Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Event

Management).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

for

Oracle

Database

product

of

Oracle

Enterprise

Manager

(component:

Target

Management).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

for

Oracle

Database.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

for

Oracle

Database

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

for

Oracle

Database

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

for

Oracle

Database.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L).

denial of service
privileged network access compromise
dos


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Application

Service

Level

Mgmt).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

System

Monitoring).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Database

Gateway

for

ODBC

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

having

Create

Session

privilege

with

network

access

via

OracleNet

to

compromise

Database

Gateway

for

ODBC.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Database

Gateway

for

ODBC

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Database

Gateway

for

ODBC

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Database

Gateway

for

ODBC.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L).


Vulnerability

in

the

Enterprise

Manager

for

Oracle

Database

product

of

Oracle

Enterprise

Manager

(component:

Change

Manager

web

based).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

for

Oracle

Database.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

for

Oracle

Database

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

for

Oracle

Database

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

for

Oracle

Database.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Connector

Framework).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Application

Express

component

of

Oracle

Database

Server.

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

End

User

Role

privilege

with

network

access

via

HTTPS

to

compromise

Oracle

Application

Express.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

Application

Express

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Application

Express.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L).


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Enterprise

Manager

Repository).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Enterprise

Config

Management).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Metrics

Framework).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

for

Oracle

Database

product

of

Oracle

Enterprise

Manager

(component:

Discovery

Framework).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

for

Oracle

Database.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

for

Oracle

Database

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

for

Oracle

Database

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

for

Oracle

Database.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Connectors

product

of

Oracle

MySQL

(component:

Connector/J).

Supported

versions

that

are

affected

are

and

prior.

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Connectors.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

MySQL

Connectors.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L).


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Extensibility

Framework).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Job

System).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

for

Fusion

Middleware

product

of

Oracle

Enterprise

Manager

(component:

APM

Mesh).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

for

Fusion

Middleware.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

for

Fusion

Middleware

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

for

Fusion

Middleware

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

for

Fusion

Middleware.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Repository).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Host

Management).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Oracle

Management

Service).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

for

Oracle

Database

product

of

Oracle

Enterprise

Manager

(component:

Enterprise

Config

Management).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

for

Oracle

Database.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

for

Oracle

Database

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

for

Oracle

Database

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

for

Oracle

Database.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Base

Platform

product

of

Oracle

Enterprise

Manager

(component:

Configuration

Standard

Framewk).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Base

Platform.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Enterprise

Manager

Base

Platform

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Base

Platform

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Enterprise

Manager

Base

Platform.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Application

Performance

Management

product

of

Oracle

Enterprise

Manager

(component:

EM

Request

Monitoring).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Application

Performance

Management.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Application

Performance

Management

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Application

Performance

Management

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Application

Performance

Management.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Database

Gateway

for

ODBC

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

having

Create

Procedure

Create

Database

Link

privilege

with

network

access

via

OracleNet

to

compromise

Database

Gateway

for

ODBC.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Database

Gateway

for

ODBC

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Database

Gateway

for

ODBC.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L).


Race condition in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of media threads.


Race condition in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to media.


Race condition in Google Chrome before 21.0.1180.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving improper interaction between worker processes and an XMLHttpRequest (aka XHR) object.


Race condition in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the plug-in paint buffer.


Race condition in Google Chrome before 14.0.835.163 allows attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the certificate cache.


Race condition in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to worker processes.


Race condition in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to worker process initialization.


Race condition in Google Chrome before 11.0.696.57 on Linux and Mac OS X allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to linked lists and a database.


Race condition in Microsoft Windows Media server allows remote attackers to cause a denial of service in the Windows Media Unicast Service via a malformed request aka the \Unicast Service Race Condition\ vulnerability.


Race condition in Microsoft Windows Server 2003 and Vista allows local users to cause a denial of service (crash or hang) via a multi-threaded application that makes many calls to UnhookWindowsHookEx while certain other desktop activity is occurring.


Race condition in the VRF-aware NAT feature in Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 allows remote attackers to cause a denial of service (memory consumption) via IPv4 packets aka Bug IDs CSCtg47129 and CSCtz96745.


Race condition in the workers implementation in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via unknown vectors.


Race condition in the kernel in Sun Solaris 8 through 10 allows local users to cause a denial of service (panic) via unspecified vectors related to \the handling of thread contexts.\


Race condition in the Remote Procedure Call kernel module (rpcmod) in Sun Solaris 8 through 10 allows local users to cause a denial of service (NULL dereference and panic) via unspecified vectors.


Race condition in the Symantec Enterprise Security Manager (ESM) 6.5.3 managers and agents on Windows before 20070524 allows remote attackers to cause a denial of service (CPU consumption and application hang) via certain network scans to ESM ports.


Race condition in the TCP subsystem for Solaris 10 allows remote attackers to cause a denial of service (system panic) via unknown vectors.


Race condition in the lighttpd module in Cisco IOS XR 5.1 and earlier on Network Convergence System 6000 devices allows remote attackers to cause a denial of service (process reload) by establishing many TCP sessions aka Bug ID CSCuq45239.


Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation.


Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to cause a denial of service (libvirtd crash) by closing a connection before a keepalive response is sent.


Race condition in the Solaris Auditing subsystem in Sun Solaris 9 and 10 and OpenSolaris before snv_121 when extended file attributes are used allows local users to cause a denial of service (panic) via vectors related to \pathnames for invalid fds.\


Race condition in the sysfs_read_file and sysfs_write_file functions in Linux kernel before 2.6.10 allows local users to read kernel memory and cause a denial of service (crash) via large offsets in sysfs files.


Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denial of service (free list corruption and host crash) or gain privileges on the host via vectors involving maptrack free list handling.


Race condition in the kernel in Red Hat Enterprise Linux 7 kernel-rt and Red Hat Enterprise MRG 2 when the nfnetlink_log module is loaded allows local users to cause a denial of service (panic) by creating netlink sockets.


Race condition in the Neighbor Discovery (ND) protocol implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service via a flood of Router Solicitation messages on the local network aka Bug ID CSCuo67770.


Race condition in the setreuid system-call implementation in the kernel in Apple iOS before 8.3 Apple OS X before 10.10.3 and Apple TV before 7.2 allows attackers to cause a denial of service via a crafted app.


Race condition in the kernel in Sun Solaris 8 through 10 allows local users to cause a denial of service (panic) via unspecified vectors possibly related to the exitlwps function and SIGKILL and /proc PCAGENT signals.


Race condition in the Zone-Based Firewall in Cisco IOS 15.1 and 15.2 when IPS policies are configured allows remote attackers to cause a denial of service (device crash) by sending IPv6 packets aka Bug ID CSCtk53534.


Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption or process exit) via a large volume of TCP queries.


Race condition in the Intel(R) Driver and Support Assistant before version 20.1.5 may allow an authenticated user to potentially enable denial of service via local access.


Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.


Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call.


Race condition in the queue_delete function in sound/core/seq/seq_queue.c in the Linux kernel before 4.4.1 allows local users to cause a denial of service (use-after-free and system crash) by making an ioctl call at a certain time.


Race condition in the setsid function in Linux before 2.6.8.1 allows local users to cause a denial of service (crash) and possibly access portions of kernel memory related to TTY changes locking and semaphores.


Race condition in the s_xout kernel module in Sun Solstice X.25 9.2 when running on a multiple CPU machine allows local users to cause a denial of service (panic) via vectors involving reading the /dev/xty file.


Race condition in the STREAMS Administrative Driver (sad) in Sun Solaris 10 allows local users to cause a denial of service (panic) via unknown vectors.


Race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6 and 2.6.25 before 2.6.25.1 allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors.


Race condition in the sandbox launcher implementation in Google Chrome before 11.0.696.57 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Bromium client version 4.0.3.2060 and prior to 4.1.7 Update 1 has an out of bound read results in race condition causing Kernel memory leaks or denial of service.


The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs which allows local users to obtain sensitive information cause a denial of service or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c mm/mmap.c fs/proc/task_mmu.c and drivers/infiniband/core/uverbs_main.c.


A use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12.0.0.6870 can be triggered due to a race condition when handling IRP_MJ_CLEANUP requests in the minifilter for directory change notifications. This allows an attacker to cause a denial of service (BSOD) when an executable is run inside the container.


The fix for CVE-2019-11599 affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive information cause a denial of service or possibly have other unspecified impacts by triggering a race condition with mmget_not_zero or get_task_mm calls.


An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI device.


An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a race condition that arose when XENMEM_exchange was introduced.


An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3 8.8.4 and 8.9 and Banner Enterprise Identity Services 8.3 8.3.1 8.3.2 and 8.4 in conjunction with SSO Manager. This vulnerability allows remote attackers to steal a victim's session (and cause a denial of service) by repeatedly requesting the initial Banner Web Tailor main page with the IDMSESSID cookie set to the victim's UDCID which in the case tested is the institutional ID. During a login attempt by a victim the attacker can leverage the race condition and will be issued the SESSID that was meant for this victim.


Multiple race conditions in ipc/shm.c in the Linux kernel before 3.12.2 allow local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted application that uses shmctl IPC_RMID operations in conjunction with other shm system calls.


Multiple race conditions in the (1) virDomainBlockStats (2) virDomainGetBlockInf (3) qemuDomainBlockJobImpl and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.


Race condition in the HTTP Deep Packet Inspection (DPI) feature in Cisco Adaptive Security Appliance (ASA) Software 8.2.x before 8.2(5.46) 8.3.x before 8.3(2.39) 8.4.x before 8.4(5.5) 8.5.x before 8.5(1.18) 8.6.x before 8.6(1.12) 8.7.x before 8.7(1.4) 9.0.x before 9.0(1.4) and 9.1.x before 9.1(1.2) in certain conditions involving the spoof-server option or ActiveX or Java response inspection allows remote attackers to cause a denial of service (device reload) via a crafted HTTP response aka Bug ID CSCud37992.


Race condition in the IPv6 virtual fragmentation reassembly (VFR) implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.3 allows remote attackers to cause a denial of service (device reload or hang) via fragmented IPv6 packets aka Bug ID CSCud64812.


Race condition in the CIFS implementation in the rewriter module in the Clientless SSL VPN component on Cisco Adaptive Security Appliances (ASA) devices allows remote authenticated users to cause a denial of service (device reload) by accessing resources within multiple sessions aka Bug ID CSCub58996.


Race condition in the International Components for Unicode (ICU) functionality in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Multiple

race

conditions

in

the

Web

Audio

implementation

in

Blink

as

used

in

Google

Chrome

before

allow

remote

attackers

to

cause

a

denial

of

service

or

possibly

have

unspecified

other

impact

via

vectors

related

to

threading

in

and


A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation aka CID-dbcc7d57bffc.


An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status aka CID-9380afd6df70.


PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP SDP RTP STUN TURN and ICE. In PJSIP before version 2.11.1 there are a couple of issues found in the SSL socket. First a race condition between callback and destroy due to the accepted socket having no group lock. Second the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash resulting in a denial of service. These are fixed in version 2.11.1.


Race condition in firmware for some Intel(R) Optane(TM) SSD Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow a privileged user to potentially enable denial of service via local access.


Race condition within a thread in firmware for some Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow a privileged user to potentially enable denial of service via local access.


A TOCTOU race condition in SMU may allow for the caller to obtain and manipulate the address of a message port register which may result in a potential denial of service.


Race condition in MDaemon 2.8.5.0 POP server allows local users to cause a denial of service by entering a UIDL command and quickly exiting the server.


Race condition in the Fibre Channel protocol (fcp) driver and Devices filesystem (devfs) in Sun Solaris 10 allows local users to cause a denial of service (system hang) via some programs that access hardware resources as demonstrated by the (1) cfgadm and (2) format programs.


Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service (daemon crash) by simultaneously acquiring and giving back file callbacks which causes the handler for the GiveUpAllCallBacks RPC to perform linked-list operations without the host_glock lock.


Race condition in Cisco Adaptive Security Appliance (ASA) and PIX 7.1 before 7.1(2)49 and 7.2 before 7.2(2)19 when using \clientless SSL VPNs \ allows remote attackers to cause a denial of service (device reload) via \non-standard SSL sessions.\


Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors possibly involving truetype font (TTF) support.


Race condition in the tee (sys_tee) system call in the Linux kernel 2.6.17 through 2.6.17.6 might allow local users to cause a denial of service (system crash) obtain sensitive information (kernel memory contents) or gain privileges via unspecified vectors related to a potentially dropped ipipe lock during a race between two pipe readers.


Race condition in the ip4_datagram_release_cb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect expectations about locking during multithreaded access to internal data structures for IPv4 UDP sockets.


The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition.


Race condition in the chan_pjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a cancel request for a SIP session with a queued action to (1) answer a session or (2) send ringing.


Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag.


Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions.


Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode) related to sta_info.c and tx.c.


Race condition in the Health and Performance Monitoring (HPM) for ASDM feature in Cisco ASA Software 8.3 before 8.3(2.42) 8.4 before 8.4(7.11) 8.5 before 8.5(1.19) 8.6 before 8.6(1.13) 8.7 before 8.7(1.11) 9.0 before 9.0(4.8) and 9.1 before 9.1(4.5) allows remote attackers to cause a denial of service (device reload) via TCP traffic that triggers many half-open connections at the same time aka Bug ID CSCum00556.


Race condition in the IP logging feature in Cisco Intrusion Prevention System (IPS) Software 7.1(7)E4 and earlier allows remote attackers to cause a denial of service (device reload) via crafted IP traffic that matches a problematic rule aka Bug ID CSCud82085.


Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i when multithreading and session resumption are used allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.


Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4 as used in Mozilla Firefox before 27.0 Firefox ESR 24.x before 24.3 Thunderbird before 24.3 SeaMonkey before 2.24 and other products allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.


Race condition in the cut-through proxy feature in Cisco Firewall Services Module (FWSM) Software 3.x before 3.2(28) and 4.x before 4.1(15) allows remote attackers to cause a denial of service (device reload) via certain matching traffic aka Bug ID CSCuj16824.


Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load.


The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET which allows local users to leverage a race condition and gain privileges or cause a denial of service (double fault) via a crafted application that makes ptrace and fork system calls.


Race condition in HVMOP_track_dirty_vram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM tracking which allows certain local guest domains to cause a denial of service via unspecified vectors.


Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report a similar issue to CVE-2010-5313.


Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection leading to the accept function having an unexpected value of None for the address or an ECONNABORTED EAGAIN or EWOULDBLOCK error a related issue to CVE-2010-3492.


Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection leading to the accept function having an unexpected return value of None an unexpected value of None for the address or an ECONNABORTED EAGAIN or EWOULDBLOCK error a related issue to CVE-2010-3492.


Multiple race conditions in smtpd.py in the smtpd module in Python 2.6 2.7 3.1 and 3.2 alpha allow remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection leading to the accept function having an unexpected return value of None an unexpected value of None for the address or an ECONNABORTED EAGAIN or EWOULDBLOCK error or the getpeername function having an ENOTCONN error a related issue to CVE-2010-3492.


Race condition in the hvc_close function in drivers/char/hvc_console.c in the Linux kernel before 2.6.34 allows local users to cause a denial of service or possibly have unspecified other impact by closing a Hypervisor Virtual Console device related to the hvc_open and hvc_remove functions.


Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g when SSL_MODE_RELEASE_BUFFERS is enabled allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.


Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report a similar issue to CVE-2014-7842.


Race condition in the sctp_icmp_proto_unreachable function in net/sctp/input.c in Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of service (panic) via an ICMP unreachable message to a socket that is already locked by a user which causes the socket to be freed and triggers list corruption related to the sctp_wait_for_connect function.


Race condition in IBM Web Content Manager (WCM) 7.0.0.1 before CF003 allows remote authenticated users to cause a denial of service (infinite recursive query) via unspecified vectors related to a StackOverflowError exception.


Race condition in the __exit_signal function in kernel/exit.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors related to multithreaded exec the use of a thread group leader in kernel/posix-cpu-timers.c and the selection of a new thread group leader in the de_thread function in fs/exec.c.


A race condition vulnerability exists in the QuickClean feature of McAfee Total Protection for Windows prior to 16.0.43 that allows a local user to gain privilege elevation and perform an arbitrary file delete. This could lead to sensitive files being deleted and potentially cause denial of service. This attack exploits the way symlinks are created and how the product works with them.


An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters outside of the AWS VPN Client allow list to be injected into the configuration file prior to the AWS VPN Client service (running as SYSTEM) processing the file. Dangerous arguments can be injected by a low-level user such as log which allows an arbitrary destination to be specified for writing log files. This leads to an arbitrary file write as SYSTEM with partial control over the files content. This can be abused to cause an elevation of privilege or denial of service.


Race condition in the Doors subsystem in the kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_94 allows local users to cause a denial of service (process hang) or possibly bypass file permissions or gain kernel-context privileges via vectors involving the time at which control is transferred from a caller to a door server.


Race condition in AFP Server in Apple Mac OS X 10.5.6 allows local users to cause a denial of service (infinite loop) via unspecified vectors related to \file enumeration logic.\


Race condition in the pseudo-terminal (aka pty) driver module in Sun Solaris 8 through 10 and OpenSolaris before snv_103 allows local users to cause a denial of service (panic) via unspecified vectors related to lack of \properly sequenced code\ in ptc and ptsl.


Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that triggers a certain state change in the absence of an aggregation session.


Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.1 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection leading to the accept function having an unexpected return value of None a different vulnerability than CVE-2010-3494.


Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection leading to the getpeername function having an ENOTCONN error a different vulnerability than CVE-2010-3494.


A multi-threaded race condition in the Windows RPC DCOM functionality with the MS03-039 patch installed allows remote attackers to cause a denial of service (crash or reboot) by causing two threads to process the same RPC request which causes one thread to use memory after it has been freed a different vulnerability than CVE-2003-0352 (Blaster/Nachi) CVE-2003-0715 and CVE-2003-0528 and as demonstrated by certain exploits against those vulnerabilities.


Race condition in Solaris 2.6 through 9 allows local users to cause a denial of service (kernel panic) as demonstrated via the namefs function pipe and certain STREAMS routines.


Multiple race conditions in Linux-VServer 1.22 with Linux kernel 2.4.23 and SMP allow local users to cause a denial of service (kernel oops) via unknown attack vectors related to the (1) s_info and (2) ip_info data structures and the (a) forget_original_parent (b) goodness (c) schedule (d) update_process_times and (e) vc_new_s_context functions.


Race condition in IMWheel 1.0.0pre11 and earlier when running with the -k option allows local users to cause a denial of service (IMWheel crash) and possibly modify arbitrary files via a symlink attack on the imwheel.pid file.


Race condition in SELinux 2.6.x through 2.6.9 allows local users to cause a denial of service (kernel crash) via SOCK_SEQPACKET unix domain sockets which are not properly handled in the sock_dgram_sendmsg function.


Multiple race conditions in the terminal layer in Linux 2.4.x and 2.6.x before 2.6.9 allow (1) local users to obtain portions of kernel data via a TIOCSETD ioctl call to a terminal interface that is being accessed by another thread or (2) remote attackers to cause a denial of service (panic) by switching from console to PPP line discipline then quickly sending data that is received during the switch.


Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline.


The grant-table feature in Xen through 4.8.x has a race condition leading to a double free which allows guest OS users to cause a denial of service (memory consumption) or possibly obtain sensitive information or gain privileges aka XSA-218 bug 2.


Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing.


Race condition in Blizzard Overwatch 1.15.0.2 allows remote authenticated users to cause a denial of service (season bans and SR losses for other users) by leaving a competitive match at a specific time during the initial loading of that match.


Race condition in net/packet/af_packet.c in the Linux kernel before 4.9.13 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that makes PACKET_FANOUT setsockopt system calls.


Race condition in kernel/ucount.c in the Linux kernel through 4.10.2 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls that leverage certain decrement behavior that causes incorrect interaction between put_ucounts and get_ucounts.


The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the \negative\ state to avoid a race condition which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.


Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c.


Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state.


In the Linux kernel before 4.15 fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tree during read operations in DIRECT mode which allows local users to cause a denial of service (BUG) by modifying a certain e_cpos field.


The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices.


The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid which allows local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads.


Race condition in the MutationObserver implementation in Blink as used in Google Chrome before 47.0.2526.80 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact by leveraging unanticipated object deletion.


Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a denial of service (host crash) via vectors involving the destruction of a domain and using XENMEM_decrease_reservation to reduce the memory of the domain.


Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service (use-after-free and BUG) or possibly gain privileges via a (1) madvise or (2) msync system call related to mm/madvise.c and mm/msync.c.


Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (NULL pointer free and module crash) by triggering intermittent connectivity with many IPv6 CPE devices aka Bug ID CSCug47366.


Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsem_down_read and ldsem_down_write deadlock) by establishing a new tty thread during shutdown of a previous tty thread.


Race condition in Cisco IOS 12.2SCH in the Performance Routing Engine (PRE) module on uBR10000 devices when NetFlow and an MPLS IPv6 VPN are configured allows remote attackers to cause a denial of service (PXF process crash) by sending malformed MPLS 6VPE packets quickly aka Bug ID CSCud83396.


D-Bus 1.4.x through 1.6.x before 1.6.30 1.8.x before 1.8.16 and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.


Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System (IPS) Software before 7.3(3)E4 allows remote attackers to cause a denial of service (process hang) by establishing many HTTPS sessions aka Bug ID CSCuq40652.


Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products allow attackers to cause a denial of service (zero-value write) or possibly have unspecified other impact via a COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl call.


Race condition in the Measurement Aggregation and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching aka Bug ID CSCul48736.


Race condition in the SSL implementation on Cisco Intrusion Prevention System (IPS) devices allows remote attackers to cause a denial of service by making many management-interface HTTPS connections during the key-regeneration phase of an upgrade aka Bug ID CSCui25688.


Race condition in the Common Classification Engine (CCE) in the Measurement Aggregation and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching aka Bug ID CSCuj96752.


Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg 1.0.0 before 1.0.0s 1.0.1 before 1.0.1n and 1.0.2 before 1.0.2b when used for a multi-threaded client allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.


Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service (list corruption and panic) via a rapid series of system calls related to sockets as demonstrated by setsockopt calls.


Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux (RHEL) 7 and other products allows remote attackers to cause a denial of service (application crash) by establishing many TLS sessions to a multithreaded server leading to use of a negative value for a certain length field.


ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t 1.0.1 before 1.0.1p and 1.0.2 before 1.0.2d when used for a multi-threaded client writes the PSK identity hint to an incorrect data structure which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.


Race condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation.


Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling.


Race condition in resolver.c in named in ISC BIND 9.9.8 before 9.9.8-P2 and 9.10.3 before 9.10.3-P2 allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via unspecified vectors.


spread uses a temporary file with a static filename based on the port number which allows local users to cause a denial of service by creating the file during a race condition between unlink and bind function calls. NOTE: spread deletes this temporary file before use which could cause conflicts with other programs that use the same filename but this is not a distinct issue.


Race condition in run_posix_cpu_timers in Linux kernel before 2.6.16.21 allows local users to cause a denial of service (BUG_ON crash) by causing one CPU to attach a timer to a process that is exiting.


Race condition between the kfree_skb and __skb_unlink functions in the socket buffer handling in Linux kernel 2.6.9 and possibly other versions allows remote attackers to cause a denial of service (crash) as demonstrated using the TCP stress tests from the LTP test suite.


Race condition in the (1) add_key (2) request_key and (3) keyctl functions in Linux kernel 2.6.x allows local users to cause a denial of service (crash) or read sensitive kernel memory by modifying the length of a string argument between the time that the kernel calculates the length and when it copies the data into kernel memory.


Race condition in the __find_get_block_slow function in the ISO9660 filesystem in Linux 2.6.18 and possibly other versions allows local users to cause a denial of service (infinite loop) by mounting a crafted ISO9660 filesystem containing malformed data structures.


Race condition in Sun Solaris 10 allows attackers to cause a denial of service (system panic) via unspecified vectors related to ifconfig and either netstat or SNMP queries.


Race condition in (1) libnsl and (2) TLI/XTI API routines in Sun Solaris 10 allows remote attackers to cause a denial of service (\tight loop\ and CPU consumption for listener applications) via unknown vectors related to TCP fusion (do_tcp_fusion).


Sendmail before 8.11.4 and 8.12.0 before 8.12.0.Beta10 allows local users to cause a denial of service and possibly corrupt the heap and gain privileges via race conditions in signal handlers.


Race condition in OpenBSD VFS allows local users to cause a denial of service (kernel panic) by (1) creating a pipe in one thread and causing another thread to set one of the file descriptors to NULL via a close or (2) calling dup2 on a file descriptor in one process then setting the descriptor to NULL via a close in another process that is created via rfork.


Race condition in signal handling of procmail 3.20 and earlier when running setuid allows local users to cause a denial of service or gain root privileges by sending a signal while a signal handling routine is already running.


The Linux kernel before 3.4.5 on the x86 platform when Physical Address Extension (PAE) is enabled does not properly use the Page Middle Directory (PMD) which allows local users to cause a denial of service (panic) via a crafted application that triggers a race condition.


Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.


Race condition in Pepper as used in Google Chrome before 23.0.1271.64 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to buffers.


Race condition on Cisco Adaptive Security Appliances (ASA) devices allows remote attackers to cause a denial of service (CPU consumption or device reload) by establishing multiple connections leading to improper handling of hash lookups for secondary flows aka Bug IDs CSCue31622 and CSCuc71272.


v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.


An

issue

was

discovered

in

the

Linux

kernel

through

in

reads

the

same

user

data

twice

with

The

header

part

of

the

user

data

is

double-fetched

and

a

malicious

user

thread

can

tamper

with

the

critical

variables

and

in

the

header

between

the

two

fetches

because

of

a

race

condition

leading

to

severe

kernel

errors

such

as

buffer

over-accesses.

This

bug

can

cause

a

local

denial

of

service

and

information

leakage.


389-ds-base before versions 1.4.0.10 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.


In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service until mount points are unmounted.


GEAR Software products that include GEARAspiWDM.sys 2.2.5.0 allow local users to cause a denial of service (Race Condition and BSoD on Windows) by not checking that user-mode memory is available right before writing to it. A check is only performed at the beginning of a long subroutine.


In libvips before 8.6.3 a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.


DISPUTED

Race

condition

in

the

function

in

in

the

Linux

kernel

through

allows

local

users

to

cause

a

denial

of

service

(panic)

by

leveraging

root

access

to

write

to

the

file

in

a

/sys/devices/system/machinecheck/machinecheck<cpu

number>

directory.

NOTE:

a

third

party

has

indicated

that

this

report

is

not

security

relevant.


A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.


An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service achieve data corruption or possibly gain privileges by exploiting a race condition that leads to a use-after-free involving 2MiB and 1GiB superpages.


NVIDIA Linux GPU Display Driver all versions contains a vulnerability in the UVM driver in which a race condition may lead to a denial of service.


A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221 4.9.x before 4.9.221 4.14.x before 4.14.178 4.19.x before 4.19.119 and 5.x before 5.3 allows local users to cause a denial of service (panic) by corrupting a mountpoint reference counter.


Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted SNDRV_PCM_TRIGGER_START command.


Race condition in the netlink_dump function in net/netlink/af_netlink.c in the Linux kernel before 4.6.3 allows local users to cause a denial of service (double free) or possibly have unspecified other impact via a crafted application that makes sendmsg system calls leading to a free operation associated with a new dump that started earlier than anticipated.


Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version related to the packet_set_ring and packet_setsockopt functions.


Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c.


In the Linux kernel before 4.9.3 fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure.


Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value aka a \double fetch\ vulnerability.


Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value aka a \double fetch\ vulnerability.


Race condition in libvpx in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.


Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call.


sound/core/timer.c in the Linux kernel before 4.4.1 employs a locking approach that does not consider slave timer instances which allows local users to cause a denial of service (race condition use-after-free and system crash) via a crafted ioctl call.


The msm_ipc_router_bind_control_port function in net/ipc_router/ipc_router_core.c in the IPC router kernel module for the Linux kernel 3.x as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products does not verify that a port is a client port which allows attackers to gain privileges or cause a denial of service (race condition and list corruption) by making many BIND_CONTROL_PORT ioctl calls.


sound/core/timer.c in the Linux kernel before 4.4.1 uses an incorrect type of mutex which allows local users to cause a denial of service (race condition use-after-free and system crash) via a crafted ioctl call.


The snd_timer_interrupt function in sound/core/timer.c in the Linux kernel before 4.4.1 does not properly maintain a certain linked list which allows local users to cause a denial of service (race condition and system crash) via a crafted ioctl call.


Race condition in Linux 2.6 when threads are sharing memory mapping via CLONE_VM (such as linuxthreads and vfork) might allow local users to cause a denial of service (deadlock) by triggering a core dump while waiting for a thread that has just performed an exec.


Race condition in Cisco Adaptive Security Appliance (ASA) 7.0(0) 7.0(2) and 7.0(4) when running with an Active/Standby configuration and when the failover LAN interface fails allows remote attackers to cause a denial of service (standby firewall failure) by sending spoofed ARP responses from an IP address of an active firewall which prevents the standby firewall from becoming active aka \failover denial of service.\


Race condition in do_coredump in signal.c in Linux kernel 2.6 allows local users to cause a denial of service by triggering a core dump in one thread while another thread has a pending SIGSTOP.


Race condition in ip_vs_conn_flush in Linux 2.6 before 2.6.13 and 2.4 before 2.4.32-pre2 when running on SMP systems allows local users to cause a denial of service (null dereference) by causing a connection timer to expire while the connection table is being flushed before the appropriate lock is acquired.


Race condition in ebtables netfilter module (ebtables.c) in Linux 2.6 when running on an SMP system that is operating under a heavy load might allow remote attackers to cause a denial of service (crash) via a series of packets that cause a value to be modified after it has been read but before it has been locked.


Race condition in OpenVPN before 2.0.1 when --duplicate-cn is not enabled allows remote attackers to cause a denial of service (server crash) via simultaneous TCP connections from multiple clients that use the same client certificate.


Race condition in the xpcom library as used by web browsers such as Firefox Mozilla Netscape and Galeon allows remote attackers to cause a denial of service (application crash) via a large HTML file that loads a DOM call from within nested DIV tags which causes part of the currently rendering page and referenced objects to be deleted.


The ath_rate_sample function in the ath_rate/sample/sample.c sample code in MadWifi before 0.9.3 allows remote attackers to cause a denial of service (failed KASSERT and system crash) by moving a connected system to a location with low signal strength and possibly other vectors related to a race condition between interface enabling and packet transmission.


Race condition in Philippe Jounin Tftpd32 before 2.80 allows remote attackers to cause a denial of service (daemon crash) via invalid \connect frames.\


Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x 6.0.x 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections.


Race condition in the do_setlk function in fs/nfs/file.c in the Linux kernel before 2.6.26 allows local users to cause a denial of service (crash) via vectors resulting in an interrupted RPC call that leads to a stray FL_POSIX lock related to improper handling of a race between fcntl and close in the EINTR case.


win32k.sys in Microsoft Windows Server 2003 and Vista allows local users to cause a denial of service (system crash) via vectors related to CreateWindow TranslateMessage and DispatchMessage possibly a race condition between threads a different vulnerability than CVE-2008-1084. NOTE: some of these details are obtained from third party information.


Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file which causes Jasper to exit. NOTE: this was originally reported as a symlink issue but this was incorrect. NOTE: some vendors dispute the severity of this issue but it satisfies CVE's requirements for inclusion.


Race condition in the ptrace and utrace support in the Linux kernel 2.6.9 through 2.6.25 as used in Red Hat Enterprise Linux (RHEL) 4 allows local users to cause a denial of service (oops) via a long series of PTRACE_ATTACH ptrace calls to another user's process that trigger a conflict between utrace_detach and report_quiescent related to \late ptrace_may_attach() check\ and \race around &dead_engine_ops setting \ a different vulnerability than CVE-2007-0771 and CVE-2008-1514. NOTE: this issue might only affect kernel versions before 2.6.16.x.


Race condition in the cm_work_handler function in the InfiniBand driver (drivers/infiniband/core/cma.c) in Linux kernel 2.6.x allows remote attackers to cause a denial of service (panic) by sending an InfiniBand request while other request handlers are still running which triggers an invalid pointer dereference.


Race condition in the sctp_rcv function in net/sctp/input.c in the Linux kernel before 2.6.29 allows remote attackers to cause a denial of service (system hang) via SCTP packets. NOTE: in some environments this issue exists because of an incomplete fix for CVE-2011-2482.


A race condition in the way env_start and env_end pointers are initialized in the execve system call and used in fs/proc/base.c on Linux 2.4 allows local users to cause a denial of service (crash).


Multiple race conditions in the Solaris Event Port API in Sun Solaris 10 and OpenSolaris before snv_107 allow local users to cause a denial of service (panic) via unspecified vectors related to a race between the port_dissociate and close functions.


Multiple race conditions in the madvise_remove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service (use-after-free and system crash) via vectors involving a (1) munmap or (2) close system call.


Multiple race conditions in the CPU Performance Counters (cpc) subsystem in the kernel in Sun Solaris 10 allow local users to cause a denial of service (panic) via unspecified vectors related to kcpc_unbind and kcpc_restore.


Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file exists.


In the Linux kernel 4.12 3.10 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system this can lead to a deadlock and denial of service condition.


Unknown vulnerability in Solaris 2.6 through 9 causes a denial of service (system panic) via \a rare race condition\ or an attack by local users.


Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors.

denial of service
race condition
arbitrary code execution


The cycle collection (CC) implementation in Mozilla Firefox before 25.0 Firefox ESR 24.x before 24.1 Thunderbird before 24.1 and SeaMonkey before 2.22 does not properly determine the thread for release of an image object which allows remote attackers to execute arbitrary code or cause a denial of service (race condition and application crash) via a large HTML document containing IMG elements as demonstrated by the Never-Ending Reddit on reddit.com.


Multiple signal handler race conditions in lukemftpd (aka tnftpd before 20040810) allow remote authenticated attackers to cause a denial of service or execute arbitrary code.


Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the IndexedDB implementation.


Race

condition

in

the

AsyncPaintWaitEvent::AsyncPaintWaitEvent

function

in

Mozilla

Firefox

before

allows

remote

attackers

to

execute

arbitrary

code

or

cause

a

denial

of

service

(use-after-free)

via

a

crafted

plugin

that

does

not

properly

complete

initialization.


Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code if GSSAPI authentication is enabled via unspecified vectors that lead to a double-free.


Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript arrays.


Race

condition

in

in

Google

Chrome

before

allows

remote

attackers

to

cause

a

denial

of

service

(buffer

overflow)

or

possibly

have

unspecified

other

impact

by

manipulating

OpenGL

ES

commands.

denial of service
race condition
buffer overflow


Race condition in Jungo Windriver 12.5.1 allows local users to cause a denial of service (buffer overflow) or gain system privileges by flipping pool buffer size aka a \double fetch\ vulnerability.


Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value aka a \double fetch\ vulnerability.


Race condition in the FastCopy optimization in the Array.Copy method in metadata/icall.c in Mono when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used allows remote attackers to trigger a buffer overflow and modify internal data structures and cause a denial of service (plugin crash) or corrupt the internal state of the security manager via a crafted media file in which a thread makes a change after a type check but before a copy action.


Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly obtain sensitive credential information or execute arbitrary code via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.

denial of service
race condition
buffer overflow
arbitrary code execution


Race condition in the JPEGEncoder function in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via vectors involving a CANVAS element and crafted JavaScript code.


Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted request.


Race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted web site.


Race condition in the ia32 compatibility code for the execve system call in Linux kernel 2.4 before 2.4.31 and 2.6 before 2.6.6 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code via a concurrent thread that increments a pointer count after the nargs function has counted the pointers but before the count is copied from user space to kernel space which leads to a buffer overflow.


Multiple buffer overflows in the POSIX readdir_r function as used in multiple packages allow local users to cause a denial of service and possibly execute arbitrary code via (1) a symlink attack that exploits a race condition between opendir and pathcon calls and changes the filesystem to one with a larger maximum directory-entry name length or (2) possibly via programmer-introduced errors on operating systems with a small struct dirent such as Solaris or BeOS as demonstrated in packages including (a) gcj (b) KDE (c) libwww (d) the Rudiments library (e) teTeX (f) xmail (g) bfbtester (h) ncftp (i) netwib (j) OpenOffice.org (k) Pike (l) reprepro (m) Tcl and (n) xgsmlib.


Race condition in the Enterprise Tree ActiveX control (EnterpriseControls.dll 11.5.0.313) in Crystal Reports XI Release 2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the SelectedSession method which triggers a buffer overflow.


A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F 4.21.3F - 4.21.7.1M 4.20 release train: 4.20.14M and earlier releases 4.19 release train: 4.19.12M and earlier releases End of support release trains (4.18 and 4.17)


A race condition was addressed with improved locking. This issue is fixed in Security Update 2021-004 Mojave iOS 14.5 and iPadOS 14.5 watchOS 7.4 Security Update 2021-003 Catalina tvOS 14.5 macOS Big Sur 11.3. A remote attacker may be able to cause a denial of service.


On PTX Series and QFX10k Series devices with the \inline-jflow\ feature enabled a use after free weakness in the Packet Forwarding Engine (PFE) microkernel architecture of Juniper Networks Junos OS may allow an attacker to cause a Denial of Service (DoS) condition whereby one or more Flexible PIC Concentrators (FPCs) may restart. As this is a race condition situation this issue become more likely to be hit when network instability occurs such as but not limited to BGP/IGP reconvergences and/or further likely to occur when more active \traffic flows\ are occurring through the device. When this issue occurs it will cause one or more FPCs to restart unexpectedly. During FPC restarts core files will be generated. While the core file is generated traffic will be disrupted. Sustained receipt of large traffic flows and reconvergence-like situations may sustain the Denial of Service (DoS) situation. This issue affects: Juniper Networks Junos OS: 18.1 version 18.1R2 and later versions prior to 18.1R3-S10 on PTX Series QFX10K Series.


A Race Condition in the 'show chassis pic' command in Juniper Networks Junos OS Evolved may allow an attacker to crash the port interface concentrator daemon (picd) process on the FPC if the command is executed coincident with other system events outside the attacker's control leading to a Denial of Service (DoS) condition. Continued execution of the CLI command under precise conditions could create a sustained Denial of Service (DoS) condition. This issue affects all Juniper Networks Junos OS Evolved versions prior to 20.1R2-EVO on PTX10003 and PTX10008 platforms. Junos OS is not affected by this vulnerability.


An Improper Check for Unusual or Exceptional Conditions vulnerability combined with a Race Condition in the flow daemon (flowd) of Juniper Networks Junos OS on SRX300 Series SRX500 Series SRX1500 and SRX5000 Series with SPC2 allows an unauthenticated network based attacker sending specific traffic to cause a crash of the flowd/srxpfe process responsible for traffic forwarding in SRX which will cause a Denial of Service (DoS). Continued receipt and processing of this specific traffic will create a sustained Denial of Service (DoS) condition. This issue can only occur when specific packets are trying to create the same session and logging for session-close is configured as a policy action. Affected platforms are: SRX300 Series SRX500 Series SRX1500 and SRX5000 Series with SPC2. Not affected platforms are: SRX4000 Series SRX5000 Series with SPC3 and vSRX Series. This issue affects Juniper Networks Junos OS SRX300 Series SRX500 Series SRX1500 and SRX5000 Series with SPC2: All versions prior to 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S6; 19.2 versions prior to 19.2R1-S7 19.2R3-S2; 19.3 versions prior to 19.3R2-S6 19.3R3-S2; 19.4 versions prior to 19.4R1-S4 19.4R3-S3; 20.1 versions prior to 20.1R2-S2 20.1R3; 20.2 versions prior to 20.2R3; 20.3 versions prior to 20.3R2-S1 20.3R3; 20.4 versions prior to 20.4R2.


Linux PV device frontends vulnerable to attacks by backends This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions resulting in potential data leaks data corruption by malicious backends and denial of service triggered by malicious backends: blkfront netfront scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case they assume that a following removal of the granted access will always succeed which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront netfront scsifront usbfront dmabuf xenbus 9p kbdfront and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042


A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE 3.16 could allow an authenticated remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a race condition that could occur when the affected software processes an SNMP read request that contains certain criteria for a specific object ID (OID) and an active crypto session is disconnected on an affected device. An attacker who can authenticate to an affected device could trigger this vulnerability by issuing an SNMP request for a specific OID on the device. A successful exploit will cause the device to restart due to an attempt to access an invalid memory region. The attacker does not control how or when crypto sessions are disconnected on the device. Cisco Bug IDs: CSCvb94392.


Audio driver in P9 smartphones with software The versions before EVA-AL10C00B389 has a denial of service (DoS) vulnerability. An attacker tricks a user into installing a malicious application on the smart phone and the race condition cause null pointer accessing during the application access shared resource which make the system reboot.


A vulnerability in the errdisable per VLAN feature of Cisco IOS XE Software could allow an unauthenticated adjacent attacker to cause the device to crash leading to a denial of service (DoS) condition. The vulnerability is due to a race condition that occurs when the VLAN and port enter an errdisabled state resulting in an incorrect state in the software. An attacker could exploit this vulnerability by sending frames that trigger the errdisable condition. A successful exploit could allow the attacker to cause the affected device to crash leading to a DoS condition.


An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests between its vCPUs the locking model used allows for a second vCPU of the same guest (also operating on the timers) to release a lock that it didn't acquire. The most likely effect of the issue is a hang or crash of the hypervisor i.e. a Denial of Service (DoS). All versions of Xen are affected. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only x86 HVM guests can leverage the vulnerability. x86 PV and PVH cannot leverage the vulnerability. Only guests with more than one vCPU can exploit the vulnerability.


An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77) can lead to the violation of various internal assumptions. This may lead to out of bounds memory accesses or triggering of bug checks. In particular x86 PV guests may be able to elevate their privilege to that of the host. Host and guest crashes are also possible leading to a Denial of Service (DoS). Information leaks cannot be ruled out. All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and earlier are not vulnerable.


A Race Condition vulnerability in Juniper Networks Junos OS LLDP implementation allows an attacker to cause LLDP to crash leading to a Denial of Service (DoS). This issue occurs when crafted LLDP packets are received by the device from an adjacent device. Multiple LACP flaps will occur after LLDP crashes. An indicator of compromise is to evaluate log file details for lldp with RLIMIT. Intervention should occur before 85% threshold of used KB versus maximum available KB memory is reached. show log messages | match RLIMIT | match lldp | last 20 Matching statement is \ /kernel: %KERNEL-number: Process (pid # lldpd) has exceeded 85% of RLIMIT_DATA: \ with as variable data to evaluate for. This issue affects: Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S15; 12.3X48 versions prior to 12.3X48-D95; 15.1 versions prior to 15.1R7-S6; 15.1X49 versions prior to 15.1X49-D200; 15.1X53 versions prior to 15.1X53-D593; 16.1 versions prior to 16.1R7-S7; 17.1 versions prior to 17.1R2-S11 17.1R3-S2; 17.2 versions prior to 17.2R1-S9 17.2R3-S3; 17.3 versions prior to 17.3R2-S5 17.3R3-S6; 17.4 versions prior to 17.4R2-S4 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to 18.2R2-S7 18.2R3; 18.2X75 versions prior to 18.2X75-D12 18.2X75-D33 18.2X75-D50 18.2X75-D420; 18.3 versions prior to 18.3R1-S7 18.3R2-S3 18.3R3; 18.4 versions prior to 18.4R1-S5 18.4R2; 19.1 versions prior to 19.1R1-S4 19.1R2.


MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system Thought for desktop uses this operating system presents insecure defaults for robots. These insecurities include a way for users to escalate their access beyond what they were granted via file creation access race conditions insecure home directory configurations and defaults that facilitate Denial of Service (DoS) attacks.


A vulnerability in the syslog processing engine of Cisco Identity Services Engine (ISE) could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a race condition that may occur when syslog messages are processed. An attacker could exploit this vulnerability by sending a high rate of syslog messages to an affected device. A successful exploit could allow the attacker to cause the Application Server process to crash resulting in a DoS condition.


All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) where user can trigger a race condition due to lack of synchronization in two functions leading to a denial of service or potential escalation of privileges.

denial of service
race condition
escalated privilege


Race condition in the PCNTL extension in PHP before 5.3.4 when a user-defined signal handler exists might allow context-dependent attackers to cause a denial of service (memory corruption) via a large number of concurrent signals.

denial of service
race condition
memory corruption


Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key.


The Linux kernel through 3.14.5 does not properly consider the presence of hugetlb entries which allows local users to cause a denial of service (memory corruption or system crash) by accessing certain memory locations as demonstrated by triggering a race condition via numa_maps read operations during hugepage migration related to fs/proc/task_mmu.c and mm/mempolicy.c.


The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the \LECHO & !OPOST\ case which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.


Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.


Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows local users to cause a denial of service (kernel memory corruption) by simultaneously executing the same HFS_SET_PKG_EXTENSIONS code path in multiple threads which is problematic because of lack of mutex locking for an unspecified global variable.


Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event and vfs_rename functions.


The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1 as used in Google Chrome before 46.0.2490.71 and other products relies on a coefficient-partition count during multi-threaded operation which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.


main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.


Race condition in Linux kernel 2.6.15 to 2.6.17 when running on SMP platforms allows local users to cause a denial of service (crash) by creating and exiting a large number of tasks then accessing the /proc entry of a task that is exiting which causes memory corruption that leads to a failure in the prune_dcache function or a BUG_ON error in include/linux/list.h.


Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (memory corruption and system crash) by changing a certain header aka a \double fetch\ vulnerability.


Multiple

race

conditions

in

in

the

WebRTC

implementation

in

Mozilla

Firefox

before

on

Windows

might

allow

remote

attackers

to

cause

a

denial

of

service

(memory

corruption)

or

possibly

have

unspecified

other

impact

via

unknown

vectors.


Race condition in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors involving access to an object aka \Window Open Race Condition Vulnerability.\

denial of service
race condition
memory corruption
arbitrary code execution


An issue was discovered in certain Apple products. iOS before 11 is affected. tvOS before 11 is affected. The issue involves the \Wi-Fi\ component. It might allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via crafted Wi-Fi traffic that leverages a race condition.


Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.


Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at the time of a shutdown.


Vulnerability

in

the

Oracle

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

LDoms

IO).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

unauthenticated

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

denial of service
unauthenticated infrastructure logon