 and CVE-2008-3802.


Sophos virus detection engine 2.75 on Linux and Unix as used in Sophos Email Appliance Pure Message for Unix and Sophos Anti-Virus Interface (SAVI) allows remote attackers to cause a denial of service (engine crash) via zero-length MIME attachments.


Wireshark (formerly Ethereal) 0.10.14 through 1.0.2 allows attackers to cause a denial of service (crash) via a packet with crafted zlib-compressed data that triggers an invalid read in the tvb_uncompress function.


Off-by-one error in the iov_iter_advance function in mm/filemap.c in the Linux kernel before 2.6.27-rc2 allows local users to cause a denial of service (system crash) via a certain sequence of file I/O operations with readv and writev as demonstrated by testcases/kernel/fs/ftest/ftest03 from the Linux Test Project.


MailEnable Professional 3.5.2 and Enterprise 3.52 allow remote attackers to cause a denial of service (crash) via multiple IMAP connection requests to the same folder.


The scanning engine in F-Prot Antivirus 6.2.1 4252 allows remote attackers to cause a denial of service (infinite loop) via a malformed ZIP archive probably related to invalid offsets.


libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malformed Petite file that triggers an out-of-bounds memory access. NOTE: this issue exists because of an incomplete fix for CVE-2008-2713.


Unspecified vulnerability in Sun Solaris 10 and OpenSolaris before snv_96 allows (1) context-dependent attackers to cause a denial of service (panic) via vectors involving creation of a crafted file and use of the sendfilev system call as demonstrated by a file served by an Apache 2.2.x web server with EnableSendFile configured; and (2) local users to cause a denial of service (panic) via a call to the sendfile system call as reachable through the sendfilev library.


The remote management interface in SIP Enablement Services (SES) Server in Avaya SIP Enablement Services 5.0 and Communication Manager (CM) 5.0 on the S8300C with SES enabled proceeds with Core router updates even when a login is invalid which allows remote attackers to cause a denial of service (messaging outage) or gain privileges via an update request.


An unspecified ISAPI extension in VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (IIS crash) via a malformed request.


Cisco IOS 12.4 when IOS firewall Application Inspection Control (AIC) with HTTP Deep Packet Inspection is enabled allows remote attackers to cause a denial of service (device reload) via a malformed HTTP transit packet.


arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared Objects (vDSO) implementation in the Linux kernel before 2.6.21 does not properly check boundaries which allows local users to gain privileges or cause a denial of service via unspecified vectors related to the install_special_mapping syscall and syscall32_nopage functions.


The regular expression engine (regex.c) in Ruby 1.8.5 and earlier 1.8.6 through 1.8.6-p286 1.8.7 through 1.8.7-p71 and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket related to memory allocation failure and as demonstrated against Webrick.


Unspecified vulnerability in ovtopmd in HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 allows remote attackers to cause a denial of service via unknown vectors a different vulnerability than CVE-2008-3536 CVE-2008-3537 and CVE-2008-3544. NOTE: due to insufficient details from the vendor it is not clear whether this is the same as CVE-2008-1853.


Postfix 2.4 before 2.4.9 2.5 before 2.5.5 and 2.6 before 2.6-20080902 when used with the Linux 2.6 kernel leaks epoll file descriptors during execution of \non-Postfix\ commands which allows local users to cause a denial of service (application slowdown or exit) via a crafted command as demonstrated by a command in a .forward file.


The syslog dissector in Wireshark (formerly Ethereal) 1.0.0 allows remote attackers to cause a denial of service (application crash) via unknown vectors possibly related to an \incomplete SS7 MSU syslog encapsulated packet.\


Unspecified vulnerability in Best Practical Solutions RT 3.0.0 through 3.6.6 allows remote authenticated users to cause a denial of service (CPU or memory consumption) via unspecified vectors related to the Devel::StackTrace module for Perl.


dnsmasq 2.43 allows remote attackers to cause a denial of service (daemon crash) by (1) sending a DHCPINFORM while lacking a DHCP lease or (2) attempting to renew a nonexistent DHCP lease for an invalid subnet as an \unknown client \ a different vulnerability than CVE-2008-3214.


arch/x86/kernel/ptrace.c in the Linux kernel before 2.6.25.10 on the x86_64 platform leaks task_struct references into the sys32_ptrace function which allows local users to cause a denial of service (system crash) or have unspecified other impact via unknown vectors possibly a use-after-free vulnerability.


Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 when VoIP is configured allows remote attackers to cause a denial of service (device reload) via unspecified valid SIP messages aka Cisco bug ID CSCsk42759 a different vulnerability than CVE-2008-3800 and CVE-2008-3801.


Memory leak in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 when VoIP is configured allows remote attackers to cause a denial of service (memory consumption and voice-service outage) via unspecified valid SIP messages.


The ffmpeg lavf demuxer allows user-assisted attackers to cause a denial of service (application crash) via a crafted GIF file possibly related to gstreamer as demonstrated by lol-giftopnm.gif.


Unspecified vulnerability in Finder in Mac OS X 10.5.5 allows user-assisted attackers to cause a denial of service (continuous termination and restart) via a crafted Desktop file that generates an error when producing its icon related to an \error recovery issue.\


Unspecified vulnerability in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 allows remote attackers to cause a denial of service via unknown vectors a different vulnerability than CVE-2008-3536.


The ApiThread function in the firewall service (aka TmPfw.exe) in Trend Micro Network Security Component (NSC) modules as used in Trend Micro OfficeScan 8.0 SP1 Patch 1 and Internet Security 2007 and 2008 17.0.1224 allows remote attackers to cause a denial of service (service crash) via a packet with a large value in an unspecified size field.


vncviewer.exe in RealVNC Windows Client 4.1.2.0 allows remote VNC servers to cause a denial of service (application crash) via a crafted frame buffer update packet.


The IAX2 protocol implementation in Asterisk Open Source 1.0.x 1.2.x before 1.2.30 and 1.4.x before 1.4.21.2; Business Edition A.x.x B.x.x before B.2.5.4 and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (call-number exhaustion and CPU consumption) by quickly sending a large number of IAX2 (IAX) POKE requests.


Cisco IOS 12.0 through 12.4 on Cisco 10000 uBR10012 and uBR7200 series devices handles external UDP packets that are sent to 127.0.0.0/8 addresses intended for IPC communication within the device which allows remote attackers to cause a denial of service (device or linecard reload) via crafted UDP packets a different vulnerability than CVE-2008-3805.


Unspecified vulnerability in the FTP subsystem in Sun Java System Web Proxy Server 4.0 through 4.0.5 before SP6 allows remote attackers to cause a denial of service (failure to accept connections) via unknown vectors probably related to exhaustion of file descriptors.


Unspecified vulnerability in Wireshark (formerly Ethereal) 0.99.6 through 1.0.2 allows attackers to cause a denial of service (crash) via a crafted Tektronix .rf5 file.


Cisco IOS 12.4 allows remote attackers to cause a denial of service (device crash) via a normal properly formed SSL packet that occurs during termination of an SSL session.


Unspecified vulnerability in the kmxfw.sys driver in CA Host-Based Intrusion Prevention System (HIPS) r8 as used in CA Internet Security Suite and Personal Firewall allows remote attackers to cause a denial of service via unknown vectors related to \insufficient validation.\


xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via a crafted OGG file as demonstrated by playing lol-ffplay.ogg with xine.


Unspecified vulnerability in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 allows remote attackers to cause a denial of service via unknown vectors a different vulnerability than CVE-2008-3537.


America's Army (aka AA or Army Game Project) 2.8.3.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted UDP packet probably involving a VoiceIndex value that is outside of the range specified by VOICE_MAX_CHATTERS.


MySQL 5.0 before 5.0.66 5.1 before 5.1.26 and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token aka an empty bit-string literal which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.


Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier 1.8.6 through 1.8.6-p286 1.8.7 through 1.8.7-p71 and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.


The REXML module in Ruby 1.8.6 through 1.8.6-p287 1.8.7 through 1.8.7-p72 and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities aka an \XML entity explosion.\


The LDT implementation in the Linux kernel 2.6.25.x before 2.6.25.11 on x86_64 platforms uses an incorrect size for ldt_desc which allows local users to cause a denial of service (system crash) or possibly gain privileges via unspecified vectors.


The Xerox Phaser 8400 allows remote attackers to cause a denial of service (reboot) via an empty UDP packet to port 1900.


The SNMP daemon in the F5 FirePass 1200 6.0.2 hotfix 3 allows remote attackers to cause a denial of service (daemon crash) by walking the hrSWInstalled OID branch in HOST-RESOURCES-MIB.


The Downlevel DB2RA Support component in IBM DB2 9.1 before Fixpak 4a allows remote attackers to cause a denial of service (instance crash) via a crafted CONNECT data stream that simulates a V7 client connect request.


hcmon.sys in VMware Workstation 6.5.1 and earlier VMware Player 2.5.1 and earlier VMware ACE 2.5.1 and earlier and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs which allows local users to cause a denial of service via a crafted IOCTL request.


src/racoon/handler.c in racoon in ipsec-tools does not remove an \orphaned ph1\ (phase 1) handle when it has been initiated remotely which allows remote attackers to cause a denial of service (resource consumption).


Multiple memory leaks in Red Hat Directory Server 7.1 before SP7 Red Hat Directory Server 8 and Fedora Directory Server 1.1.1 and earlier allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) the authentication / bind phase and (2) anonymous LDAP search requests.


NetBSD 3.0 3.1 and 4.0 when a pppoe instance exists does not properly check the length of a PPPoE packet tag which allows remote attackers to cause a denial of service (system crash) via a crafted PPPoE packet.


rutil/dns/DnsStub.cxx in ReSIProcate 1.3.2 as used by repro allows remote attackers to cause a denial of service (daemon crash) via a SIP (1) INVITE or (2) OPTIONS message with a long domain name in a request URI which triggers an assert error.


Memory leak in Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 8.0 before 8.0(4) and 8.1 before 8.1(2) allows remote attackers to cause a denial of service (memory consumption) via an unspecified sequence of packets related to the \initialization code for the hardware crypto accelerator.\


The GSM SMS dissector in Wireshark (formerly Ethereal) 0.99.2 through 1.0.0 allows remote attackers to cause a denial of service (application crash) via unknown vectors.


Multiple unspecified vulnerabilities in the scanning engine before 4.4.4 in F-Prot Antivirus before 6.0.9.0 allow remote attackers to cause a denial of service via (1) a crafted UPX-compressed file which triggers an engine crash; (2) a crafted Microsoft Office file which triggers an infinite loop; or (3) an ASPack-compressed file which triggers an engine crash.


The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint.


Unspecified vulnerability in Avici routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages leading to route flapping possibly a related issue to CVE-2007-6372.


IBM Rational Build Forge 7.0.2 allows remote attackers to cause a denial of service (CPU consumption) via a port scan which spawns multiple bfagent server processes that attempt to read data from closed sockets.


The UPnP functionality in Pidgin 2.0.0 and possibly other versions allows remote attackers to trigger the download of arbitrary files and cause a denial of service (memory or disk consumption) via a UDP packet that specifies an arbitrary URL.


Unspecified vulnerability in AlaxalA AX routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages leading to route flapping possibly a related issue to CVE-2007-6372.


Memory leak in the ipip6_rcv function in net/ipv6/sit.c in the Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3 allows remote attackers to cause a denial of service (memory consumption) via network traffic to a Simple Internet Transition (SIT) tunnel interface related to the pskb_may_pull and kfree_skb functions and management of an skb reference count.


Memory leak in a certain Red Hat deployment of vsftpd before 2.0.5 on Red Hat Enterprise Linux (RHEL) 3 and 4 when PAM is used allows remote attackers to cause a denial of service (memory consumption) via a large number of invalid authentication attempts within the same session a different vulnerability than CVE-2007-5962.


Linksys SPA-2102 Phone Adapter 3.3.6 allows remote attackers to cause a denial of service (crash) via a long ping packet (\ping of death\). NOTE: the severity of this issue has been disputed since there are limited attack scenarios.


Cisco Adaptive Security Appliance (ASA) and Cisco PIX security appliance 8.0.x before 8.0(3)9 and 8.1.x before 8.1(1)1 allows remote attackers to cause a denial of service (device reload) via a crafted Transport Layer Security (TLS) packet to the device interface.


The utimensat system call (sys_utimensat) in Linux kernel 2.6.22 and other versions before 2.6.25.3 does not check file permissions when certain UTIME_NOW and UTIME_OMIT combinations are used which allows local users to modify file times of arbitrary files possibly leading to a denial of service.


Cisco PIX and Adaptive Security Appliance (ASA) 5500 devices 7.2 before 7.2(4)2 8.0 before 8.0(3)14 and 8.1 before 8.1(1)4 when configured as a client VPN endpoint do not properly process IPSec client authentication which allows remote attackers to cause a denial of service (device reload) via a crafted authentication attempt aka Bug ID CSCso69942.


The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1 (2) OpenBSD 4.2 and 4.3 (3) NetBSD (4) Force10 FTOS before E7.7.1.1 (5) Juniper JUNOS and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).


Unspecified vulnerability in cshttpd in Sun Java System Calendar Server 6 and 6.3 and Sun ONE Calendar Server 6.0 when access logging (aka service.http.commandlog.all) is enabled allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.


Call of Duty 4 (CoD4) 1.5 and earlier allows remote authenticated users to cause a denial of service (crash) via a type 7 stats packet which triggers a memcpy with a negative value.


The (1) sparc_mmap_check function in arch/sparc/kernel/sys_sparc.c and the (2) sparc64_mmap_check function in arch/sparc64/kernel/sys_sparc.c in the Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3 omit some virtual-address range (aka span) checks when the mmap MAP_FIXED bit is not set which allows local users to cause a denial of service (panic) via unspecified mmap calls.


The Instant Messenger (IM) inspection engine in Cisco Adaptive Security Appliance (ASA) and Cisco PIX security appliance 7.2.x before 7.2(4) 8.0.x before 8.0(3)10 and 8.1.x before 8.1(1)2 allows remote attackers to cause a denial of service via a crafted packet.


Unspecified vulnerability in Data Detectors Engine in Apple Mac OS X 10.5.4 allows attackers to cause a denial of service (resource consumption) via crafted textual content in messages.


The SNMP-DMI mapper subagent daemon (aka snmpXdmid) in Solstice Enterprise Agents in Sun Solaris 8 through 10 allows remote attackers to cause a denial of service (daemon crash) via malformed packets.


Exiv2 0.16 allows user-assisted remote attackers to cause a denial of service (divide-by-zero and application crash) via a zero value in Nikon lens information in the metadata of an image related to \pretty printing\ and the RationalValue::toLong function.


Multiple unspecified vulnerabilities in the SIP inspection functionality in Cisco PIX and Adaptive Security Appliance (ASA) 5500 devices 7.0 before 7.0(7)16 7.1 before 7.1(2)71 7.2 before 7.2(4)7 8.0 before 8.0(3)20 and 8.1 before 8.1(1)8 allow remote attackers to cause a denial of service (device reload) via unknown vectors aka Bug IDs CSCsq07867 CSCsq57091 CSCsk60581 and CSCsq39315.


Skulltag 0.97d2-RC2 and earlier allows remote attackers to cause a denial of service (daemon hang) via a series of long malformed connect packets related to these packets being \parsed multiple times.\


liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.


The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.


Red Hat Directory Server 7.1 before SP7 Red Hat Directory Server 8 and Fedora Directory Server 1.1.1 allow remote attackers to cause a denial of service (CPU consumption and search outage) via crafted LDAP search requests with patterns related to a single-threaded regular-expression subsystem.


** DISPUTED ** Memory leak in Pidgin 2.0.0 and possibly other versions allows remote attackers to cause a denial of service (memory consumption) via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor who states: \I was never able to identify a scenario under which a problem occurred and the original reporter wasn't able to supply any sort of reproduction details.\


Mozilla Firefox 3.0 beta 5 allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls document.write in an infinite loop.


Unspecified vulnerability in Century routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages leading to route flapping possibly a related issue to CVE-2007-6372.


Unspecified vulnerability in Cisco Intrusion Prevention System (IPS) 5.x before 5.1(8)E2 and 6.x before 6.0(5)E2 when inline mode and jumbo Ethernet support are enabled allows remote attackers to cause a denial of service (panic) and possibly bypass intended restrictions on network traffic via a \specific series of jumbo Ethernet frames.\


Memory leak in the crypto functionality in Cisco Adaptive Security Appliance (ASA) 5500 devices 7.2 before 7.2(4)2 8.0 before 8.0(3)14 and 8.1 before 8.1(1)4 when configured as a clientless SSL VPN endpoint allows remote attackers to cause a denial of service (memory consumption and VPN hang) via a crafted SSL or HTTP packet aka Bug ID CSCso66472.


Double free vulnerability in the utrace support in the Linux kernel probably 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 and Fedora Core 6 (FC6) allows local users to cause a denial of service (oops) as demonstrated by a crash when running the GNU GDB testsuite a different vulnerability than CVE-2008-2365.


The kmxfw.sys driver in CA Host-Based Intrusion Prevention System (HIPS) r8 as used in CA Internet Security Suite and Personal Firewall does not properly verify IOCTL requests which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted request.


The Linux kernel 2.6.24 and 2.6.25 before 2.6.25.9 allows local users to cause a denial of service (memory consumption) via a large number of calls to the get_user_pages function which lacks a ZERO_PAGE optimization and results in allocation of \useless newly zeroed pages.\


The TCP implementation in Sun Solaris 8 9 and 10 allows remote attackers to cause a denial of service (CPU consumption and new connection timeouts) via a TCP SYN flood attack.


fetchmail 6.3.8 and earlier when running in -v -v (aka verbose) mode allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers which triggers an erroneous dereference when using vsnprintf to format log messages.


Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 has insufficient access control for deletion and modification of registry keys which allows local users to cause a denial of service or obtain sensitive information.


The SERVICE.DNS signature engine in the Intrusion Prevention System (IPS) in Cisco IOS 12.3 and 12.4 allows remote attackers to cause a denial of service (device crash or hang) via network traffic that triggers unspecified IPS signatures a different vulnerability than CVE-2008-1447.


Unspecified vulnerability in Yamaha routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages leading to route flapping possibly a related issue to CVE-2007-6372.


The mld_input function in sys/netinet6/mld6.c in the kernel in NetBSD 4.0 FreeBSD and KAME when INET6 is enabled allows remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ICMPv6 Multicast Listener Discovery (MLD) query with a certain Maximum Response Delay value.


The hpssd message parser in hpssd.py in HP Linux Imaging and Printing (HPLIP) 1.6.7 allows local users to cause a denial of service (process stop) via a crafted packet as demonstrated by sending \msg=0\ to TCP port 2207.


The Computer Telephony Integration (CTI) Manager service in Cisco Unified Communications Manager (CUCM) 5.x before 5.1(3c) and 6.x before 6.1(2) allows remote attackers to cause a denial of service (TSP crash) via malformed network traffic to TCP port 2748.