The Decomposer component in multiple Symantec products allows remote attackers to cause a denial of service (infinite loop) via a certain value in the PACK_SIZE field of a RAR archive file header.


Wireshark before 0.99.6 allows remote attackers to cause a denial of service via malformed (1) SSL or (2) MMS packets that trigger an infinite loop.


mm/mmap.c in the hugetlb kernel when run on PowerPC systems does not prevent stack expansion from entering into reserved kernel page memory which allows local users to cause a denial of service (OOPS) via unspecified vectors.


Unspecified vulnerability in Kaspersky Anti-Virus for Check Point FireWall-1 before Critical Fix 1 (5.5.161.0) might allow attackers to cause a denial of service (kernel hang) via unspecified vectors. NOTE: it is not clear whether there is an attacker role.


The ULE process scheduler in the FreeBSD kernel gives preference to \interactive\ processes that perform voluntary sleeps which allows local users to cause a denial of service (CPU consumption) as described in \Secretly Monopolizing the CPU Without Superuser Privileges.\


input.c in VideoLAN VLC Media Player before 0.8.6c allows remote attackers to cause a denial of service (crash) via a crafted WAV file that causes an uninitialized i_nb_resamplers variable to be used.


The Common Internet File System (CIFS) optimization in Cisco Wide Area Application Services (WAAS) 4.0.7 and 4.0.9 as used by Cisco WAE appliance and the NM-WAE-502 network module when Edge Services are configured allows remote attackers to cause a denial of service (loss of service) via a flood of TCP SYN packets to port (1) 139 or (2) 445.


Multiple unspecified vulnerabilities in the KSSL kernel module in Sun Solaris 10 when configured with the KSSL proxy allow remote attackers to cause a denial of service (kernel panic) via unspecified vectors related to \memory buffers\ of Secure Socket Layer (SSL) records.


Format string vulnerability in the Aastra 9112i SIP Phone with firmware 1.4.0.1048 and boot version 1.1.0.10 allows remote attackers to cause a denial of service (blocked call reception and slow calling) via format string specifiers in an SDP header value a different vulnerability than CVE-2007-3349.


The IM Server (aka IMserve or IMserver) 2.0.5.30 and probably earlier in Ipswitch Instant Messaging before 2.07 in Ipswitch Collaboration Suite (ICS) allows remote attackers to cause a denial of service (daemon crash) via certain data to TCP port 5179 that overwrites a destructor as reachable by the (1) DoAttachVideoSender (2) DoAttachVideoReceiver (3) DoAttachAudioSender and (4) DoAttachAudioReceiver functions.


corefoundation.dll in Apple Safari 3.0.1 (552.12.2) for Windows allows remote attackers to cause a denial of service (crash) via certain forms that trigger errors related to History possibly involving multiple form fields with the same name.


The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in %cs (the xcs field) during ptrace single-step operations which allows local users to cause a denial of service (NULL dereference and OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP requests related to the TRACE_IRQS_ON function and possibly related to the arch_ptrace function.


Format string vulnerability in the MprLogToFile::logEvent function in Mbedthis AppWeb 2.0.5-4 when the build supports logging but the configuration disables logging allows remote attackers to cause a denial of service (daemon crash) via format string specifiers in the HTTP scheme as demonstrated by a \GET %n://localhost:80/\ request.


Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero a similar issue to CVE-2007-2237.


The OLE2 parsing in Norman Antivirus before 5.91.02 allows remote attackers to cause a denial of service via a crafted DOC file that triggers a divide-by-zero error.


Wireshark 0.99.5 and 0.10.x up to 0.10.14 when running on certain systems allows remote attackers to cause a denial of service (crash) via crafted iSeries capture files that trigger a SIGTRAP.


The Program Neighborhood Agent in Citrix Presentation Server Clients for 32-bit Windows before 10.100 allows remote attackers to cause a denial of service (agent exit) via a certain request that uses content redirection and a long pathname.


The (1) psp (aka .tub) (2) bmp (3) pcx and (4) psd plugins in gimp allow user-assisted remote attackers to cause a denial of service (crash or memory consumption) via crafted image files as discovered using the fusil fuzzing tool.


The D-Link DPH-540/DPH-541 phone allows remote attackers to cause a denial of service (device outage) via a malformed SDP header in a SIP INVITE message.


Apache httpd 2.0.59 and 2.2.4 with the Prefork MPM module allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.


Unrestricted critical resource lock in Agnitum Outpost Firewall PRO 4.0 1007.591.145 and earlier allows local users to cause a denial of service (system hang) by capturing the outpost_ipc_hdr mutex.


The Nortel PC Client SIP Soft Phone 4.1 3.5.20820051015 allows remote attackers to cause a denial of service (device crash) via a SIP message with a malformed header.


The 3Com IntelliJack Switch NJ220 before 2.0.23 allows remote attackers to cause a denial of service (reboot and reporting outage) via a loopback packet with zero in the length field.


The process scheduler in the Sun Solaris kernel does not make use of the process statistics kept by the kernel and performs scheduling based upon CPU billing gathered from periodic process sampling ticks which allows local users to cause a denial of service (CPU consumption) as described in \Secretly Monopolizing the CPU Without Superuser Privileges.\


The mirror mechanism in SurgeFTP 2.3a1 allows user-assisted remote FTP servers to cause a denial of service (restart) via a malformed response to a PASV command.


** DISPUTED ** JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external templates. NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue so no privilege boundaries are crossed. However it seems possible that this is a vulnerability class to which an JWIG application may be vulnerable if template contents can be influenced but this would be an issue in the application itself not JWIG.


ESET NOD32 Antivirus before 2.2289 allows remote attackers to cause a denial of service via a crafted (1) ASPACK or (2) FSG packed file which triggers a divide-by-zero error.


The Session Initiation Protocol (SIP) User Access Client (UAC) message parsing module in Avaya one-X Desktop Edition 2.1.0.70 and earlier allows remote attackers to cause a denial of service (device crash) via a malformed SIP message.


The Skinny channel driver (chan_skinny) in Asterisk before 1.2.22 and 1.4.x before 1.4.8 Business Edition before B.2.2.1 AsteriskNOW before beta7 Appliance Developer Kit before 0.5.0 and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a certain data length value in a crafted packet which results in an \overly large memcpy.\


The LDAP service in Windows Active Directory in Microsoft Windows 2000 Server SP4 does not properly check \the number of convertible attributes\ which allows remote attackers to cause a denial of service (service unavailability) via a crafted LDAP request related to \client sent LDAP request logic \ aka \Windows Active Directory Denial of Service Vulnerability\. NOTE: this is probably a different issue than CVE-2007-0040.


The signal handling in the Linux kernel before 2.6.22 including 2.6.2 when running on PowerPC systems using HTX allows local users to cause a denial of service via unspecified vectors involving floating point corruption and concurrency related to clearing of MSR bits.


Unspecified vulnerability in Hitachi TP1/Server Base before 03-05-/P 05-00-x before 05-00-/G 05-01-x before 05-01-/A and 05-02-x before 05-02-/C on HP-UX 11.0 through 11i v3 allows attackers to cause a denial of service by sending certain data to a port.


The Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 does not properly manage transaction states which allows remote attackers to cause a denial of service (temporary device hang) by sending a certain SIP INVITE message but not providing an ACK when the call is answered.


The Avaya 4602 SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware uses a constant media port number for calls which allows remote attackers to cause a denial of service (audio quality loss) via a flood of packets to the RTP port.


request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers as demonstrated by a request containing two Location header lines which results in a segmentation fault.


The Logging Server (Logsrv.exe) in IPSwitch WS_FTP 7.5.29.0 allows remote attackers to cause a denial of service (daemon crash) by sending a crafted packet containing a long string to port 5151/udp.


The Distributed Lock Manager (DLM) in the cluster manager for Linux kernel 2.6.15 allows remote attackers to cause a denial of service (loss of lock services) by connecting to the DLM port which probably prevents other processes from accessing the service.


Multiple vulnerabilities in Symantec Ghost Solution Suite 2.0.0 and earlier with Ghost 8.0.992 and possibly other versions allow remote attackers to cause a denial of service (client or server crash) via malformed requests to the daemon port 1346/udp or 1347/udp.


The _LoadBMP function in imlib 1.9.15 and earlier allows context-dependent attackers to cause a denial of service (infinite loop) via a BMP image with a Bits Per Page (BPP) value of 0.


BugHunter HTTP SERVER (httpsv.exe) 1.6.2 allows remote attackers to cause a denial of service (application crash) via a large number of requests for nonexistent pages.


Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data which results in a segmentation fault.


The STUN implementation in Asterisk 1.4.x before 1.4.8 AsteriskNOW before beta7 Appliance Developer Kit before 0.5.0 and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.


The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.


arclib.dll before 7.3.0.9 in CA Anti-Virus (formerly eTrust Antivirus) 8 and certain other CA products allows remote attackers to cause a denial of service (infinite loop and loss of antivirus functionality) via an invalid \previous listing chunk number\ field in a CHM file.


Format string vulnerability on the Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 allows remote attackers to cause a denial of service (blocked call reception and calling) via format string specifiers in an SIP INVITE message that lacks a host name in the Contact header.


The GDM daemon in GNOME Display Manager (GDM) before 2.14.13 2.16.x before 2.16.7 2.18.x before 2.18.4 and 2.19.x before 2.19.5 does not properly handle NULL return values from the g_strsplit function which allows local users to cause a denial of service (persistent daemon crash) via a crafted command to the daemon's socket related to (1) gdm.c and (2) gdmconfig.c in daemon/ and (3) gdmconfig.c and (4) gdmflexiserver.c in gui/.


CA ERwin Data Model Validator (formerly AllFusion Data Model Validator) allows remote attackers to (1) cause a denial of service (application hang) via a malformed .EXP database file and (2) cause a denial of service (aaplication crash) via a crafted .EXP database file which triggers a NULL dereference.


mod_auth (http_auth.c) in lighttpd before 1.4.16 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving (1) a memory leak (2) use of md5-sess without a cnonce (3) base64 encoded strings and (4) trailing whitespace in the Auth-Digest header.


Stampit Web uses guessable id values for online stamp purchases which allows remote attackers to cause a denial of service (stamp invalidation) via a SOAP request with an id value for a stamp that has not yet been printed.


rpttop.htm in the web management interface in Packeteer PacketShaper 7.3.0g2 and 7.5.0g1 allows remote attackers to cause a denial of service (device reboot) via a request with empty values of the OP.MEAS.DATAQUERY and MEAS.TYPE parameters.


Unspecified vulnerability in EXCLEXPT.DLL in ActiveReportsExcelReport allows remote attackers to cause a denial of service via the DDRow Height variable.


The com_print_typeinfo function in the bz2 extension in PHP 5.2.3 allows context-dependent attackers to cause a denial of service via a long argument.


The lcd_write function in drivers/usb/misc/usblcd.c in the Linux kernel before 2.6.22-rc7 does not limit the amount of memory used by a caller which allows local users to cause a denial of service (memory consumption).


The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allow attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value.


Conti FtpServer 1.0 allows remote authenticated users to cause a denial of service (daemon crash) via a certain string containing \//A:\ in the argument to the LIST command.


Unspecified vulnerability in Cisco Unified Communications Manager (CUCM formerly CallManager) and Unified Presence Server (CUPS) allows remote attackers to cause a denial of service (loss of cluster services) via unspecified vectors aka (1) CSCsj09859 and (2) CSCsj19985.


Unspecified vulnerability in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1.0.7 and earlier allows remote attackers to cause a denial of service related to a thread hang and possibly related to a \TCP issue \ or to MPAlarmThread and a resultant memory leak.


Memory leak in server/MaraDNS.c in MaraDNS 1.2.12.06 and 1.3.05 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors a different set of affected versions than CVE-2007-3114 and CVE-2007-3115.


Multiple unspecified vulnerabilities in Astaro Security Gateway (ASG) before 7.005 allow remote attackers to cause a denial of service via (1) certain email which stops the SMTP Proxy during scanning; (2) certain HTTP traffic which stops or slows down the HTTP proxy during HTTP responses containing virus scanned web pages; and (3) a disconnection during a streaming session.


Integer signedness error in the SET_VALUE function in rarvm.cpp in unrar 3.70 beta 3 as used in products including WinRAR and RAR for OS X allows user-assisted remote attackers to cause a denial of service (crash) via a crafted RAR archive that causes a negative signed number to be cast to a large unsigned number.


graph_image.php in Cacti 0.8.6i and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_start or (2) graph_end parameter different vectors than CVE-2007-3113.


http.c in MiniWeb Http Server 0.8.x allows remote attackers to cause a denial of service (application crash) via a negative value in the Content-Length HTTP header.


TeamSpeak WebServer 2.0 for Windows does not validate parameter value lengths and does not expire TCP sessions which allows remote attackers to cause a denial of service (CPU and memory consumption) via long username and password parameters in a request to login.tscmd on TCP port 14534.


Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x possibly only on Windows allows remote attackers to cause a denial of service (process crash) via a URI of a certain length that contains a sap-isc-key parameter related to configuration of a web cache.


The Aastra 9112i SIP Phone with firmware 1.4.0.1048 and boot version 1.1.0.10 allows remote attackers to (1) cause a denial of service (device freeze) via a malformed SIP message of a certain length or (2) cause a denial of service (continuous ring) via a malformed SIP message of a certain other length.


NVIDIA drivers (nvidia-drivers) before 1.0.7185 1.0.9639 and 100.14.11 as used in Gentoo Linux and possibly other distributions creates /dev/nvidia* device files with insecure permissions which allows local users to modify video card settings cause a denial of service (crash or physical video card damage) and obtain sensitive information.


Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via a crafted chunked encoding in an HTTP response possibly related to a zero-length payload.


Unspecified vulnerability in libclamav/phishcheck.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 when running on Solaris allows remote attackers to cause a denial of service (hang) via unknown vectors related to the isURL function and regular expressions.


MySQL Community Server before 5.0.45 allows remote attackers to cause a denial of service (daemon crash) via a malformed password packet in the connection protocol.


The SJPhone SIP soft phone 1.60.303c when installed on the Dell Axim X3 running Windows Mobile 2003 allows remote attackers to cause a denial of service (device hang and traffic amplification) via a direct crafted INVITE transaction which causes the phone to transmit many RTP packets.


The 4BSD process scheduler in the FreeBSD kernel performs scheduling based on CPU billing gathered from periodic process sampling ticks which allows local users to cause a denial of service (CPU consumption) by performing voluntary nanosecond sleeps that result in the process not being active during a clock interrupt as described in \Secretly Monopolizing the CPU Without Superuser Privileges.\


The Java Message Service (JMS) in IBM WebSphere Application Server (WAS) before 6.1.0.7 allows attackers to cause a denial of service via unknown vectors involving the \double release of a bytebuffer input stream \ possibly a double free vulnerability.


The Remote Play feature in Sony Playstation 3 (PS3) 1.60 and Playstation Portable (PSP) 3.10 OE-A allows remote attackers to cause a denial of service via a flood of UDP packets.


Unspecified vulnerability in the Cisco IP Phone 7940 and 7960 running firmware before POS8-6-0 allows remote attackers to cause a denial of service via the Remote-Party-ID sipURI field in a SIP INVITE request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1) IsFolderAvailable or (2) RootFolder property value different vectors than CVE-2007-0371.


The Zend Engine in PHP 4.x before 4.4.7 and 5.x before 5.2.2 allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays which trigger deep recursion in the variable destruction routines.


libdayzero.dll in the Filter Hub Service (filter-hub.exe) in Symantec Mail Security for SMTP before 5.0.1 Patch 181 and Mail Security Appliance before 5.0.0-36 allows remote attackers to cause a denial of service (crash) via a crafted executable attachment in an e-mail involving the detection of \PE-Shield v0.2\ and \ASPack v1.00-1.08.02\.


Unspecified vulnerability in (1) Deskbar.dll and (2) Toolbar.dll in AOL 9.0 before February 2007 allows remote attackers to cause a denial of service (browser crash) via unknown vectors.


Array index error in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash) via (1) large num_action values in the ProcAuSetElements function in server/dia/audispatch.c or (2) a large inputNum parameter to the compileInputs function in server/dia/auutil.c.


The PMA_ArrayWalkRecursive function in libraries/common.lib.php in phpMyAdmin before 2.10.0.2 does not limit recursion on arrays provided by users which allows context-dependent attackers to cause a denial of service (web server crash) via an array with many dimensions. NOTE: it could be argued that this vulnerability is caused by a problem in PHP (CVE-2006-1549) and the proper fix should be in PHP; if so then this should not be treated as a vulnerability in phpMyAdmin.


Kaspersky AntiVirus Engine 6.0.1.411 for Windows and 5.5-10 for Linux allows remote attackers to cause a denial of service (CPU consumption) via a crafted UPX compressed file with a negative offset which triggers an infinite loop during decompression.


The DCCP support in the do_dccp_getsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later does not verify the upper bounds of the optlen value which allows local users running on certain architectures to read kernel memory or cause a denial of service (oops) a related issue to CVE-2007-1730.


Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching certain input bytes against some regex patterns in non-UTF-8 mode which allows context-dependent attackers to obtain sensitive information or cause a denial of service (crash) as demonstrated by the \\\X?\\d\ and \\\P{L}?\\d\ patterns.


VMware Workstation before 5.5.4 allows attackers to cause a denial of service against the guest OS by causing the virtual machine process (VMX) to store malformed configuration information.


TrueCrypt 4.3 when installed setuid root allows local users to cause a denial of service (filesystem unavailability) or gain privileges by mounting a crafted TrueCrypt volume as demonstrated using (1) /usr/bin or (2) another user's home directory a different issue than CVE-2007-1589.


The LLTD Mapper in Microsoft Windows Vista does not properly gather responses to EMIT packets which allows remote attackers to cause a denial of service (mapping failure) by omitting an ACK response which triggers an XML syntax error.


cache_util.c in the mod_cache module in Apache HTTP Server (httpd) when caching is enabled and a threaded Multi-Processing Module (MPM) is used allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage (2) max-age (3) min-fresh or (4) max-stale Cache-Control headers without a value.


net/ipv6/tcp_ipv6.c in Linux kernel 2.6.x up to 2.6.21-rc3 inadvertently copies the ipv6_fl_socklist from a listening TCP socket to child sockets which allows local users to cause a denial of service (OOPS) or double free by opening a listening IPv6 socket attaching a flow label and connecting to that socket.


Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4 and SeaMonkey 1.0.9 and 1.1.2 allows remote attackers to cause a denial of service via (1) a large cookie path parameter which triggers memory consumption or (2) an internal delimiter within cookie path or name values which could trigger a misinterpretation of cookie data aka \Path Abuse in Cookies.\


Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.00 allows local users to cause a denial of service via unknown vectors. NOTE: due to lack of vendor details it is not clear whether this is the same as CVE-2007-0916.


zoo decoder 2.10 (zoo-2.10) as used in multiple products including (1) Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399 (2) Spam Firewall before 3.4 20070319 with virusdef before 2.0.6399o and (3) AMaViS 2.4.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.


Cisco Unified CallManager (CUCM) 5.0 before 5.0(4a)SU1 and Cisco Unified Presence Server (CUPS) 1.0 before 1.0(3) allow remote attackers to cause a denial of service (loss of voice services) via a flood of ICMP echo requests aka bug ID CSCsf12698.


The Tape Engine in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to cause a denial of service (disabled interface) by calling an unspecified RPC function.


Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6 and ColdFusion MX 6.1 and 7.0 Enterprise when using Microsoft IIS 6 allows remote attackers to cause a denial of service via unspecified vectors involving the request of a file in the JRun web root.


The atalk_sum_skb function in AppleTalk for Linux kernel 2.6.x before 2.6.21 and possibly 2.4.x allows remote attackers to cause a denial of service (crash) via an AppleTalk frame that is shorter than the specified length which triggers a BUG_ON call when an attempt is made to perform a checksum.


Vixie Cron before 4.1-r10 on Gentoo Linux is installed with insecure permissions which allows local users to cause a denial of service (cron failure) by creating hard links which results in a failed st_nlink check in database.c.


avpack32.dll before 7.3.0.6 in Avira AntiVir allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.


TurboFTP 5.30 Build 572 allows remote servers to cause a denial of service (CPU consumption) via a response with a large number of newline characters.


The \\Device\\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.1.7 and possibly other products using symevent.sys 12.0.0.20 allows local users to cause a denial of service (system crash) via invalid data as demonstrated by calling DeviceIoControl to send the data a reintroduction of CVE-2006-4855.


Microsoft Windows XP and Vista overwrites ARP table entries included in gratuitous ARP which allows remote attackers to cause a denial of service (loss of network access) by sending a gratuitous ARP for the address of the Vista host.


The administrative service in Symantec Veritas Volume Replicator (VVR) for Windows 3.1 through 4.3 and VVR for Unix 3.5 through 5.0 in Symantec Storage Foundation products allows remote attackers to cause a denial of service (memory consumption and service crash) via a crafted packet to the service port (8199/tcp) that triggers a request for more memory than available which causes the service to write to an invalid pointer.


bgpd/bgp_attr.c in Quagga 0.98.6 and earlier and 0.99.6 and earlier 0.99 versions does not validate length values in the MP_REACH_NLRI and MP_UNREACH_NLRI attributes which allows remote attackers to cause a denial of service (daemon crash or exit) via crafted UPDATE messages that trigger an assertion error or out of bounds read.


A certain ActiveX control in the DivXBrowserPlugin (npdivx32.dll) in DivX Web Player as distributed with DivX Player 1.3.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via large values to DivxWP.Resize related to resizing images.


PulseAudio 0.9.5 allows remote attackers to cause a denial of service (daemon crash) via (1) a PA_PSTREAM_DESCRIPTOR_LENGTH value of FRAME_SIZE_MAX_ALLOW sent on TCP port 9875 which triggers a p->export assertion failure in do_read; (2) a PA_PSTREAM_DESCRIPTOR_LENGTH value of 0 sent on TCP port 9875 which triggers a length assertion failure in pa_memblock_new; or (3) an empty packet on UDP port 9875 which triggers a t assertion failure in pa_sdp_parse; and allows remote authenticated users to cause a denial of service (daemon crash) via a crafted packet on TCP port 9875 that (4) triggers a maxlength assertion failure in pa_memblockq_new (5) triggers a size assertion failure in pa_xmalloc or (6) plays a certain sound file.


The Rediff Toolbar 2.0 ActiveX control in redifftoolbar.dll allows remote attackers to cause a denial of service via unspecified manipulations possibly involving improper initialization or blank arguments.


The memory management in VMware Workstation before 5.5.4 allows attackers to cause a denial of service (Windows virtual machine crash) by triggering certain general protection faults (GPF).


Panda Software Antivirus before 20070402 allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.


SnapGear 560 585 580 640 710 and 720 appliances before the 3.1.4u5 firmware allow remote attackers to cause a denial of service (complete packet loss) via a packet flood a different vulnerability than CVE-2006-4613.


The safevoid_vsnprintf function in Metamod-P 1.19p29 and earlier on Windows allows remote attackers to cause a denial of service (daemon crash) via a long meta list command.


AcroPDF.DLL in Adobe Reader 8.0 when accessed from Mozilla Firefox Netscape or Opera allows remote attackers to cause a denial of service (unspecified resource consumption) via a .pdf URL with an anchor identifier that begins with search= followed by many %n sequences a different vulnerability than CVE-2006-6027 and CVE-2006-6236.


Microsoft Windows Explorer on Windows XP and 2003 allows remote user-assisted attackers to cause a denial of service (crash) via a malformed WMF file which triggers the crash when the user browses the folder.


Unspecified vulnerability in Cisco IOS 12.2SXA SXB SXD and SXF; and the MSFC2 MSFC2a and MSFC3 running in Hybrid Mode on Cisco Catalyst 6000 6500 and Cisco 7600 series systems; allows remote attackers on a local network segment to cause a denial of service (software reload) via a certain MPLS packet.


The 4thPass browser (BlackBerry Browser) on the RIM BlackBerry 8100 (Pearl) before 4.2.1 allows remote attackers to cause a denial of service (temporary functionality loss) via a long href attribute in a link in a WML page.


The clientProcessRequest() function in src/client_side.c in Squid 2.6 before 2.6.STABLE12 allows remote attackers to cause a denial of service (daemon crash) via crafted TRACE requests that trigger an assertion error.


tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 allows remote attackers to cause a denial of service via a long UDP packet that is not properly handled in a recv_from call. NOTE: this issue might be related to CVE-2006-4948.


The Skinny Call Control Protocol (SCCP) implementation in Cisco Unified CallManager (CUCM) 3.3 before 3.3(5)SR2a 4.1 before 4.1(3)SR4 4.2 before 4.2(3)SR1 and 5.0 before 5.0(4a)SU1 allows remote attackers to cause a denial of service (loss of voice services) by sending crafted packets to the (1) SCCP (2000/tcp) or (2) SCCPS (2443/tcp) port.


TrueCrypt before 4.3 when set-euid mode is used on Linux allows local users to cause a denial of service (filesystem unavailability) by dismounting a volume mounted by a different user.


VsapiNT.sys in the Scan Engine 8.0 for Trend Micro AntiVirus 14.10.1041 and other products allows remote attackers to cause a denial of service (kernel fault and system crash) via a crafted UPX file with a certain field that triggers a divide-by-zero error.


The RFC_SET_REG_SERVER_PROPERTY function in the SAP RFC Library 6.40 and 7.00 before 20070109 implements an option for exclusive access to an RFC server which allows remote attackers to cause a denial of service (client lockout) via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.


Shemes.com Grabit 1.5.3 and possibly earlier allows remote attackers to cause a denial of service (application crash) via a .nzb file with a subject field containing ';' (semicolon) characters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


avast! antivirus before 4.7.981 allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.


\\Device\\NdisTapi (NDISTAPI.sys) in Microsoft Windows XP SP2 and 2003 SP1 uses weak permissions which allows local users to write to the device and cause a denial of service as demonstrated by using an IRQL to acquire a spinlock on paged memory via the NdisTapiDispatch function.


The frag3 preprocessor in Snort 2.6.1.1 2.6.1.2 and 2.7.0 beta when configured for inline use on Linux without the ip_conntrack module loaded allows remote attackers to cause a denial of service (segmentation fault and application crash) via certain UDP packets produced by send_morefrag_packet and send_overlap_packet.


The isakmp_info_recv function in src/racoon/isakmp_inf.c in racoon in Ipsec-tools before 0.6.7 allows remote attackers to cause a denial of service (tunnel crash) via crafted (1) DELETE (ISAKMP_NPTYPE_D) and (2) NOTIFY (ISAKMP_NPTYPE_N) messages.


The SymTDI device driver (SYMTDI.SYS) in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier Internet Security 2005 and 2006 AntiVirus Corporate Edition 3.0.x through 10.1.x and other Norton products allows local users to cause a denial of service (system crash) by sending crafted data to the driver's \\Device file which triggers invalid memory access a different vulnerability than CVE-2006-4855.


The AddResource function in server/dia/resource.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (server crash) via a nonexistent client ID.


Microsoft Office 2003 allows user-assisted remote attackers to cause a denial of service (application crash) by attempting to insert a corrupted WMF file.


The SIP channel module in Yet Another Telephony Engine (Yate) before 1.2.0 sets the caller_info_uri parameter using an incorrect variable that can be NULL which allows remote attackers to cause a denial of service (NULL dereference and application crash) via a Call-Info header without a purpose parameter.


GlowWorm FW before 1.5.3b4 allows remote attackers to cause a denial of service (kernel panic) via certain DNS responses that trigger infinite recursion in TrueDNS packet parsing as originally observed with certain login.yahoo.com responses.


Niels Provos libevent 1.2 and 1.2a allows remote attackers to cause a denial of service (infinite loop) via a DNS response containing a label pointer that references its own offset.


Perl-Compatible Regular Expression (PCRE) library before 7.3 reads past the end of the string when searching for unmatched brackets and parentheses which allows context-dependent attackers to cause a denial of service (crash) possibly involving forward references.


Unspecified kernel GDI functions in Microsoft Windows 2000 SP4; XP SP2; and Server 2003 Gold SP1 and SP2 allows user-assisted remote attackers to cause a denial of service (possibly persistent restart) via a crafted Windows Metafile (WMF) image that causes an invalid dereference of an offset in a kernel structure a related issue to CVE-2005-4560.


lighttpd 1.4.12 and 1.4.13 allows remote attackers to cause a denial of service (cpu and resource consumption) by disconnecting while lighttpd is parsing CRLF sequences which triggers an infinite loop and file descriptor consumption.


MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing information_schema table subselects and using ORDER BY to sort a single-row result which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort function.


The SILC_SERVER_CMD_FUNC function in apps/silcd/command.c in silc-server 1.0.2 allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a request without a cipher algorithm and an invalid HMAC algorithm.


chunkcounter.cpp in KTorrent before 2.1.2 allows remote attackers to cause a denial of service (crash) and heap corruption via a negative or large idx value.


Unspecified vulnerability in the IPSec Manager Service for Cisco Unified CallManager (CUCM) 5.0 before 5.0(4a)SU1 and Cisco Unified Presence Server (CUPS) 1.0 before 1.0(3) allows remote attackers to cause a denial of service (loss of cluster services) via a \specific UDP packet\ to UDP port 8500 aka bug ID CSCsg60949.


The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.


PerlRun.pm in Apache mod_perl before 1.30 and RegistryCooker.pm in mod_perl 2.x does not properly escape PATH_INFO before use in a regular expression which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.


The Grandstream BudgeTone 200 IP phone with program 1.1.1.14 and bootloader 1.1.1.5 allows remote attackers to cause a denial of service (device crash) via SIP (1) INVITE (2) CANCEL or unspecified other messages with a WWW-Authenticate header containing a crafted Digest domain.


The nl_fib_lookup function in net/ipv4/fib_frontend.c in Linux Kernel before 2.6.20.8 allows attackers to cause a denial of service (kernel panic) via NETLINK_FIB_LOOKUP replies which trigger infinite recursion and a stack overflow.


SimBin GTR - FIA GT Racing Game 1.5.0.0 and earlier GT Legends 1.1.0.0 and earlier GTR 2 1.1 and earlier and RACE - The WTCC Game 1.0 and earlier allow remote attackers to cause a denial of service (client disconnection) via an empty UDP packet to the server port.


The command line interface (CLI) in Cisco Unified IP Phone 7906G 7911G 7941G 7961G 7970G and 7971G with firmware 8.0(4)SR1 and earlier allows local users to obtain privileges or cause a denial of service via unspecified vectors. NOTE: this issue can be leveraged remotely via CVE-2007-1063.


The virtual machine process (VMX) in VMware Workstation before 5.5.4 does not properly read state information when moving from the ACPI sleep state to the run state which allows attackers to cause a denial of service (virtual machine reboot) via unknown vectors.


The handle_response function in chan_sip.c in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP Response code 0 in a SIP packet.


WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a file with a binary content type which is downloaded even though it cannot contain usable pingback data.


Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterprise Server allow remote attackers to cause a denial of service via certain requests that trigger errors that lead to a server being marked as unavailable hosting web server failure or CPU consumption.


squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing responses possibly related to the (1) ftpListingFinish and (2) ftpHtmlifyListEntry functions.


Hitachi HiRDB Datareplicator 7HiRDB 7(64) 6 6(64) 5.0 and 5.0(64); and various products that bundle HiRDB Datareplicator; allows attackers to cause a denial of service (CPU consumption) via certain data.


The Motorola MOTORAZR V3 phone allows remote attackers to cause a denial of service (continual modal dialogs and UI unavailability) by repeatedly trying to OBEX push a file over Bluetooth as demonstrated by ussp-push.


Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to cause a denial of service (memory exhaustion and servlet outage) via unknown vectors related to a large number of calls in a batch.


Unspecified vulnerability in Cisco Firewall Services Module (FWSM) 3.x before 3.1(3.3) when set to log at the \debug\ level allows remote attackers to cause a denial of service (device reboot) by sending packets that are not of a particular protocol such as TCP or UDP which triggers the reboot during generation of Syslog message 710006.


smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service (memory and CPU exhaustion) by renaming a file in a way that prevents a request from being removed from the deferred open queue which triggers an infinite loop.


The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors which allows remote attackers to cause a denial of service (server outage).


The GdkPixbufLoader function in GIMP ToolKit (GTK+) in GTK 2 (gtk2) before 2.4.13 allows context-dependent attackers to cause a denial of service (crash) via a malformed image file.


The SSH key generation process in OpenSSH in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allows remote attackers to cause a denial of service by connecting to the server before SSH has finished creating keys which causes the keys to be regenerated and can break trust relationships that were based on the original keys.


The utrace support in Linux kernel 2.6.18 and other versions allows local users to cause a denial of service (system hang) related to \MT exec + utrace_attach spin failure mode \ as demonstrated by ptrace-thrash.c.


Cisco Firewall Services Module (FWSM) 3.x before 3.1(3.1) allows remote attackers to cause a denial of service (device reboot) via malformed SNMP requests.


KarjaSoft Sami HTTP Server 2.0.1 allows remote attackers to cause a denial of service (daemon hang) via a large number of requests for nonexistent objects.


The Data-link Switching (DLSw) feature in Cisco IOS 11.0 through 12.4 allows remote attackers to cause a denial of service (device reload) via \an invalid value in a DLSw message... during the capabilities exchange.\


Format string vulnerability in iMovie HD 6.0.3 and Safari in Apple Mac OS X 10.4 through 10.4.10 allows remote user-assisted attackers to cause a denial of service (crash) via format string specifiers in a filename which is not properly handled when calling the NSRunCriticalAlertPanel Apple AppKit function.


The ATOMIC.TCP signature engine in the Intrusion Prevention System (IPS) feature for Cisco IOS 12.4XA 12.3YA 12.3T and other trains allows remote attackers to cause a denial of service (IPS crash and traffic loss) via unspecified manipulations that are not properly handled by the regular expression feature as demonstrated using the 3123.0 (Netbus Pro Traffic) signature.


The license registering interface in Symantec Web Security (SWS) before 3.0.1.85 allows attackers to cause a denial of service (CPU consumption) by submitting a large file.


Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3 9.4.0a1 up to 9.4.0a6 9.4.0b1 up to 9.4.0b4 9.4.0rc1 and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (named daemon crash) via unspecified vectors that cause named to \dereference a freed fetch context.\


Cisco PIX 500 and ASA 5500 Series Security Appliances 7.0 before 7.0(4.14) and 7.1 before 7.1(2.1) and the FWSM 2.x before 2.3(4.12) and 3.x before 3.1(3.24) when \inspect http\ is enabled allows remote attackers to cause a denial of service (device reboot) via malformed HTTP traffic.


PostgreSQL 7.3 before 7.3.13 7.4 before 7.4.16 8.0 before 8.0.11 8.1 before 8.1.7 and 8.2 before 8.2.2 allows attackers to disable certain checks for the data types of SQL function arguments which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content.


LGSERVER.EXE

in

BrightStor

Mobile

Backup

allows

remote

attackers

to

cause

a

denial

of

service

(disk

consumption

and

daemon

hang)

via

a

value

of

at

a

certain

point

in

an

authentication

negotiation

packet

which

writes

a

large

amount

of

data

to

a

.USX

file

in


DivXBrowserPlugin (aka DivX Web Player) npdivx32.dll as distributed with DivX Player 6.4.1 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) by invoking the GoWindowed method for a certain instance of the ActiveX object.


The ufs_lookup function in the Mac OS X 10.4.8 and FreeBSD 6.1 kernels allows local users to cause a denial of service (kernel panic) and possibly corrupt other filesystems by mounting a crafted UNIX File System (UFS) DMG image that contains a corrupted directory entry (struct direct) related to the ufs_dirbad function. NOTE: a third party states that the FreeBSD issue does not cross privilege boundaries.


The Bonjour functionality in mDNSResponder iChat 3.1.6 and InstantMessage framework 428 in Apple Mac OS X 10.4.8 allows remote attackers to cause a denial of service (persistent application crash) via a crafted phsh hash attribute in a TXT key.


Cisco Firewall Services Module (FWSM) 3.x before 3.1(3.11) when the HTTPS server is enabled allows remote attackers to cause a denial of service (device reboot) via certain HTTPS traffic.


Unspecified vulnerability in Microsoft Internet Explorer on Windows Mobile 5.0 allows remote attackers to cause a denial of service (loss of browser and other device functionality) via a malformed WML page related to an \overflow state.\ NOTE: it is possible that this issue is related to CVE-2007-0685.


VideoLAN VLC 0.8.6a allows remote attackers to cause a denial of service (application crash) via a crafted .wmv file.


nxconfigure.sh in NoMachine NX Server before 2.1.0-18 does not validate the invoking user which allows local users to modify server configuration keys in /usr/NX/etc/server.cfg resulting in an unspecified denial of service.


The JTapi Gateway process in Cisco Unified Contact Center Enterprise Unified Contact Center Hosted IP Contact Center Enterprise and Cisco IP Contact Center Hosted 5.0 through 7.1 allows remote attackers to cause a denial of service (repeated process restart) via a certain TCP session on the JTapi server port.


The AToZed IntraWeb component 8.0 and earlier for Borland Delphi and Kylix and IntraWeb 9.0 before build (9.0.12) allows remote attackers to cause a denial of service (thread hang or CPU consumption) via a crafted HTTP request related to the OnBeforeDispatch function in the TIWServerController object.


The http_open function in httpget.c in mpg123 before 0.64 allows remote attackers to cause a denial of service (infinite loop) by closing the HTTP connection early.


Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6 8.1 through 8.1 SP5 9.0 and 9.1 when T3 authentication is used allows remote attackers to cause a denial of service (thread and system hang) via unspecified \sequences of events.\


BEA WebLogic Server 6.1 through 6.1 SP7 and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers which cause a large amount of data to be written to the server log.


The file watch implementation in the audit subsystem (auditctl -w) in the Red Hat Enterprise Linux (RHEL) 4 kernel 2.6.9 allows local users to cause a denial of service (kernel panic) by replacing a watched file which does not cause the watch on the old inode to be dropped.


Unspecified vulnerability in libnsl in Sun Solaris 8 and 9 allows remote attackers to cause a denial of service (crash) via malformed RPC requests that trigger a crash in rpcbind.


A cleanup script in crontabs in Apple Mac OS X 10.3.9 and 10.4.9 might delete filesystems that have been mounted in /tmp which might allow local users to cause a denial of service related to the find command.


Unspecified vulnerability in the Chat Room functionality in Yahoo! Messenger 8.1.0.239 and earlier allows remote attackers to cause a denial of service via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


BEA WebLogic Server 6.1 through 6.1 SP7 7.0 through 7.0 SP6 8.1 through 8.1 SP5 and 9.0 allows remote attackers to cause a denial of service (server hang) via certain requests that cause muxer threads to block when processing error pages.


Hitachi

through

through

and

through

and

Base

through

through

through

and

allow

attackers

to

cause

a

denial

of

service

(process

crash)

via

invalid

data

to

an

port.


Unspecified vulnerability in Microsoft Word 2000 allows remote attackers to cause a denial of service (crash) via unknown vectors a different vulnerability than CVE-2006-5994 CVE-2006-6456 CVE-2006-6561 and CVE-2007-0515 a variant of Exploit-MS06-027.


The Nokia N70 phone allows remote attackers to cause a denial of service (continual modal dialogs and UI unavailability) by repeatedly trying to OBEX push a file over Bluetooth as demonstrated by ussp-push.


The Loopback Filesystem (LOFS) in Sun Solaris 10 allows local users in a non-global zone to move and rename files in a read-only filesystem which could lead to a denial of service.


Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero which causes a function to return without closing a file descriptor.


Unspecified vulnerability in Drupal before 4.6.11 and 4.7 before 4.7.5 when MySQL is used allows remote authenticated users to cause a denial of service by poisoning the page cache via unspecified vectors which triggers erroneous 404 HTTP errors for pages that exist.


Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML which triggers \massive memory usage.\


The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service (crash) by causing an external_acl queue overload which triggers an infinite loop.


The Common Controls Replacement Project (CCRP) FolderTreeview (FTV) ActiveX control (ccrpftv6.ocx) allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long CCRP.RootFolder property value.


Acunetix Web Vulnerability Scanner (WVS) 4.0 Build 20060717 and earlier allows remote attackers to cause a denial of service (application crash) via multiple HTTP requests containing invalid Content-Length values.


Cisco FWSM 3.x before 3.1(3.18) when authentication is configured to use \aaa authentication match\ or \aaa authentication include\ allows remote attackers to cause a denial of service (device reboot) via a malformed HTTPS request.


The Linux kernel 2.6.13 and other versions before 2.6.20.1 allows remote attackers to cause a denial of service (oops) via a crafted NFSACL 2 ACCESS request that triggers a free of an incorrect pointer.


cmdmon.sys in Comodo Firewall Pro (formerly Comodo Personal Firewall) before 2.4.16.174 does not validate arguments that originate in user mode for the (1) NtConnectPort and (2) NtCreatePort hooked SSDT functions which allows local users to cause a denial of service (system crash) and possibly gain privileges via invalid arguments.


Windows Explorer (explorer.exe) 6.0.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted .avi file which triggers the crash when the user right clicks on the file.


formbankcgi.exe in Fersch Formbankserver 1.9 when the PATH_INFO begins with (1) AbfrageForm or (2) EingabeForm allows remote attackers to cause a denial of service (daemon crash) via multiple requests containing many /../ sequences in the Name parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.


Pictures and Videos on Windows Mobile 5.0 and Windows Mobile 2003 and 2003SE for Smartphones and PocketPC allows user-assisted remote attackers to cause a denial of service (device hang) via a malformed JPEG file.


The Bonjour functionality in iChat in Apple Mac OS X 10.3.9 allows remote attackers to cause a denial of service (persistent application crash) via unspecified vectors possibly related to CVE-2007-0614.


packet-tcp.c in the TCP dissector in Wireshark (formerly Ethereal) 0.99.2 through 0.99.4 allows remote attackers to cause a denial of service (application crash or hang) via fragmented HTTP packets.


axigen 1.2.6 through 2.0.0b1 does not properly parse login credentials which allows remote attackers to cause a denial of service (NULL dereference and application crash) via a base64-encoded \*\\x00\ sequence on the imap port (143/tcp).


Cisco IOS allows remote attackers to cause a denial of service (crash) via a crafted IPv6 Type 0 Routing header.


Cisco PIX 500 and ASA 5500 Series Security Appliances 7.2.2 when configured to inspect certain TCP-based protocols allows remote attackers to cause a denial of service (device reboot) via malformed TCP packets.


Texas Imperial Software WFTPD and WFTPD Pro Server 3.25 and earlier allow remote attackers to cause a denial of service (application crash) via a long SITE ADMIN command.


The wp_remote_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a large file which triggers a long download session without a timeout constraint.


pptpgre.c in PoPToP Point to Point Tunneling Server (pptpd) before 1.3.4 allows remote attackers to cause a denial of service (PPTP connection tear-down) via (1) GRE packets with out-of-order sequence numbers or (2) certain GRE packets that are processed using a wrong pointer and improperly dequeued.


WebCore in Apple WebKit build 18794 allows remote attackers to cause a denial of service (null dereference and application crash) via a TD element with a large number in the ROWSPAN attribute as demonstrated by a crash of OmniWeb 5.5.3 on Mac OS X 10.4.8 a different vulnerability than CVE-2006-2019.


The Sony Ericsson K700i and W810i phones allow remote attackers to cause a denial of service (continual modal dialogs and UI unavailability) by repeatedly trying to OBEX push a file over Bluetooth as demonstrated by ussp-push.


Chicken of the VNC (cotv) 2.0 allows remote attackers to cause a denial of service (application crash) via a large computer-name size value in a ServerInit packet which triggers a failed malloc and a resulting NULL dereference.


Cisco IOS after 12.3(14)T 12.3(8)YC1 12.3(8)YG and 12.4 with voice support and without Session Initiated Protocol (SIP) configured allows remote attackers to cause a denial of service (crash) by sending a crafted packet to port 5060/UDP.


Intel Enterprise Southbridge 2 Baseboard Management Controller (BMC) Intel Server Boards 5000XAL S5000PAL S5000PSL S5000XVN S5000VCL S5000VSA SC5400RA and OEM Firmware for Intel Enterprise Southbridge Baseboard Management Controller before 20070119 when Intelligent Platform Management Interface (IPMI) is enabled allow remote attackers to connect and issue arbitrary IPMI commands possibly triggering a denial of service.


Array index error in the uri_lookup function in the URI parser for neon 0.26.0 to 0.26.2 possibly only on 64-bit platforms allows remote malicious servers to cause a denial of service (crash) via a URI with non-ASCII characters which triggers a buffer under-read due to a type conversion error that generates a negative index.


Unspecified vulnerability in March Networks DVR 3000 and 4000 Digital Video Recorders allows attackers to cause an unspecified denial of service. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The LG Chocolate KG800 phone allows remote attackers to cause a denial of service (continual modal dialogs and UI unavailability) by repeatedly trying to OBEX push a file over Bluetooth as demonstrated by ussp-push.


The is_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the \'\ (quote) character which allows remote authenticated users to execute limited SQL injection attacks and cause a denial of service (database error) via a ' character in certain messages tickets or Wiki entries.


Telligent Community Server 2.1 and earlier allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to (1) a large file which triggers a long download session without a timeout constraint; or (2) a file with a binary content type which is downloaded even though it cannot contain usable pingback data.


The key serial number collision avoidance code in the key_alloc_serial function in Linux kernel 2.6.9 up to 2.6.20 allows local users to cause a denial of service (crash) via vectors that trigger a null dereference as originally reported as \spinlock CPU recursion.\


The 64-bit versions of Microsoft Visual C++ 8.0 standard library (MSVCR80.DLL) time functions including (1) localtime (2) localtime_s (3) gmtime (4) gmtime_s (5) ctime (6) ctime_s (7) wctime (8) wctime_s and (9) fstat trigger an assertion error instead of a NULL pointer or EINVAL when processing a time argument later than Jan 1 3000 which might allow context-dependent attackers to cause a denial of service (application exit) via large time values. NOTE: it could be argued that this is a design limitation of the functions and the vulnerability lies with any application that does not validate arguments to these functions. However this behavior is inconsistent with documentation which does not list assertions as a possible result of an error condition.


OpenBSD before 20070116 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via certain IPv6 ICMP (aka ICMP6) echo request packets.


FreeProxy before 3.92 Build 1626 allows malicious users to cause a denial of service (infinite loop) via a HOST: header with a hostname and port number that refers to the server itself.


The query planner in PostgreSQL before 8.0.11 8.1 before 8.1.7 and 8.2 before 8.2.2 does not verify that a table is compatible with a \previously made query plan \ which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an \ALTER COLUMN TYPE\ SQL statement which can be leveraged to read arbitrary memory from the server.


Cisco PIX 500 and ASA 5500 Series Security Appliances 6.x before 6.3(5.115) 7.0 before 7.0(5.2) and 7.1 before 7.1(2.5) and the FWSM 3.x before 3.1(3.24) when the \inspect sip\ option is enabled allows remote attackers to cause a denial of service (device reboot) via malformed SIP packets.


Kaspersky Labs Antivirus Engine 6.0 for Windows and 5.5-10 for Linux before 20070102 enter an infinite loop upon encountering an invalid NumberOfRvaAndSizes value in the Optional Windows Header of a portable executable (PE) file which allows remote attackers to cause a denial of service (CPU consumption) by scanning a crafted PE file.


The zend_hash_init function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 when running on a 64-bit platform allows context-dependent attackers to cause a denial of service (infinite loop) by unserializing certain integer expressions which only cause 32-bit arguments to be used after the check for a negative value as demonstrated by an \a:2147483649:{\ argument.


The Bonjour functionality in mDNSResponder iChat 3.1.6 and InstantMessage framework 428 in Apple Mac OS X 10.4.8 does not check for duplicate entries when adding newly discovered available contacts which allows remote attackers to cause a denial of service (disrupted communication) via a flood of duplicate _presence._tcp mDNS queries.


The Huawei Versatile Routing Platform 1.43 2500E-003 firmware on the Quidway R1600 Router and possibly other models allows remote attackers to cause a denial of service (device crash) via a long show arp command.


Cisco FWSM 3.x before 3.1(3.2) when authentication is configured to use \aaa authentication match\ or \aaa authentication include\ allows remote attackers to cause a denial of service (device reboot) via a long HTTP request.


ISC BIND 9.0.x 9.1.x 9.2.0 up to 9.2.7 9.3.0 up to 9.3.3 9.4.0a1 up to 9.4.0a6 9.4.0b1 up to 9.4.0b4 9.4.0rc1 and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (exit) via a type * (ANY) DNS query response that contains multiple RRsets which triggers an assertion error aka the \DNSSEC Validation\ vulnerability.


cmdmon.sys in Comodo Firewall Pro (formerly Comodo Personal Firewall) 2.4.16.174 and earlier does not validate arguments that originate in user mode for the (1) NtCreateSection (2) NtOpenProcess (3) NtOpenSection (4) NtOpenThread and (5) NtSetValueKey hooked SSDT functions which allows local users to cause a denial of service (system crash) and possibly gain privileges via invalid arguments.


The CUPS service on multiple platforms allows remote attackers to cause a denial of service (service hang) via a \partially-negotiated\ SSL connection which prevents other requests from being accepted.


Format string vulnerability in Apple Safari 2.0.4 (419.3) allows remote user-assisted attackers to cause a denial of service (crash) via format string specifiers in filenames that are not properly handled when calling the (1) NSLog and (2) NSBeginAlertSheet Apple AppKit functions.


The do_hfs_truncate function in Mac OS X 10.4.8 allows context-dependent attackers to cause a denial of service (kernel panic) via a crafted HFS+ filesystem in a DMG image which causes an access of an invalid vnode structure during file removal.


Use-after-free vulnerability in PDFium as used in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document related to fpdfsdk/src/fpdfview.cpp and fpdfsdk/src/fsdk_mgr.cpp a different vulnerability than CVE-2015-1205.


The png coder in ImageMagick allows remote attackers to cause a denial of service (crash).


The eSpace Meeting ActiveX control (eSpaceStatusCtrl.dll) in Huawei eSpace Desktop before V200R001C03 allows local users to cause a denial of service (memory overflow) via unspecified vectors.


coders/pnm.c in ImageMagick 6.9.0-1 Beta and earlier allows remote attackers to cause a denial of service (crash) via a crafted png file.


The ELF parser in file 5.16 through 5.21 allows remote attackers to cause a denial of service via a long string.


The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a \broken number-with-base\ in a Postscript stream as demonstrated by 8#garbage.


sysplant.sys in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allows local users to cause a denial of service (blocked system shutdown) by triggering an unspecified deadlock condition.


wp-includes/class-phpass.php in WordPress before 3.7.5 3.8.x before 3.8.5 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing a similar issue to CVE-2014-9016.


Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


The getid3 library in MediaWiki before 1.24.1 1.23.8 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files cause a denial of service or possibly have other impact via an XML External Entity (XXE) attack. NOTE: Related to CVE-2014-2053.


libavcodec/utvideodec.c in FFmpeg before 2.5.2 does not check for a zero value of a slice height which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Ut Video data related to the (1) restore_median and (2) restore_median_il functions.


Siemens SPC controllers SPC4000 SPC5000 and SPC6000 before 3.6.0 allow remote attackers to cause a denial of service (device restart) via crafted packets.


Huawei USG9560/9520/9580 before V300R001C01SPC300 allows remote attackers to cause a memory leak or denial of service (memory exhaustion reboot and MPU switchover) via a crafted website.


HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.


The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMU_MACHPHYS_UPDATE.


libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file related to the Exif marker.


readelf.c in file before 5.22 as used in the Fileinfo component in PHP before 5.4.37 5.5.x before 5.5.21 and 5.6.x before 5.6.5 does not consider that pread calls sometimes read only a subset of the available data which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.


The email gateway in RT (aka Request Tracker) 3.0.0 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to cause a denial of service (CPU and disk consumption) via a crafted email.


The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file.


imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.


The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6 2.2.x through 2.3.x and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via an IDAT before an IHDR in a PNG file.


Arbiter 1094B GPS Substation Clock allows remote attackers to cause a denial of service (disruption) via crafted radio transmissions that spoof GPS satellite broadcasts.


Double free vulnerability in the ssl_parse_clienthello_use_srtp_ext function in d1_srtp.c in LibreSSL before 2.1.2 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a certain length-verification error during processing of a DTLS handshake.


The CodeWrights HART Device Type Manager (DTM) library in Emerson HART DTM before 1.4.181 allows physically proximate attackers to cause a denial of service (DTM outage and FDT Frame application hang) by transmitting crafted response packets on the 4-20 mA current loop.


ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1 when Autokey Authentication is enabled allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.


Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a crafted QES file.


Xen 4.4.x and earlier when using a large number of VCPUs does not properly handle read and write locks which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests a different vulnerability than CVE-2014-9065.


Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2 12.x before 12.7.2 and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.


The mconvert function in softmagic.c in file before 5.21 as used in the Fileinfo component in PHP before 5.4.37 5.5.x before 5.5.21 and 5.6.x before 5.6.5 does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file.


strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.


The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries which allows local users to cause a denial of service (infinite loop and system crash or hang) via a crafted iso9660 image.


The mjpeg_decode_app function in libavcodec/mjpegdec.c in FFMpeg before 2.1.6 2.2.x through 2.3.x and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via vectors related to LJIF tags in an MJPEG file.


Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.


Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption).


engine/server/server.cpp in Teeworlds 0.6.x before 0.6.3 allows remote attackers to read memory and cause a denial of service (crash) via unspecified vectors.


Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption).


platform/msm_shared/dev_tree.c in the Qualcomm bootloader in Android before 2016-07-05 on Nexus 5 devices does not check the relationship between tags addresses and aboot addresses which allows attackers to cause a denial of service (OS outage) via a crafted application aka Android internal bug 28821448 and Qualcomm internal bug CR681965.


The Googlemaps plugin 3.2 and earlier for Joomla! allows remote attackers with control of a sub-domain belonging to a victim domain to cause a denial of service via the 'url' parameter to plugin_googlemap3_kmlprxy.php. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7428.


oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.


The Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices makes incorrect snprintf calls which allows remote attackers to cause a denial of service (device hang or reboot) via crafted frames aka Android internal bug 28670333 and Qualcomm internal bug CR548711.


The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.


coders/tiff.c in ImageMagick allows remote attackers to cause a denial of service (application crash) via vectors related to the \identification of image.\


libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7 4.1.x before 4.1.14.8 and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password.


The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large number of notes.


Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientHello messages. NOTE: this identifier was SPLIT from CVE-2014-8628 per ADT3 due to different affected versions.


The pdb coder in ImageMagick allows remote attackers to cause a denial of service (double free) via unspecified vectors.


The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.


magick/cache.c in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (crash).


imlib2 before 1.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted PNM file.


The xwd file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed xwd file.


The Meeting component in Huawei eSpace Desktop before V100R001C03 allows local users to cause a denial of service (program exit) via a crafted image.


type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.


Adobe ColdFusion 10 before Update 15 and 11 before Update 3 allows attackers to cause a denial of service (resource consumption) via unspecified vectors.


The regulator_ena_gpio_free function in drivers/regulator/core.c in the Linux kernel before 3.19 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.


The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.


in

Google

Chrome

before

on

Android

does

not

properly

restrict

use

of

intent:

URLs

to

open

an

application

after

navigation

to

a

web

site

which

allows

remote

attackers

to

cause

a

denial

of

service

(loss

of

browser

access

to

that

site)

via

crafted

JavaScript

code

as

demonstrated

by

pandora.com

and

the

Pandora

application

a

different

vulnerability

than


The vmd_decode function in libavcodec/vmdvideo.c in FFmpeg before 2.5.2 does not validate the relationship between a certain length value and the frame width which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Sierra VMD video data.


The raw_decode function in libavcodec/rawdec.c in FFMpeg before 2.1.6 2.2.x through 2.3.x and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via a crafted .cine file that triggers the avpicture_get_size function to return a negative frame size.


senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files.


The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.


coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS file.


OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish a different vulnerability than CVE-2015-1881.


The (1) t1_parse_font_matrix function in type1/t1load.c (2) cid_parse_font_matrix function in cid/cidload.c (3) t42_parse_font_matrix function in type42/t42parse.c and (4) ps_parser_load_field function in psaux/psobjs.c in FreeType before 2.5.4 do not check return values which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted font.


The numtok function in lib/raven/okjson.rb in the raven-ruby gem before 0.12.2 for Ruby allows remote attackers to cause a denial of service via a large exponent value in a scientific number.


The ff_hevc_decode_nal_sps function in libavcodec/hevc_ps.c in FFMpeg before 2.1.6 2.2.x through 2.3.x and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted .bit file.


Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file.


coders/sun.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted sun file.


The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large box size.


OpenStack Glance 2014.2.x through 2014.2.1 2014.1.3 and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting an image in the saving state.


The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode which allows remote attackers to cause a denial of service (infinite loop) via a Type42 font.


The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21 when the DNS backend in the Name Service Switch configuration is enabled allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process.


vision.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via vectors related to \too many object.\


The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2) NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image as demonstrated by libtiff-cvs-1.tif and libtiff-cvs-2.tif.


magick/colormap-private.h in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access).


The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.18.2 does not ensure a certain data-structure size consistency which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.


imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.


The dpx file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed dpx file.


scanner.c in LibYAML 0.1.5 and 0.1.6 as used in the YAML-LibYAML (aka YAML-XS) module for Perl allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.


common/spinlock.c in Xen 4.4.x and earlier does not properly handle read and write locks which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests a different vulnerability to CVE-2014-9066.


GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fault) via a crafted diff file.


The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop and system crash) via a PRDT with zero complete sectors related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.


The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register which allows local users to cause a denial of service (panic) via a modify_ldt system call as demonstrated by sigreturn_32 in the linux-clock-tests test suite.


libavcodec/xface.h in FFmpeg before 2.5.2 establishes certain digits and words array dimensions that do not satisfy a required mathematical relationship which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted X-Face image data.


Apache Traffic Server before 5.1.2 allows remote attackers to cause a denial of service via unspecified vectors related to internal buffer sizing.


Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (application crash) via a call in a situation where :some_key is present in keep_keys but not present in the hash.


Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources.


ISC BIND 9.0.x through 9.8.x 9.9.0 through 9.9.6 and 9.10.0 through 9.10.1 does not limit delegation chaining which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals.


The TACACS+ command-authorization implementation in Cisco NX-OS allows local users to cause a denial of service (device reload) via a long CLI command aka Bug ID CSCur54182.


pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.


The dissect_write_structured_field function in epan/dissectors/packet-tn5250.c in the TN5250 dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


The REXML parser in Ruby 1.9.x before 1.9.3-p550 2.0.x before 2.0.0-p594 and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document aka an XML Entity Expansion (XEE) attack.


The compatibility mode hypercall argument translation in Xen 3.3.x through 4.4.x when running on a 64-bit hypervisor allows local 32-bit HVM guests to cause a denial of service (host crash) via vectors involving altering the high halves of registers while in 64-bit mode.


OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine which allows remote attackers to cause a denial of service via a large number of requests to the login page.


The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a \session overflow\ involving \sessions overlapping in memory.\


Unspecified vulnerability in Check Point Security Gateway R75 R76 R77 and R77.10 when UserCheck is enabled and the (1) Application Control (2) URL Filtering (3) DLP (4) Threat Emulation (5) Anti-Bot or (6) Anti-Virus blade is used allows remote attackers to cause a denial of service (fwk0 process crash core dump and restart) via a redirect to the UserCheck page.


The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path expressions.


CA Cloud Service Management (CSM) before Summer 2014 allows remote attackers to read arbitrary files send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


Common Inventory Technology (CIT) before 2.7.0.2050 in IBM License Metric Tool 7.2.2 7.5 and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service (CPU consumption or application crash) via a crafted XML query a different vulnerability than CVE-2014-8926.


Huawei

with

software

with

software

ACU

with

software

ACU

with

software

with

software

and

earlier

versions;

with

software

and

earlier

versions;

with

software

and

earlier

versions

could

allow

remote

attackers

to

send

a

special

SSH

packet

to

the

VRP

device

to

cause

a

denial

of

service.


Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 when using the res_pjsip_refer module allows remote attackers to cause a denial of service (crash) via an in-dialog INVITE with Replaces message which triggers the channel to be hung up.


libavcodec/mmvideo.c in FFmpeg before 2.4.2 does not consider all lines of HHV Intra blocks during validation of image height which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MM video data.


The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c as demonstrated by tiffdither.


The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.


The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551 2.0.x before 2.0.0 patchlevel 598 and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080.


libavcodec/gifdec.c in FFmpeg before 2.4.2 does not properly compute image heights which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted GIF data.


iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining which allows remote attackers to cause a denial of service (memory and CPU consumption) via a large or infinite number of referrals.


network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.


The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2 when using radvd 2.0+ allows remote authenticated users to cause a denial of service (blocked router update processing) by creating eight routers and assigning an ipv6 non-provider subnet to each.


Common Inventory Technology (CIT) before 2.7.0.2050 in IBM License Metric Tool 7.2.2 7.5 and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service (CPU consumption or application crash) via a crafted XML query a different vulnerability than CVE-2014-8927.


FreeBSD 9.1 9.2 and 10.0 when compiling OpenSSH with Kerberos support uses incorrect library ordering when linking sshd which causes symbols to be resolved incorrectly and allows remote attackers to cause a denial of service (sshd deadlock and prevention of new connections) by ending multiple connections before authentication is completed.


LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image as demonstrated by failure of tif_next.c to verify that the BitsPerSample value is 2 and the t2p_sample_lab_signed_to_unsigned function in tiff2pdf.c.


The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access.


libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.


The CMS CORBA listener in SAP BusinessObjects BI Edge 4.0 allows remote attackers to cause a denial of service (server shutdown) via crafted OSCAFactory::Session ORB message.


Integer underflow in libavcodec/cinepak.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Cinepak video data.


The Calendar Base (cal) extension before 1.5.9 and 1.6.x before 1.6.1 for TYPO3 allows remote attackers to cause a denial of service (resource consumption) via vectors related to the PHP PCRE library.


OpenVPN 2.x before 2.0.11 2.1.x 2.2.x before 2.2.3 and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.


Unspecified vulnerability in McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to obtain sensitive information affect integrity or cause a denial of service via unknown vectors related to simultaneous logins.


The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.


The filesystem implementation in the Linux kernel before 3.13 performs certain operations on lists of files with an inappropriate locking approach which allows local users to cause a denial of service (soft lockup or system crash) via unspecified use of Asynchronous I/O (AIO) operations.


The Cisco IronPort Email Security Appliance (ESA) allows remote attackers to cause a denial of service (CPU consumption) via long Subject headers in e-mail messages aka Bug ID CSCzv93864.


The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write segmentation fault and crash) via a crafted extended name table in an archive.


DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it which triggers the file pointer to be reset.


The

mozilla::dom::AudioParamTimeline::AudioNodeInputValue

function

in

the

Web

Audio

API

implementation

in

Mozilla

Firefox

before

and

SeaMonkey

before

does

not

properly

restrict

timeline

operations

which

allows

remote

attackers

to

cause

a

denial

of

service

(uninitialized-memory

read

and

application

crash)

via

crafted

API

calls.


The acceleration support for the \REP MOVS\ instruction in Xen 4.4.x 3.2.x and earlier lacks properly bounds checking for memory mapped I/O (MMIO) emulated in the hypervisor which allows local HVM guests to cause a denial of service (host crash) via unspecified vectors.


The FTP server on Siemens SCALANCE X-300 switches with firmware before 4.0 and SCALANCE X 408 switches with firmware before 4.0 allows remote authenticated users to cause a denial of service (reboot) via crafted FTP packets.


The GeoIP functionality in ISC BIND 9.10.0 through 9.10.1 allows remote attackers to cause a denial of service (assertion failure and named exit) via vectors related to (1) the lack of GeoIP databases for both IPv4 and IPv6 or (2) IPv6 support with certain options.


Unspecified vulnerability in Check Point Security Gateway R77 and R77.10 when the (1) URL Filtering or (2) Identity Awareness blade is used allows remote attackers to cause a denial of service (crash) via vectors involving an HTTPS request.


The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.


VMware Workstation 10.x before 10.0.5 VMware Player 6.x before 6.0.5 VMware Fusion 6.x before 6.0.5 and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a configuration file.


Cisco IOS XR allows remote attackers to cause a denial of service (LISP process reload) by establishing many LISP TCP sessions aka Bug ID CSCuq90378.


buddy-ng.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.


Elipse E3 3.x and earlier allows remote attackers to cause a denial of service (application crash and plant outage) via a rapid series of HTTP requests to index.html on TCP port 1681.


Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates. NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2014-9744 for the ClientHello message issue.


The XML_RPC_cd function in lib/pear/XML/RPC.php in Revive Adserver before 3.0.6 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted XML-RPC request aka an XML Entity Expansion (XEE) attack.


PowerDNS Recursor before 3.6.2 does not limit delegation chaining which allows remote attackers to cause a denial of service (\performance degradations\) via a large or infinite number of referrals as demonstrated by resolving domains hosted by ezdns.it.


libavcodec/tiff.c in FFmpeg before 2.4.2 does not properly validate bits-per-pixel fields which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted TIFF data.


tcpdump 3.8 through 4.6.2 might allow remote attackers to obtain sensitive information from memory or cause a denial of service (packet loss or segmentation fault) via a crafted Ad hoc On-Demand Distance Vector (AODV) packet which triggers an out-of-bounds memory access.


Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet aka Bug ID CSCub63710.


The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resize state.


The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly restrict use of User Verbs for registration of memory regions which allows local users to access arbitrary physical memory locations and consequently cause a denial of service (system crash) or gain privileges by leveraging permissions on a uverbs device under /dev/infiniband/.


IBM DB2 9.5 through FP10 9.7 through FP10 9.8 through FP5 10.1 through FP4 and 10.5 before FP5 allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted XML query.


Multiple unspecified vulnerabilities in Check Point Security Gateway R75.40VS R75.45 R75.46 R75.47 R76 R77 and R77.10 when the (1) IPS blade (2) IPsec Remote Access (3) Mobile Access / SSL VPN blade (4) SSL Network Extender (5) Identify Awareness blade (6) HTTPS Inspection (7) UserCheck or (8) Data Leak Prevention blade module is enabled allow remote attackers to cause a denial of service (\stability issue\) via an unspecified \traffic condition.\


The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities.


The build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 does not properly initialize a data structure which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2 when in verbose mode allow remote attackers to cause a denial of service (segmentation fault and crash) via a crafted length value in a Geonet frame.


libavcodec/on2avc.c in FFmpeg before 2.4.2 does not constrain the number of channels to at most 2 which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted On2 data.


The memory resource controller (aka memcg) in the Linux kernel allows local users to cause a denial of service (deadlock) by spawning new processes within a memory-constrained cgroup.


Cisco Unified Communication Domain Manager Platform Software allows remote attackers to cause a denial of service (CPU consumption and performance degradation or service outage) via a flood of malformed TCP packets and UDP packets aka Bug ID CSCup25276.


The JPEG decoder in ImageMagick before 6.8.9-9 allows local users to cause a denial of service (out-of-bounds memory access and crash).


arch/x86/x86_emulate/x86_emulate.c in Xen 3.2.1 through 4.4.x does not properly check privileges which allows local HVM guest users to gain privileges or cause a denial of service (crash) via a crafted (1) CALL (2) JMP (3) RETF (4) LCALL (5) LJMP or (6) LRET far branch instruction.


softmagic.c in file before 5.21 does not properly limit recursion which allows remote attackers to cause a denial of service (CPU consumption or crash) via unspecified vectors.


The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28 3.2.x before 3.2.20 and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR) related to generating key IDs.


The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock which allows local users to cause a denial of service (deadlock and system hang) via a crafted application.


The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows remote attackers to cause a denial of service (disconnect all wifi clients) via a request to wirelessChannelStatus.html.