The perfstat kernel extension in bos.perf.perfstat in AIX 5.3 does not verify privileges when processing a SET call which allows local users to cause a denial of service (system hang or crash) via unspecified SET operations.


Multiple

memory

leaks

in

Cisco

IOS

through

allow

remote

attackers

to

cause

a

denial

of

service

(device

crash)

via

a

malformed

SIP

packet

aka

and


Cisco 4100 and 4400 Airespace 4000 and Catalyst 6500 and 3750 Wireless LAN Controller (WLC) software before 3.2 20070727 4.0 before 20070727 and 4.1 before 4.1.180.0 allows remote attackers to cause a denial of service (traffic amplification or ARP storm) via a crafted unicast ARP request that (1) has a destination MAC address unknown to the Layer-2 infrastructure aka CSCsj69233; or (2) occurs during Layer-3 roaming across IP subnets aka CSCsj70841.


Unspecified vulnerability in Skype allows remote attackers to cause a denial of service (server hang) via unknown vectors related to sending long URIs as claimed to be actively exploited on 20070817 using a \call to a specific number.\ NOTE: this identifier is for the en.securitylab.ru disclosure. According to the vendor this issue is separate from the \sign-on issues\ that reduced Skype service on 20070817 which appears to be a site-specific problem. As of 20070821 it is not clear whether this issue is simply a symptom of the larger sign-on problem.


Integer underflow in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via a PKT_CHAT packet with a data length less than 3 which triggers an erroneous malloc possibly related to the Sv_HandlePacket function in sv_main.c.


rmpvc on IBM AIX 4.3 allows local users to cause a denial of service (system crash) via long port logical name (-l) argument.


Unspecified vulnerability in the server in Firebird before 2.0.2 when a Superserver/TCP/IP environment is configured allows remote attackers to cause a denial of service (CPU and memory consumption) via \large network packets with garbage\ aka CORE-1397.


rvd in TIBCO Rendezvous (RV) 7.5.2 when -no-lead-wc is omitted might allow remote attackers to cause a denial of service (network instability) via a subject name with a leading (1) '*' (asterisk) or (2) '>' (greater than) wildcard character.


BlockHosts before 2.0.4 does not properly parse (1) sshd and (2) vsftpd log files which allows remote attackers to add arbitrary deny entries to the /etc/hosts.allow file and cause a denial of service by adding arbitrary IP addresses to a daemon log file as demonstrated by connecting through ssh with a client protocol version identification containing an IP address string or connecting through ftp with a username containing an IP address string different vectors than CVE-2007-2765.


The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23 1.4.x before 1.4.9 and Asterisk Appliance Developer Kit before 0.6.0 when configured to allow unauthenticated calls allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake which causes an ast_channel to be allocated but not released.


Cisco Content Switching Modules (CSM) 4.2 before 4.2.7 and Cisco Content Switching Module with SSL (CSM-S) 2.1 before 2.1.6 when service termination is enabled allow remote attackers to cause a denial of service (reboot) via unspecified vectors related to high network utilization aka CSCsh57876.


Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.11 and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors. NOTE: this is probably different from CVE-2007-0916 but this is not certain due to lack of vendor details.


Zoidcom 0.6.7 and earlier allows remote attackers to cause a denial of service (application crash) via a JOIN packet (aka connection packet) containing 0x69 in the ninth byte which triggers a \double-delete\ of trace data a different vulnerability than CVE-2005-1643.


The Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation 5.0 for Windows allows remote attackers to cause a denial of service (daemon crash or hang) via malformed packets.


The UCC dedicated server for the Unreal engine possibly 2003 and 2004 on Windows allows remote attackers to cause a denial of service (continuous beep and server slowdown) via a string containing many 0x07 characters in (1) a request to the images/ directory (2) the Content-Type field (3) a HEAD request and possibly other unspecified vectors.


The administrative interface (aka DkService.exe) in Diskeeper 9 Professional 2007 Pro Premier and probably other versions exposes a memory comparison function via RPC over TCP which allows remote attackers to (1) obtain sensitive information (process memory contents) as demonstrated by an attack that obtains module base addresses to defeat Address Space Layout Randomization (ASLR); or (2) cause a denial of service (application crash) via an out-of-bounds address.


RegMon 7.04 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to cause a denial of service (crash) and possibly gain privileges via kernel SSDT hooks to the (1) NtCreateKey and (2) NtOpenKey Windows Native API functions.


The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections.


Guidance Software EnCase 5.0 allows user-assisted remote attackers to cause a denial of service (stack memory consumption) and possibly have other unspecified impact via a malformed file related to \EnCase's file system parsing.\ NOTE: this information is based upon a vague pre-advisory. It might overlap CVE-2007-4036.


Alien Arena 2007 6.10 and earlier allows remote attackers to cause a denial of service (client disconnect) by sending a client_connect command in a forged packet from the server to a client. NOTE: client IP addresses are available via product-specific queries.


Avnex AV MP3 Player allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed .au file that triggers a divide-by-zero error.


The administration interface in the Planet VC-200M VDSL2 router allows remote attackers to cause a denial of service (administration interface outage) via an HTTP request without a Host header.


The Open Phone Abstraction Library (opal) as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4 allows remote attackers to cause a denial of service (crash) via an invalid Content-Length header field in Session Initiation Protocol (SIP) packets which causes a \\0 byte to be written to an \attacker-controlled address.\


PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers (3) iconv_mime_decode or (4) iconv_strlen function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads unless these issues can be demonstrated for code execution.


Windows Calendar on Microsoft Windows Vista allows remote attackers to cause a denial of service (NULL dereference and persistent application crash) via a malformed ICS file.


DenyHosts 2.6 does not properly parse sshd log files which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file as demonstrated by logging in via ssh with a client protocol version identification containing an IP address string a different vector than CVE-2006-6301.


The Visionsoft Audit on Demand Service (VSAOD) in Visionsoft Audit 12.4.0.0 does not require authentication for (1) the \LOG.\ command which allows remote attackers to create or overwrite arbitrary files; (2) the SETTINGSFILE command which allows remote attackers to overwrite the ini file and reconfigure VSAOD or cause a denial of service; or (3) the UNINSTALL command which allows remote attackers to cause a denial of service (daemon shutdown). NOTE: vector 1 can be leveraged for code execution by writing to a Startup folder.


The (1) hugetlb_vmtruncate_list and (2) hugetlb_vmtruncate functions in fs/hugetlbfs/inode.c in the Linux kernel before 2.6.19-rc4 perform certain prio_tree calculations using HPAGE_SIZE instead of PAGE_SIZE units which allows local users to cause a denial of service (panic) via unspecified vectors.


Cisco Content Switching Modules (CSM) 4.2 before 4.2.3a and Cisco Content Switching Module with SSL (CSM-S) 2.1 before 2.1.2a allow remote attackers to cause a denial of service (CPU consumption or reboot) via sets of out-of-order TCP packets with unspecified characteristics aka CSCsd27478.


X-Diesel Unreal Commander 0.92 build 565 and 573 does not properly react to an FTP server's behavior after sending a \CWD /\ command which allows remote FTP servers to cause a denial of service (infinite loop) by (1) repeatedly sending a 550 error response or (2) sending a 550 error response and then disconnecting.


JSMP3OGGWt.dll in JetCast Server 2.0.0.4308 allows remote attackers to cause a denial of service (daemon crash) via a long .mp3 URI to TCP port 8000. NOTE: some of these details are obtained from third party information.


Media Player Classic (MPC) allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed .au file that triggers a divide-by-zero error.


Unspecified vulnerability in pfilter-reporter.pl in Astaro Security Gateway (ASG) 7 allows remote attackers to cause a denial of service (CPU consumption) via certain network traffic as demonstrated by P2P and iTunes applications that download large amounts of data.


Unspecified vulnerability in Dell Remote Access Card 4 (DRAC4) with firmware 1.50 Build 02.16 allows remote attackers to cause a denial of service (SSH daemon crash) via certain network traffic as demonstrated by an \nmap -O\ scan with nmap 4.03 possibly related to a Mocana (Mocanada) SSH vulnerability.


Soldat game server 1.4.2 and earlier and dedicated server 2.6.2 and earlier allows remote attackers to cause a denial of service (client lockout) via a series of UDP join packets from a spoofed IP address which triggers temporary blacklisting of this IP address.


Brian Carrier The Sleuth Kit (TSK) before 2.09 allows user-assisted remote attackers to cause a denial of service (application crash) and prevent examination of certain NTFS files via a malformed NTFS image that triggers (1) dereference of a certain integer value by ntfs_dent.c in fls or (2) dereference of a certain other integer value by ntfs.c in fsstat.


libpurple in Pidgin before 2.2.1 does not properly handle MSN nudge messages from users who are not on the receiver's buddy list which allows remote attackers to cause a denial of service (crash) via a nudge message that triggers an access of \an invalid memory location.\


The regular expression parser in TCL before 8.4.17 as used in PostgreSQL 8.2 before 8.2.6 8.1 before 8.1.11 8.0 before 8.0.15 and 7.4 before 7.4.19 allows remote authenticated users to cause a denial of service (backend crash) via an out-of-bounds backref number.


ircu 2.10.12.02 through 2.10.12.04 allows remote attackers to cause a denial of service (memory and bandwidth consumption) by creating a large number of unused channels (zannels).


The Shared Trace Service (aka OVTrace) in HP Performance Agent C.04.70 (aka 4.70) HP OpenView Performance Agent C.04.60 and C.04.61 HP Reporter 3.8 and HP OpenView Reporter 3.7 (aka Report 3.70) allows remote attackers to cause a denial of service via an unspecified series of RPC requests (aka Trace Event Messages) that triggers an out-of-bounds memory access related to an erroneous object reference.


Online Armor Personal Firewall 2.0.1.215 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to cause a denial of service (crash) and possibly gain privileges via unspecified kernel SSDT hooks for Windows Native API functions including (1) NtAllocateVirtualMemory (2) NtConnectPort (3) NtCreateFile (4) NtCreateKey (5) NtCreatePort (6) NtDeleteFile (7) NtDeleteValueKey (8) NtLoadKey (9) NtOpenFile (10) NtOpenProcess (11) NtOpenThread (12) NtResumeThread (13) NtSetContextThread (14) NtSetValueKey (15) NtSuspendProcess (16) NtSuspendThread and (17) NtTerminateThread.


The Fileinfo 2.0.9 plugin for Total Commander allows user-assisted remote attackers to cause a denial of service (unhandled exception) via an invalid RVA address function pointer in (1) an IMAGE_THUNK_DATA structure involving the (a) OriginalFirstThunk and (b) FirstThunk IMAGE_IMPORT_DESCRIPTOR fields or (2) the AddressOfNames IMAGE_EXPORT_DIRECTORY field in a PE file.


The setlocale function in PHP before 5.2.4 allows context-dependent attackers to cause a denial of service (application crash) via a long string in the locale parameter. NOTE: this might not be a vulnerability in most web server environments that support multiple threads unless this issue can be demonstrated for code execution.


Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service (device crash) via (1) \abnormal\ MGCP messages aka CSCsd81407; and (2) a large facsimile packet aka CSCej20505.


eyeOS uses predictable checksum values in the checknum parameter for access control which allows remote attackers to register many accounts via doCreateUser actions add many eyeBoard messages via addMsg actions and cause a denial of service or conduct certain unauthorized activities by guessing valid parameter values.


ntfs.c in fsstat in Brian Carrier The Sleuth Kit (TSK) before 2.09 interprets a certain variable as a byte count rather than a count of 32-bit integers which allows user-assisted remote attackers to cause a denial of service (application crash) and prevent examination of certain NTFS files via a malformed NTFS image.


The client in Toribash 2.71 and earlier allows remote attackers to cause a denial of service (disconnection) via a long (1) emote or (2) SPEC command.


Unspecified vulnerability in KDE Konqueror 3.5.7 and earlier allows remote attackers to cause a denial of service (failed assertion and application crash) via certain malformed HTML as demonstrated by a document containing TEXTAREA BUTTON BR BDO PRE FRAMESET and A tags. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Unspecified vulnerability in Cisco IOS 12.0 through 12.4 allows context-dependent attackers to cause a denial of service (device restart and BGP routing table rebuild) via certain regular expressions in a \show ip bgp regexp\ command. NOTE: unauthenticated remote attacks are possible in environments with anonymous telnet and Looking Glass access.


sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and application crash) by refusing certain warning messages that are sent over SMTP.


Unspecified vulnerability in Cisco IOS and Cisco IOS XR 12.x up to 12.3 including some versions before 12.3(15) and 12.3(14)T allows remote attackers to obtain sensitive information (partial packet contents) or cause a denial of service (router or component crash) via crafted IPv6 packets with a Type 0 routing header.


Unspecified vulnerability in SSHield 1.6.1 with OpenSSH 3.0.2p1 on Cisco WebNS 8.20.0.1 on Cisco Content Services Switch (CSS) series 11000 devices allows remote attackers to cause a denial of service (connection slot exhaustion and device crash) via a series of large packets designed to exploit the SSH CRC32 attack detection overflow (CVE-2001-0144) possibly a related issue to CVE-2002-1024.


The (1) aac_cfg_open and (2) aac_compat_ioctl functions in the SCSI layer ioctl path in aacraid in the Linux kernel before 2.6.23-rc2 do not check permissions for ioctls which might allow local users to cause a denial of service or gain privileges.


Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service via a certain JPG file as demonstrated by something.jpg. NOTE: this issue might be related to CVE-2007-3958.


fail2ban 0.8 and earlier does not properly parse sshd log files which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file as demonstrated by logging in via ssh with a client protocol version identification containing an IP address string a different vector than CVE-2006-6302.


Live for Speed (LFS) S1 and S2 allows remote attackers to cause a denial of service (server crash) via (1) a certain 0x00 byte in a pre-login ID 3 packet which triggers a NULL dereference; or (2) a pre-login ID 5 packet that lacks certain strings which triggers an invalid pointer dereference.


Process Monitor 1.22 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to cause a denial of service (crash) and possibly gain privileges via unspecified kernel SSDT hooks for Windows Native API functions including (1) NtCreateKey (2) NtDeleteValueKey (3) NtLoadKey (4) NtOpenKey (5) NtQueryValueKey (6) NtSetValueKey and (7) NtUnloadKey.


The Grandstream SIP Phone GXV-3000 with firmware 1.0.1.7 Loader 1.0.0.6 and Boot 1.0.0.18 allows remote attackers to force silent call completion eavesdrop on the phone's local environment and cause a denial of service (blocked call reception) via a certain SIP INVITE message followed by a certain \SIP/2.0 183 Session Progress\ message.


The

readRequest

method

in

in

GCALDaemon

allows

remote

attackers

to

cause

a

denial

of

service

via

a

large

integer

value

in

the

Content-Length

HTTP

header

which

triggers

a

fatal

Java

OutOfMemoryError.


icat in Brian Carrier The Sleuth Kit (TSK) before 2.09 omits NULL pointer checks in certain code paths which allows user-assisted remote attackers to cause a denial of service (NULL dereference and application crash) and prevent examination of certain NTFS files via a malformed NTFS image.


pixlie.php in Pixlie 1.7 allows remote attackers to trigger the reading and JPEG image processing of files in a remote directory tree via a URL in the root parameter. NOTE: this can be leveraged for traffic amplification or other denial of service.


ProSecurity 1.40 Beta 2 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to cause a denial of service (crash) and possibly gain privileges via kernel SSDT hooks for Windows Native API functions including (1) NtCreateKey (2) NtDeleteFile (3) NtLoadDriver (4) NtOpenSection and (5) NtSetSystemTime.


Sophos Anti-Virus for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed BZip file that results in the creation of multiple Engine temporary files (aka a \BZip bomb\).


PHP before 5.2.3 allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the pattern parameter to the glob function; or (2) a long string in the string parameter to the fnmatch function accompanied by a pattern parameter value with undefined characteristics as demonstrated by a \*1e\ value. NOTE: this might not be a vulnerability in most web server environments that support multiple threads unless these issues can be demonstrated for code execution.


Unspecified vulnerability in Polipo before 1.0.2 allows remote attackers to cause a denial of service (daemon crash) via certain network traffic associated with entities larger than 2 Gb.


The CUPS service as used in SUSE Linux before 20070720 and other Linux distributions allows remote attackers to cause a denial of service via unspecified vectors related to an incomplete fix for CVE-2007-0720 that introduced a different denial of service problem in SSL negotiation.


Cisco 4100 and 4400 Airespace 4000 and Catalyst 6500 and 3750 Wireless LAN Controller (WLC) software 4.1 before 4.1.180.0 allows remote attackers to cause a denial of service (ARP storm) via a broadcast ARP packet that \targets the IP address of a known client context\ aka CSCsj50374.


The isChecked function in Toolbar.DLL in the ExportNation toolbar for Internet Explorer allows remote attackers to cause a denial of service (NULL dereference and browser crash) via unspecified vectors.


OpenOffice.org (OOo) 2.2 does not properly handle files with multiple extensions which allows user-assisted remote attackers to cause a denial of service.


Format string vulnerability in the SMTP server component in Qbik WinGate 5.x and 6.x before 6.2.2 allows remote attackers to cause a denial of service (service crash) via format string specifiers in certain unexpected commands which trigger a crash during error logging.


The server in Toribash 2.71 and earlier does not properly handle partially joined clients that are temporarily assigned the ID of -1 which allows remote attackers to cause a denial of service (daemon crash) via a GRIP command with the ID of -1.


The SIP channel driver (chan_sip) in Asterisk Open Source 1.4.x before 1.4.11 AsteriskNOW before beta7 Asterisk Appliance Developer Kit 0.x before 0.8.0 and s800i (Asterisk Appliance) 1.x before 1.0.3 allows remote attackers to cause a denial of service (memory exhaustion) via a SIP dialog that causes a large number of history entries to be created.


Soldat game server 1.4.2 and earlier and dedicated server 2.6.2 and earlier allows remote attackers to cause a client denial of service (crash) via (1) a long string to the file transfer port or (2) a long chat message or (3) a server denial of service (continuous beep and slowdown) via a string containing many 0x07 or other control characters to the file transfer port.


Unspecified vulnerability in vstor2-ws60.sys in VMWare Workstation 6.0 allows local users to cause a denial of service (host operating system crash) via unspecified vectors as demonstrated by the DC2 test suite possibly a related issue to CVE-2007-4591. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The management interface in ZyNOS firmware 3.62(WK.6) on the Zyxel Zywall 2 device allows remote authenticated administrators to cause a denial of service (infinite reboot loop) via invalid configuration data. NOTE: this issue might not cross privilege boundaries and it might be resultant from CSRF; if so then it should not be included in CVE.


The iconv_substr function in PHP 5.2.4 and earlier allows context-dependent attackers to cause (1) a denial of service (application crash) via a long string in the charset parameter probably also requiring a long string in the str parameter; or (2) a denial of service (temporary application hang) via a long string in the str parameter. NOTE: this might not be a vulnerability in most web server environments that support multiple threads unless these issues can be demonstrated for code execution.


The Thomson ST 2030 SIP phone with software 1.52.1 allows remote attackers to cause a denial of service (device hang) via an INVITE message with a Via header that contains a '/' (slash) instead of the required space following the SIP version number.


The regular expression parser in TCL before 8.4.17 as used in PostgreSQL 8.2 before 8.2.6 8.1 before 8.1.11 8.0 before 8.0.15 and 7.4 before 7.4.19 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted regular expression.


The server in Toribash 2.71 and earlier on Windows allows remote attackers to cause a denial of service (continuous beep and server hang) via certain commands that contain many 0x07 or other invalid characters.


The VStr::Resize function in str.cpp in Vavoom 1.24 and earlier allows remote attackers to cause a denial of service (daemon crash) via a string with a negative NewLen value within a certain UDP packet that triggers an assertion error.


The CallCmd function in toolbar_gaming.dll in the Toolbar Gaming toolbar for Internet Explorer allows remote attackers to cause a denial of service (NULL dereference and browser crash) via unspecified vectors.


pwlib as used by Ekiga 2.0.5 and possibly other products allows remote attackers to cause a denial of service (application crash) via a long argument to the PString::vsprintf function related to a \memory management flaw\. NOTE: this issue was originally reported as being in the SIPURL::GetHostAddress function in Ekiga (formerly GnomeMeeting).


The isChecked function in Toolbar.DLL in Advanced Searchbar before 3.33 allows remote attackers to cause a denial of service (NULL dereference and browser crash) via unspecified vectors.


The client in Toribash 2.71 and earlier allows remote attackers to cause a denial of service (application hang) via a command without an LF character as demonstrated by a SAY command.


Image Space rFactor 1.250 and earlier allows remote attackers to cause a denial of service (daemon crash) via (1) an ID 0x30 packet (2) an ID 0x38 packet and an invalid 13-bit integer in (3) an ID 0x60 packet and (4) an ID 0x68 packet; and a denial of service (UDP port block) via (5) an ID 0x20 packet and (6) an ID 0x28 packet.


Asterisk Open Source 1.4.5 through 1.4.11 when configured to use an IMAP voicemail storage backend allows remote attackers to cause a denial of service via an e-mail with an \invalid/corrupted\ MIME body which triggers a crash when the recipient listens to voicemail.


** DISPUTED ** Guidance Software EnCase allows user-assisted remote attackers to cause a denial of service via (1) a corrupted Microsoft Exchange database which triggers an application crash when many options are selected; (2) a corrupted NTFS filesystem which causes the application to report \memory allocation errors;\ or (3) deeply nested directories which trigger an application crash during an Expand All action. NOTE: the vendor disputes the significance of these vectors because the user can select fewer options there is no operational impact or the user can do less expansion.


axis-cgi/buffer/command.cgi on the AXIS 207W camera allows remote authenticated users to cause a denial of service (reboot) via many requests with unique buffer names in the buffername parameter in a start action.


ClamAV before 0.91.2 as used in Kolab Server 2.0 through 2.2beta1 and other products allows remote attackers to cause a denial of service (application crash) via (1) a crafted RTF file which triggers a NULL dereference in the cli_scanrtf function in libclamav/rtf.c; or (2) a crafted HTML document with a data: URI which triggers a NULL dereference in the cli_html_normalise function in libclamav/htmlnorm.c. NOTE: some of these details are obtained from third party information.


ImageMagick before 6.3.5-9 allows context-dependent attackers to cause a denial of service via a crafted image file that triggers (1) an infinite loop in the ReadDCMImage function related to ReadBlobByte function calls; or (2) an infinite loop in the ReadXCFImage function related to ReadBlobMSBLong function calls.


lib/vorbisfile.c in libvorbisfile in Xiph.Org libvorbis before 1.2.0 allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted OGG file aka trac Changeset 13217.


The Thomson ST 2030 SIP phone with software 1.52.1 allows remote attackers to cause a denial of service (device hang) via (1) an empty SIP message or (2) a SIP INVITE message with a malformed To header different vectors than CVE-2007-4553.


The Linux kernel 2.6.9 before 2.6.9-67 in Red Hat Enterprise Linux (RHEL) 4 on Itanium (ia64) does not properly handle page faults during NUMA memory access which allows local users to cause a denial of service (panic) via invalid arguments to set_mempolicy in an MPOL_BIND operation.


Privatefirewall 5.0.14.2 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to cause a denial of service (crash) and possibly gain privileges via kernel SSDT hooks for (1) NtOpenProcess and (2) NtOpenThread.


The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10 AsteriskNOW before beta7 Appliance Developer Kit before 0.7.0 and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population.


The Job Engine (bengine.exe) service in Symantec Backup Exec for Windows Servers (BEWS) 11d build 11.0.7170 and 11.0.6.6235 allows remote attackers to cause a denial of service (NULL dereference and service crash) via a crafted packet to port 5633/tcp.


Palm OS on Treo 650 680 700p and 755p Smart phones allows remote attackers to cause a denial of service (device reset or hang) via a flood of large ICMP echo requests. NOTE: this is probably a different vulnerability than CVE-2003-0293.


libpurple in Pidgin 2.1.0 through 2.2.1 when using HTML logging allows remote attackers to cause a denial of service (NULL dereference and application crash) via a message that contains invalid HTML data a different vector than CVE-2007-4996.


icat in Brian Carrier The Sleuth Kit (TSK) before 2.09 misinterprets a certain memory location as the holder of a loop iteration count which allows user-assisted remote attackers to cause a denial of service (long loop) and prevent examination of certain NTFS files via a malformed NTFS image.


ProcessGuard 3.410 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to cause a denial of service (crash) and possibly gain privileges via kernel SSDT hooks for Windows Native API functions including (1) NtCreateFile (2) NtCreateKey (3) NtDeleteValueKey (4) NtOpenFile (5) NtOpenKey and (6) NtSetValueKey.


Cisco IP Phone 7940 and 7960 with P0S3-08-6-00 firmware and other SIP firmware before 8.7(0) allows remote attackers to cause a denial of service (device reboot) via (1) a certain sequence of 10 invalid SIP INVITE and OPTIONS messages; or (2) a certain invalid SIP INVITE message that contains a remote tag followed by a certain set of two related SIP OPTIONS messages.


The dl function in PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in the library parameter. NOTE: there are limited usage scenarios under which this would be a vulnerability.


pngrtran.c in libpng before 1.0.29 and 1.2.x before 1.2.21 use (1) logical instead of bitwise operations and (2) incorrect comparisons which might allow remote attackers to cause a denial of service (crash) via a crafted PNG image.


The Xen hypervisor block backend driver for Linux kernel 2.6.18 when running on a 64-bit host with a 32-bit paravirtualized guest allows local privileged users in the guest OS to cause a denial of service (host OS crash) via a request that specifies a large number of blocks.


The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote attackers to cause a denial of service (CPU and memory consumption) via a GETBULK request with a large max-repeaters value.


libgssapi before 0.6-13.7 as used by the ISC BIND named daemon in SUSE Linux Enterprise Server 10 SP 1 terminates upon an initialization error which allows remote attackers to cause a denial of service (daemon exit) via a GSS-TSIG request. NOTE: this issue probably affects other daemons that attempt to initialize this library within a chroot configuration or other invalid configuration.


The Java Secure Socket Extension (JSSE) in the Hitachi Cosminexus Developer's Kit for Java in various Hitachi Cosminexus 7.5 products before 07-50-01 when using JSSE for SSL/TLS support allows remote attackers to cause a denial of service via certain SSL/TLS handshake requests. NOTE: this may be the same as CVE-2007-3698.


Multiple unspecified vulnerabilities in the kernel in Sun Solaris 8 through 10 allow local users to cause a denial of service (panic) related to the support for retrieval of kernel statistics and possibly related to the sfmmu_mlspl_enter or sfmmu_mlist_enter functions.


webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character which triggers a crash in the ws_getheaders function.


Unspecified vulnerability in \Solaris Auditing\ in the Basic Security Module (BSM) in Sun Solaris 10 when configured for auditing of networking (nt) events allows local users to cause a denial of service (panic) via unspecified vectors.


classes/Url.php in Justin Hagstrom AutoIndex PHP Script before 2.2.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via a %00 sequence in the dir parameter to index.php which triggers an erroneous \recursive calculation.\


Unspecified vulnerability in Safari on the Apple iPod touch (aka iTouch) and iPhone 1.1.1 allows user-assisted remote attackers to cause a denial of service (application crash) and enable filesystem browsing by the local user via a certain TIFF file.


Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service (panic) via a beacon frame with a large length value in the extended supported rates (xrates) element which triggers an assertion error related to net80211/ieee80211_scan_ap.c and net80211/ieee80211_scan_sta.c.


Mozilla Firefox 2.0.0.9 allows remote attackers to cause a denial of service (CPU consumption and crash) via an iframe with Javascript that sets the document.location to contain a leading NULL byte (\\x00) and a (1) res:// (2) about:config or (3) file:/// URI.


G DATA InternetSecurity 2007 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreateKey and (2) NtOpenProcess kernel SSDT hooks.


Unspecified vulnerability in the Avaya VoIP Handset allows remote attackers to cause a denial of service (reboot) via crafted packets. NOTE: as of 20071016 the only disclosure is a vague pre-advisory with no actionable information. However since it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


Massive Entertainment World in Conflict 1.001 and earlier allows remote attackers to cause a denial of service (failed assertion and daemon crash) via a large packet to TCP or UDP port 48000.


Xen 3.1.1 does not prevent modification of the CR4 TSC from applications which allows pv guests to cause a denial of service (crash).


Pioneers (formerly gnocatan) before 0.11.3 allows remote attackers to cause a denial of service (crash) by triggering a delete operation while the Session object is still being used as demonstrated by causing a \Broken pipe\ error.


Install.php in BosDev BosNews 4 and 5 does not require authentication for replacing an existing product installation or creating a new admin account which allows remote attackers to cause a denial of service (overwritten files) and possibly obtain administrative access.


The Windows dedicated server for the Unreal engine as used by America's Army and America's Army Special Forces 2.8.2 and earlier when Punkbuster (PB) is enabled allows remote attackers to cause a denial of service (server hang) via packets containing 0x07 characters or other unspecified invalid characters. NOTE: this issue may overlap CVE-2007-4443. NOTE: this issue might be in Punkbuster itself but there are insufficient details to be certain.


CIM Server in IBM Director 5.20.1 and earlier allows remote attackers to cause a denial of service (CPU consumption connection slot exhaustion and daemon crash) via a large number of idle connections.


Unspecified vulnerability in the NEC mobile handset allows remote attackers to cause a denial of service (reboot) via crafted packets. NOTE: as of 20071016 the only disclosure is a vague pre-advisory with no actionable information. However since it is from a well-known researcher it is being assigned a CVE identifier for tracking purposes.


Ghost Security Suite alpha 1.200 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreateKey (2) NtCreateThread (3) NtDeleteValueKey (4) NtQueryValueKey (5) NtSetSystemInformation and (6) NtSetValueKey kernel SSDT hooks.


The wait_task_stopped function in the Linux kernel before 2.6.23.8 checks a TASK_TRACED bit instead of an exit_state value which allows local users to cause a denial of service (machine crash) via unspecified vectors. NOTE: some of these details are obtained from third party information.


Xen 3.1.1 allows virtual guest system users to cause a denial of service (hypervisor crash) by using a debug register (DR7) to set certain breakpoints.


ZoneAlarm Pro 7.0.362.000 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreatePort and (2) NtDeleteFile kernel SSDT hooks a partial regression of CVE-2007-2083.


kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy (formerly Verity) KeyView as used by IBM Lotus Notes Symantec Mail Security and activePDF DocConverter does not properly parse long tokens which allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted .ag file.


slapo-pcache (overlays/pcache.c) in slapd in OpenLDAP before 2.3.39 when running as a proxy-caching server allocates memory using a malloc variant instead of calloc which prevents an array from being initialized properly and might allow attackers to cause a denial of service (segmentation fault) via unknown vectors that prevent the array from being null terminated.


HTTPSocket.cpp in the C++ Sockets Library before 2.2.5 allows remote attackers to cause a denial of service (crash) via an HTTP request with a missing protocol version number which triggers an exception. NOTE: some of these details were obtained from third party information.


Lantronix SCS3200 does not properly handle public-key requests which allows remote attackers to cause a denial of service (unresponsive device) via unspecified keyscan requests. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Unspecified vulnerability in the Extensible Authentication Protocol (EAP) implementation in Cisco IOS 12.3 and 12.4 on Cisco Access Points and 1310 Wireless Bridges (Wireless EAP devices) IOS 12.1 and 12.2 on Cisco switches (Wired EAP devices) and CatOS 6.x through 8.x on Cisco switches allows remote attackers to cause a denial of service (device reload) via a crafted EAP Response Identity packet.


ParseFTPList.cpp in Mozilla Firefox 2.0.0.7 allows remote FTP servers to cause a denial of service (application crash) via a crafted reply to an unspecified listing command related to \reading from invalid pointer.\


Distributed Checksum Clearinghouse (DCC) 1.3.65 allows remote attackers to cause a denial of service (crash) via a \SOCKS flood.\


Cisco IP Phone 7940 with firmware P0S3-08-7-00 allows remote attackers to cause a denial of service (\486 Busy\ responses or device reboot) via a sequence of SIP INVITE transactions in which the Request-URI lacks a user name a different vulnerability than CVE-2007-4459.


Cisco Unified Communications Manager (CUCM formerly CallManager) 5.1 before 5.1(2) and Unified CallManager 5.0 allow remote attackers to cause a denial of service (kernel panic) via a flood of SIP INVITE messages to UDP port 5060 which triggers resource exhaustion aka CSCsi75822.


The Nortel UNIStim IP Softphone 2050 IP Phone 1140E and other Nortel IP Phone Mobile Voice Client and WLAN Handsets products allow remote attackers to cause a denial of service (device hang) via a flood of Mute and UnMute messages that have a spoofed source IP address for the Signaling Server.


The Core RDBMS component in Oracle Database 9.0.1.5+ 9.2.0.8 9.2.0.8DV 10.1.0.5 and 10.2.0.3 allows remote attackers to cause a denial of service (CPU consumption) via a crafted type 6 Data packet aka DB20.


Unspecified vulnerability in the Sun Solaris RPC services library (librpcsvc) on Solaris 8 through 10 allows remote attackers to cause a denial of service (mountd crash) via unspecified packets to a server that exports many filesystems and allows local users to cause a denial of service (automountd crash) via unspecified requests to mount filesystems from a server that exports many filesystems.


Outpost Firewall Pro 4.0.1025.7828 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreateKey (2) NtDeleteFile (3) NtLoadDriver (4) NtOpenProcess (5) NtOpenSection (6) NtOpenThread and (7) NtUnloadDriver kernel SSDT hooks a partial regression of CVE-2006-7160.


Memory leak in a certain Red Hat patch applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 through 8 and on Foresight Linux and rPath appliances allows remote attackers to cause a denial of service (memory consumption) via a large number of CWD commands as demonstrated by an attack on a daemon with the deny_file configuration option.


The Communication Server in Alcatel-Lucent OmniPCX Enterprise 7.1 and earlier caches an IP address during a TFTP request from an IP Touch phone and uses this IP address as the destination for all subsequent VoIP packets to this phone which allows remote attackers to cause a denial of service (loss of audio) or intercept voice communications via a crafted TFTP request containing the phone's MAC address in the filename.


Kaspersky Anti-Virus (KAV) and Internet Security 7.0 build 125 do not properly validate certain parameters to System Service Descriptor Table (SSDT) and Shadow SSDT function handlers which allows local users to cause a denial of service (crash) via the (1) NtUserSendInput (2) LoadLibraryA (3) NtOpenProcess (4) NtOpenThread (5) NtTerminateProcess (6) NtUserFindWindowEx and (7) NtUserBuildHwndList kernel SSDT hooks in kylif.sys; the (8) NtDuplicateObject (DuplicateHandle) kernel SSDT hook; and possibly other kernel SSDT hooks. NOTE: the NtCreateSection vector is covered by CVE-2007-5043.1. NOTE: the vendor disputes that the DuplicateHandle vector is a vulnerability in their code stating that \it is not an error in our code but an obscure method for manipulating standard Windows routines to circumvent our self-defense mechanisms.\


The internationalization (i18n) framework in Django 0.91 0.95 0.95.1 and 0.96 and as used in other products such as PyLucid when the USE_I18N option and the i18n component are enabled allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers.


The CS1000 signaling server in Nortel Enterprise VoIP-Core-CS 1000M Chassis/Cabinet Enterprise VoIP-Core-CS 1000E and 1000S Meridian-Core-Option 11C Chassis and Cabinet and Meridian-Core-Option 51C 61C and 81C allows remote attackers to cause a denial of service (telephony application outage) via a flood of packets to Embedded LAN (ELAN) ports.


Linux kernel before 2.4.21 allows local users to cause a denial of service (kernel panic) via asynchronous input or output on a FIFO special file.


Hitachi Cosminexus Agent 03-00 through 03-05 and Cosminexus Library Standard and Web Edition 04-00 and 04-01 might allow remote attackers to cause a denial of service (agent process crash) via invalid data from clients other than Cosminexus Manager.


Unspecified vulnerability in (1) SYS$EI1000.EXE and (2) SYS$EI1000_MON.EXE in HP OpenVMS 8.3 and earlier allows remote attackers to cause a denial of service (machine crash) via an \oversize\ packet which is not properly discarded if \the device has no remaining buffers after receipt of the first buffer segment.\


The Vonage Motorola Phone Adapter VT 2142-VD does not properly verify that a SIP INVITE message originated from a legitimate server which allows remote attackers to send spoofed INVITE messages as demonstrated by a flood of messages triggering a denial of service and by phone calls with malicious content.


The convert_search_mode_to_innobase function in ha_innodb.cc in the InnoDB engine in MySQL 5.1.23-BK and earlier allows remote authenticated users to cause a denial of service (database crash) via a certain CONTAINS operation on an indexed column which triggers an assertion error.


Cisco PIX and ASA appliances with 7.0 through 8.0 software and Cisco Firewall Services Module (FWSM) 3.1(5) and earlier allow remote attackers to cause a denial of service (device reload) via a crafted MGCP packet aka CSCsi90468 (appliance) and CSCsi00694 (FWSM).


The Grandstream HT-488 0.1 allows remote attackers to cause a denial of service (device crash) via a flood of fragmented packets to port 5060.


Cisco Firewall Services Module (FWSM) 3.2(1) and 3.1(5) and earlier allows remote attackers to cause a denial of service (device reload) via a crafted HTTPS request aka CSCsi77844.


The GetMagicNumberString function in Massive Entertainment World in Conflict 1.000 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a string to the VoIP port (52999/tcp) with an invalid value in the third byte.


OpenLDAP before 2.3.39 allows remote attackers to cause a denial of service (slapd crash) via an LDAP request with a malformed objectClasses attribute. NOTE: this has been reported as a double free but the reports are inconsistent.


The disconnect method in the Philips USB Webcam (pwc) driver in Linux kernel 2.6.x before 2.6.22.6 \relies on user space to close the device \ which allows user-assisted local attackers to cause a denial of service (USB subsystem hang and CPU consumption in khubd) by not closing the device after the disconnect is invoked. NOTE: this rarely crosses privilege boundaries unless the attacker can convince the victim to unplug the affected device.


The TSrvOptIA_NA::rebind method in SrvOptions/SrvOptIA_NA.cpp in Dibbler 0.6.0 allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via an invalid IA_NA option in a REBIND message.


The TSC Domain Manager in Hitachi TPBroker Object Transaction Monitor and Cosminexus TPBroker Object Transaction Monitor 01-00 through 03-00 might allow attackers to cause a denial of service (crash) via invalid messages.


Unspecified vulnerability in a certain ActiveX control in Reconfig.DLL in VMware Workstation 5.5.x before 5.5.8 build 108000 VMware Workstation 6.0.x before 6.0.5 build 109488 VMware Player 1.x before 1.0.8 build 108000 VMware Player 2.x before 2.0.5 build 109488 VMware ACE 1.x before 1.0.7 build 108880 VMware ACE 2.x before 2.0.5 build 109488 and VMware Server before 1.0.7 build 108231 might allow local users to cause a denial of service to the Virtual Disk Mount Service (vmount2.exe) related to the ConnectPopulatedDiskEx function.


Unspecified vulnerability in the FTP service in Sun StorEdge/StorageTek 3510 FC Array with firmware before 4.21 allows remote attackers with access to the Ethernet management interface to cause a denial of service (I/O request timeout and device hang) via unspecified vectors.


The iwl_set_rate function in compatible/iwl3945-base.c in iwlwifi 1.1.21 and earlier dereferences an iwl_get_hw_mode return value without checking for NULL which might allow remote attackers to cause a denial of service (kernel panic) via unspecified vectors during module initialization.


Cisco PIX and ASA appliances with 7.1 and 7.2 software when configured for TLS sessions to the device allow remote attackers to cause a denial of service (device reload) via a crafted TLS packet aka CSCsg43276 and CSCsh97120.


The NantSys device 5.0.0.115 in Motorola netOctopus 5.1.2 build 1011 has weak permissions for the \\\\.\\NantSys device interface (nantsys.sys) which allows local users to gain privileges or cause a denial of service (system crash) as demonstrated by modifying the SYSENTER_EIP_MSR CPU Model Specific Register (MSR) value.


Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33 when used on Microsoft Windows Vista x64 does not properly check a buffer during an IOCTL 0x9c402420 call which allows local users to cause a denial of service (machine crash) and possibly gain privileges via unspecified vectors.


Unspecified vulnerability in OpenSSL before A.00.09.07l on HP-UX B.11.11 B.11.23 and B.11.31 allows local users to cause a denial of service via unspecified vectors.


Unspecified vulnerability in the Stream Control Transmission Protocol (sctp) functionality in Sun Solaris 10 when at least one SCTP socket is in the LISTEN state allows remote attackers to cause a denial of service (panic) via unspecified vectors related to \INIT processing.\


Ghost Security Suite beta 1.110 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to cause a denial of service (crash) and possibly gain privileges via the (1) NtCreateKey (2) NtDeleteValueKey (3) NtQueryValueKey (4) NtSetSystemInformation and (5) NtSetValueKey kernel SSDT hooks.


Unspecified vulnerability in kdebase allows local users to cause a denial of service (KDM login inaccessible or resource consumption) via unknown vectors.


Kaspersky Internet Security 7.0.0.125 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to (1) cause a denial of service (crash) and possibly gain privileges via the NtCreateSection kernel SSDT hook or (2) cause a denial of service (avp.exe service outage) via the NtLoadDriver kernel SSDT hook. NOTE: this issue may partially overlap CVE-2006-3074.


Double free vulnerability in the getreply function in ftp.c in netkit ftp (netkit-ftp) 0.17 20040614 and later allows remote FTP servers to cause a denial of service (application crash) and possibly have unspecified other impact via some types of FTP protocol behavior. NOTE: the netkit-ftpd issue is covered by CVE-2007-6263.


The ATM module in the Linux kernel before 2.4.35.3 when CLIP support is enabled allows local users to cause a denial of service (kernel panic) by reading /proc/net/atm/arp before the CLIP module has been loaded.


Norton Internet Security 2008 15.0.0.60 does not properly validate certain parameters to System Service Descriptor Table (SSDT) function handlers which allows local users to cause a denial of service (crash) and possibly gain privileges via the NtOpenSection kernel SSDT hook. NOTE: the NtCreateMutant and NtOpenEvent function hooks are already covered by CVE-2007-1793.


Off-by-one error in ICC profile chunk handling in the png_set_iCCP function in pngset.c in libpng before 1.0.29 beta1 and 1.2.x before 1.2.21 beta1 allows remote attackers to cause a denial of service (crash) via a crafted PNG image that prevents a name field from being NULL terminated.


The federated engine in MySQL 5.0.x before 5.0.51a 5.1.x before 5.1.23 and 6.0.x before 6.0.4 when performing a certain SHOW TABLE STATUS query allows remote MySQL servers to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the minimum required number of columns.


** DISPUTED ** Javamail does not properly handle a series of invalid login attempts in which the same e-mail address is entered as username and password and the domain portion of this address yields a Java UnknownHostException error which allows remote attackers to cause a denial of service (connection pool exhaustion) via a large number of requests resulting in a SQLNestedException. NOTE: Sun disputes this issue stating \The report makes references to source code and files that do not exist in the mentioned products.\


Mozilla Firefox allows remote attackers to cause a denial of service (crash) via crafted image as demonstrated by the zzuf lol-firefox.gif test case.


The RPL dissector in Wireshark (formerly Ethereal) 0.9.8 to 0.99.6 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.


The BDB backend for slapd in OpenLDAP before 2.3.36 allows remote authenticated users to cause a denial of service (crash) via a potentially-successful modify operation with the NOOP control set to critical possibly due to a double free vulnerability.


The get_filter_list function in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0006 does not properly perform certain sub filter parsing which allows remote authenticated users to cause a denial of service (infinite loop) via a malformed search filter.


Wireshark (formerly Ethereal) 0.8.16 to 0.99.6 allows remote attackers to cause a denial of service (crash) via a malformed RPC Portmap packet.


libmikmod 3.1.9 through 3.2.0 as used by MikMod SDL-mixer and possibly other products relies on the channel count of the last loaded song rather than the currently playing song for certain playback calculations which allows user-assisted attackers to cause a denial of service (application crash) by loading multiple songs (aka MOD files) with different numbers of channels.


The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 when a threaded Multi-Processing Module is used allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.


ZOLL Defibrillator / Monitor M Series E Series and R Series have a default password for System Configuration mode which allows physically proximate attackers to modify device configuration and cause a denial of service (adverse human health effects).


QK SMTP Server 3 allows remote attackers to cause a denial of service (daemon crash) via a long (1) HELO (2) MAIL FROM or (3) RCPT TO command; or (4) a long string in the message sent after the DATA command; possibly a related issue to CVE-2006-5551.


The shmem_getpage function (mm/shmem.c) in Linux kernel 2.6.11 through 2.6.23 does not properly clear allocated memory in some rare circumstances related to tmpfs which might allow local users to read sensitive kernel data or cause a denial of service (crash).


Unspecified vulnerability in Appian Enterprise Business Process Management (BPM) Suite 5.6 SP1 allows remote attackers to cause a denial of service via a crafted packet to port 5400/tcp.


The MEGACO dissector in Wireshark (formerly Ethereal) 0.9.14 to 0.99.6 allows remote attackers to cause a denial of service (long loop and resource consumption) via unknown vectors.


Unspecified vulnerability in Juniper JUNOS 7.3 through 8.4 allows remote attackers to cause a denial of service (crash) via malformed BGP packets possibly BGP UPDATE packets that trigger session flapping.


Audacity 1.3.2 creates a temporary directory with a predictable name without checking for previous existence of that directory which allows local users to cause a denial of service (recording deadlock) by creating the directory before Audacity is run. NOTE: this issue can be leveraged to delete arbitrary files or directories via a symlink attack.


The WiMAX dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (crash) via unknown vectors related to \unaligned access on some platforms.\


MPlayer possibly 1.0rc1 allows remote attackers to cause a denial of service (SIGSEGV and application crash) via (1) a malformed MP3 file as demonstrated by lol-mplayer.mp3; (2) a malformed Ogg Vorbis file as demonstrated by lol-mplayer.ogg; (3) a malformed MPEG-1 file as demonstrated by lol-mplayer.mpg; (4) a malformed MPEG-2 file as demonstrated by lol-mplayer.m2v; (5) a malformed MPEG-4 AVI file as demonstrated by lol-mplayer.avi; (6) a malformed FLAC file as demonstrated by lol-mplayer.flac; (7) a malformed Ogg Theora file as demonstrated by lol-mplayer.ogm; (8) a malformed WMV file as demonstrated by lol-mplayer.wmv; or (9) a malformed AAC file as demonstrated by lol-mplayer.aac. NOTE: vector 5 might overlap CVE-2007-4938 and vector 6 might overlap CVE-2008-0486.


Ability Mail Server before 2.61 allows remote authenticated users to cause a denial of service (daemon crash) via (1) malformed number list ranges in unspecified IMAP commands and possibly (2) a blank string in unspecified messages.


The parseRTSPRequestString function in LIVE555 Media Server 2007.11.01 and earlier allows remote attackers to cause a denial of service (daemon crash) via a short RTSP query which causes a negative number to be used during memory allocation.


The DCP ETSI dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (long loop and resource consumption) via unknown vectors.


The IPsec module in the VPN component in Ingate Firewall before 4.6.0 and SIParator before 4.6.0 allows remote attackers to cause a denial of service (module crash) via an IPsec Phase 2 proposal that lacks Perfect Forward Secrecy (PFS).


The xmlCurrentChar function in libxml2 before 2.6.31 allows context-dependent attackers to cause a denial of service (infinite loop) via XML containing invalid UTF-8 sequences.


The Belkin F5D7230-4 Wireless G Router allows remote attackers to cause a denial of service (degraded networking and logging) via a flood of TCP SYN packets a related issue to CVE-1999-0116.


exiftags before 1.01 allows attackers to cause a denial of service (infinite loop) via recursive IFD references in the EXIF data in a JPEG image.


Hitachi JP1/File Transmission Server/FTP 01-00 through 08-10-02 on Windows might allow remote attackers to cause a denial of service (service stop) via a \specific file\ argument to an FTP command.


FTPServer.py in pyftpdlib before 0.2.0 allows remote attackers to cause a denial of service via a long command.


The Bluetooth SDP dissector Wireshark (formerly Ethereal) 0.99.2 to 0.99.6 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.


The

ActiveX

control

in

pvcalendar.ocx

in

the

scheduler

component

in

the

Media

Server

in

Symantec

Backup

Exec

for

Windows

Server

(BEWS)

and

and

exposes

the

unsafe

Save

method

which

allows

remote

attackers

to

cause

a

denial

of

service

(browser

crash)

or

create

or

overwrite

arbitrary

files

via

string

values

of

the

and

properties.

NOTE:

the

vendor

states

\Authenticated

user

involvement

required

but

authentication

is

not

needed

to

attack

a

client

machine

that

loads

this

control.


IBM DB2 UDB 9.1 before Fixpak 4 does not properly perform vector aggregation which might allow attackers to cause a denial of service (divide-by-zero error and DBMS crash) related to an \overflow.\ NOTE: the vendor description of this issue is too vague to be certain that it is security-related.


Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (infinite or large loop) via the (1) IPv6 or (2) USB dissector which can trigger resource consumption or a crash. NOTE: this identifier originally included Firebird/Interbase but it is already covered by CVE-2007-6116. The DCP ETSI issue is already covered by CVE-2007-6119.


The IPsec implementation in Linux kernel before 2.6.25 allows remote routers to cause a denial of service (crash) via a fragmented ESP packet in which the first fragment does not contain the entire ESP header and IV.


typespeed before 0.6.4 allows remote attackers to cause a denial of service (application crash) via unspecified network behavior that triggers a divide-by-zero error.


Interpretation conflict in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a User-Agent header line that contains a carriage-return character which is considered a line delimiter when the header is split into individual lines but not when log_user_agent in RTSP_utils.c parses the content of the User-Agent line.


I Hear U (IHU) 0.5.6 and earlier allows remote attackers to cause (1) a denial of service (infinite loop) via a packet that contains zero in the size field in its header which is improperly handled by the Receiver::processPacket function; and (2) a denial of service (daemon crash) via an (a) IHU_INFO_INIT or a (b) IHU_INFO_RING packet that does not specify the mode which is improperly handled by the Player::ring function in Player.cpp.


Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17 as used in PostgreSQL 8.2 before 8.2.6 8.1 before 8.1.11 8.0 before 8.0.15 and 7.4 before 7.4.19 allows remote authenticated users to cause a denial of service (memory consumption) via a crafted \complex\ regular expression with doubly-nested states.


Nokia N95 cell phone with RM-159 12.0.013 firmware allows remote attackers to cause a denial of service (device inoperability) via a SIP INVITE message accompanied by an immediately subsequent SIP CANCEL message followed by a second SIP INVITE message in a different session.


Unspecified vulnerability in the GpcContainer.GpcContainer.1 ActiveX control in WebEx allows remote attackers to cause a denial of service (memory access violation and crash) via (1) an invalid argument to the InitParam method or (2) an unspecified vector involving the SetParam method.


The RealNetworks RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll as shipped with RealPlayer 11 allows remote attackers to cause a denial of service (browser crash) via a certain argument to the GetSourceTransport method.


The nfs_lock function in fs/nfs/file.c in the Linux kernel 2.6.9 does not properly remove POSIX locks on files that are setgid without group-execute permission which allows local users to cause a denial of service (BUG and system crash) by locking a file on an NFS filesystem and then changing this file's permissions a related issue to CVE-2010-0727.


The dataconn function in ftpd.c in netkit ftpd (netkit-ftpd) 0.17 when certain modifications to support SSL have been introduced calls fclose on an uninitialized file stream which allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via some types of FTP over SSL protocol behavior as demonstrated by breaking a passive FTP DATA connection in a way that triggers an error in the server's SSL_accept function. NOTE: the netkit ftp issue is covered by CVE-2007-5769.


Unspecified vulnerability in Wesnoth 1.2.x before 1.2.8 and 1.3.x before 1.3.12 allows attackers to cause a denial of service (hang) via a \faulty add-on\ and possibly execute other commands via unknown vectors related to the turn_cmd option.


fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct which allows local users to cause a denial of service (OOPS) as demonstrated by a certain fio test.


The Platform Service Process (asampsp) in Fan-Out Driver Platform Services for Novell Identity Manager (IDM) 3.5.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified network traffic that triggers a syslog message containing invalid format string specifiers as demonstrated by a Nessus scan.


The default_encrypt function in encrypt.c in IRC Services before 5.0.63 and 5.1.x before 5.1.7 allows remote attackers to cause a denial of service (daemon crash) via a long password. NOTE: some of these details are obtained from third party information.


The IMWeb.IMWebControl.1 ActiveX control in IMWeb.dll 7.0.0.x and possibly IMWebControl.dll in iMesh 7.1.0.x and earlier allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via an empty string in the argument to the ProcessRequestEx method.


The Firebird/Interbase dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (infinite loop or crash) via unknown vectors.


PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in (1) the domain parameter to the dgettext function the message parameter to the (2) dcgettext or (3) gettext function the msgid1 parameter to the (4) dngettext or (5) ngettext function or (6) the classname parameter to the stream_wrapper_register function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads unless this issue can be demonstrated for code execution.


Unspecified vulnerability in pioneers (formerly gnocatan) 0.11.3 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors that trigger an assert error. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-5933.


The ftp_STOU function in FTPServer.py in pyftpdlib before 0.2.0 does not limit the number of attempts to discover a unique filename which might allow remote authenticated users to cause a denial of service via a STOU command.


P4Webs.exe in Perforce P4Web 2006.2 and earlier when running on Windows allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with an empty body and a Content-Length greater than 0.


Unspecified vulnerability in the Sun eXtended System Control Facility (XSCF) Control Package (XCP) firmware before 1050 on SPARC Enterprise M4000 M5000 M8000 and M9000 servers allows remote attackers to cause a denial of service (reboot) via (1) telnet (2) ssh or (3) http network traffic that triggers memory exhaustion.


The \cache update reply processing\ functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.


irc-channel.c in ngIRCd before 0.10.3 allows remote attackers to cause a denial of service (crash) via a JOIN command without a channel argument.


The Url_init function in utils/url.c in Netembryo 0.0.4 when used by LScube Feng allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a malformed URI containing a \/:\ sequence as demonstrated by a \DESCRIBE /: RTSP/1.0\ request.


Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions which allows local users to perform unauthorized named commands such as causing a denial of service by stopping named.


KDE Konqueror 3.5.6 and earlier allows remote attackers to cause a denial of service (crash) via large HTTP cookie parameters.


Unspecified vulnerability in the SMB dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service via unknown vectors. NOTE: this identifier originally included MP3 and NCP but those issues are already covered by CVE-2007-6111.


LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via (1) a malformed Transport header which triggers misparsing in parse_transport_header in RTSP_setup.c as demonstrated by a Transport header that contains only a \RTP/AVP;unicast;client_port\ sequence; or (2) a malformed Range header which triggers misparsing in parse_play_time_range in RTSP_Play as demonstrated by an empty Range header.


The SRTP implementation in Ingate Firewall before 4.6.0 and SIParator before 4.6.0 allows remote attackers to cause a denial of service (kernel crash) via an RTCP index that is \much more than expected.\


Unspecified vulnerability in VanDyke VShell 3.0.1 allows remote attackers to cause a denial of service via unspecified vectors. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes but duplicates with other CVEs are difficult to determine.


The gg protocol handler in Gadu-Gadu when this product is installed but not running does not properly handle the skin attribute which allows remote attackers to cause a denial of service (resource consumption) via unspecified network traffic.


The accept_connections function in the virtual private network daemon (vpnd) in Apple Mac OS X 10.5 before 10.5.4 allows remote attackers to cause a denial of service (divide-by-zero error and daemon crash) via a crafted load balancing packet to UDP port 4112.


The cs_validate_page function in bsd/kern/ubc_subr.c in the xnu kernel 1228.0 and earlier in Apple Mac OS X 10.5.1 allows local users to cause a denial of service (failed assertion and system crash) via a crafted signed Mach-O binary that causes the hashes function to return NULL.


Unspecified vulnerability in vdccm before 0.10.1 in SynCE (SynCE-dccm) might allow attackers to cause a denial of service via unspecified vectors.


Net/DNS/RR/A.pm in Net::DNS 0.60 build 654 as used in packages such as SpamAssassin and OTRS allows remote attackers to cause a denial of service (program \croak\) via a crafted DNS response.


rpcrt4.dll (aka the RPC runtime library) in Microsoft Windows XP SP2 XP Professional x64 Edition Server 2003 SP1 and SP2 Server 2003 x64 Edition and x64 Edition SP2 and Vista and Vista x64 Edition allows remote attackers to cause a denial of service (RPCSS service stop and system restart) via an RPC request that uses NTLMSSP PACKET authentication with a zero-valued verification trailer signature which triggers an invalid dereference. NOTE: this also affects Windows 2000 SP4 although the impact is an information leak.


The Network Processing Unit (NPU) in the Cisco Wireless LAN Controller (WLC) before 3.2.193.5 4.0.x before 4.0.206.0 and 4.1.x allows remote attackers on a local wireless network to cause a denial of service (loss of packet forwarding) via (1) crafted SNAP packets (2) malformed 802.11 traffic or (3) packets with certain header length values aka Bug ID CSCsg36361.


Unspecified vulnerability in InterVations NaviCOPA Web Server 2.01 20070323 allows remote attackers to cause a denial of service (daemon crash) via crafted HTTP requests as demonstrated by long requests containing '\\A' characters probably a different issue than CVE-2006-5112 and CVE-2007-1733. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


WebSpeed 3.x in OpenEdge 10.x in Progress Software Progress 9.1e and certain other 9.x versions allows remote attackers to cause a denial of service (infinite loop and daemon hang) via a messenger URL that invokes _edit.r with no additional parameters as demonstrated by requests for cgiip.exe or wsisa.dll with WService=wsbroker1/_edit.r in the PATH_INFO.


The VFAT compat ioctls in the Linux kernel before 2.6.21.2 when run on a 64-bit system allow local users to corrupt a kernel_dirent struct and cause a denial of service (system crash) via unknown vectors.


RealNetworks RealPlayer 10 Gold allows remote attackers to cause a denial of service (memory consumption) via a certain .ra file. NOTE: this issue was referred to as a \memory leak \ but it is not clear if this is correct.


Unspecified vulnerability in Sun Cluster 3.1 and Solaris Cluster 3.2 before 20070424 allows remote authenticated users operating from a different cluster node to cause a denial of service (data corruption or send_mondo panic) via unspecified vectors as demonstrated by EMC Symcli backup software 6.2.1.


usrmgr/userList.asp in Nokia Intellisync Mobile Suite 6.4.31.2 6.6.0.107 and 6.6.2.2 possibly involving Novell Groupwise Mobile Server and Nokia Intellisync Wireless Email Express allows remote attackers to modify user account details and cause a denial of service (account deactivation) via the userid parameter in an update action.


Unspecified vulnerability in the LDAP Software Development Kit (SDK) for C as used in Sun Java System Directory Server 5.2 up to Patch 4 and Sun ONE Directory Server 5.1 allows remote attackers to cause a denial of service (crash) via certain BER encodings.


Media Player Classic 6.4.9.0 allows user-assisted remote attackers to cause a denial of service (web browser crash) via an \empty\ .MPA file which triggers a divide-by-zero error.


The file parsing engine in Avira Antivir Antivirus before 7.04.00.24 allows remote attackers to cause a denial of service (application crash) via a crafted UPX compressed file which triggers a divide-by-zero error.


The embedded Linux kernel in certain Sun-Brocade SilkWorm switches before 20070516 does not properly handle a situation in which a non-root user creates a kernel process which allows attackers to cause a denial of service (oops and device reboot) via unspecified vectors.


The NotSafe function in the MSVDTDatabaseDesigner7 ActiveX control in VDT70.DLL in Microsoft Visual Database Tools (MSVDT) Database Designer 7.0 allows remote attackers to cause a denial of service (Internet Explorer 6 crash) via a long argument.


The IPv6 protocol allows remote attackers to cause a denial of service via crafted IPv6 type 0 route headers (IPV6_RTHDR_TYPE_0) that create network amplification between two routers.


Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes which causes the authentication request to be rejected but does not reclaim VALUE_PAIR data structures.


The BOOTPD component in Enterasys NetSight Console 2.1 and NetSight Inventory Manager 2.1 and possibly earlier on Windows allows remote attackers to cause a denial of service (daemon crash) via a UDP packet that contains an invalid \packet type\ field.


Unspecified vulnerability in Interchange before 5.4.2 allows remote attackers to cause an unspecified denial of service (possibly server hang) via crafted HTTP requests.


Unspecified vulnerability in HP-UX B.11.00 and B.11.11 when running sendmail 8.9.3 or 8.11.1; and HP-UX B.11.23 when running sendmail 8.11.1; allows remote attackers to cause a denial of service via unknown attack vectors. NOTE: due to the lack of details from HP it is not known whether this issue is a duplicate of another CVE such as CVE-2006-1173 or CVE-2006-4434.


NMMediaServer.exe in Nero MediaHome 2.5.5.0 and CE 1.3.0.4 allows remote attackers to cause a denial of service (NULL dereference and application crash) via a crafted packet that contains two CRLF sequences. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6 8.1 through SP5 9.0 and 9.1 when in certain configurations does not limit or audit failed authentication attempts which allows remote attackers to more easily conduct brute-force attacks against the administrator password or flood the server with login attempts and cause a denial of service.


MyServer before 0.8.8 allows remote attackers to cause a denial of service via unspecified vectors.


The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06 and Sun Java Runtime Environment in JDK and JRE 6 JDK and JRE 5.0 Update 10 and earlier SDK and JRE 1.4.2_14 and earlier and SDK and JRE 1.3.1_19 and earlier when running on Unix/Linux systems allows remote attackers to cause a denial of service (JVM hang) via untrusted applets or applications that open arbitrary local files via a crafted BMP file such as /dev/tty.


Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed TAR archive.


aMSN (aka Alvaro's Messenger) 0.96 and earlier allows remote attackers to cause a denial of service (application crash) by sending invalid data to TCP port 31337.


blockhosts.py in BlockHosts before 2.0.3 does not properly parse daemon log files which allows remote attackers to add arbitrary deny entries to the /etc/hosts.allow file and cause a denial of service by adding arbitrary IP addresses to a daemon log file as demonstrated by logging in through ssh using a login name containing certain strings with an IP address which is not properly handled by a regular expression a related issue to CVE-2006-6301.


File descriptor leak in the PDF handler in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service via a crafted PDF file.


Konqueror 3.5.5 release 45.4 allows remote attackers to cause a denial of service (browser crash or abort) via JavaScript that matches a regular expression against a long string as demonstrated using /(.)*/.


Pi3Web Web Server 2.0.3 PL1 allows remote attackers to cause a denial of service (application exit) via a long URI. NOTE: this issue was originally reported as a crash but the vendor states that the impact is a \clean\ exit in which \the server I/O loop finishes and the process exits normally.\


The form autocomplete feature in Mozilla Firefox 1.5.x before 1.5.0.12 2.x before 2.0.0.4 and possibly earlier versions allows remote attackers to cause a denial of service (persistent temporary CPU consumption) via a large number of characters in a submitted form.


Cisco IOS 12.4 and earlier when using the crypto packages and SSL support is enabled allows remote attackers to cause a denial of service via a malformed (1) ClientHello (2) ChangeCipherSpec or (3) Finished message during an SSL session.


Unspecified vulnerability in the GetPropertyById function in ISoftomateObj in SoftomateLib in BRUJULA4.NET.DLL in the Brujula Toolbar (Brujula.net toolbar) allows attackers to cause a denial of service (NULL dereference and browser crash) via certain arguments.


The administration server in McAfee e-Business Server before 8.1.1 and 8.5.x before 8.5.2 allows remote attackers to cause a denial of service (service crash) via a large length value in a malformed authentication packet which triggers a heap over-read.


Cdelia Software ImageProcessing allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted BMP file.


The Network Processing Unit (NPU) in the Cisco Wireless LAN Controller (WLC) before 3.2.171.5 4.0.x before 4.0.206.0 and 4.1.x allows remote attackers on a local wireless network to cause a denial of service (loss of packet forwarding) via (1) crafted SNAP packets (2) malformed 802.11 traffic or (3) packets with certain header length values aka Bug IDs CSCsg15901 and CSCsh10841.


The emulated floppy disk controller in Bochs 2.3 allows local users of the guest operating system to cause a denial of service (virtual machine crash) via unspecified vectors resulting in a divide-by-zero error.


Unspecified vulnerability in Cisco Adaptive Security Appliance (ASA) and PIX 7.1 before 7.1(2)49 and 7.2 before 7.2(2)17 allows remote attackers to cause a denial of service (device reload) via unknown vectors related to VPN connection termination and password expiry.


Unspecified vulnerability in globus-job-manager in Globus Toolkit 4.1.1 and earlier (globus_nexus-6.6 and earlier) allows remote attackers to cause a denial of service (resource exhaustion and system crash) via certain requests to temporary TCP ports for a GRAM2 job or its MPICH-G2 applications.


The WordOCX ActiveX control in WordViewer.ocx 3.2.0.5 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1) DoOleCommand (2) FTPDownloadFile (3) FTPUploadFile (4) HttpUploadFile (5) GotoPage (6) Save (7) SaveWebFile (8) HttpDownloadFile (9) Open (10) OpenWebFile (11) SaveAs or (12) ShowWordStandardDialog property value.


Multiple F-Secure anti-virus products for Microsoft Windows and Linux before 20070522 allow remote attackers to cause a denial of service (file scanning infinite loop) via certain crafted (1) ARJ archives or (2) FSG packed files.


The SIP channel driver (chan_sip) in Asterisk before 1.2.18 and 1.4.x before 1.4.3 does not properly parse SIP UDP packets that do not contain a valid response code which allows remote attackers to cause a denial of service (crash).


Unspecified vulnerability in NewzCrawler 1.8 allows remote attackers to cause a denial of service (application instability) via certain invalid strings in the URL attribute of an ENCLOSURE element as demonstrated by a \%s\ sequence a \%Y\ sequence a \%%\ sequence and an \n \ sequence.


The Pascal run-time library (PAS$RTL.EXE) before 20070418 on OpenVMS for Integrity Servers 8.3 and PAS$RTL.EXE before 20070419 on OpenVMS Alpha 8.3 does not properly restore PC and PSL values which allows local users to cause a denial of service (system crash) via certain Pascal code.


The Linksys SPA941 VoIP Phone allows remote attackers to cause a denial of service (device reboot) via a 0377 (0xff) character in the From header and possibly certain other locations in a SIP INVITE request.


The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data which causes an infinite loop in the png_read_info function in libpng.


Unspecified vulnerability in query.c in ISC BIND 9.4.0 and 9.5.0a1 through 9.5.0a3 when recursion is enabled allows remote attackers to cause a denial of service (daemon exit) via a sequence of queries processed by the query_addsoa function.


Arris Cadant C3 CMTS allows remote attackers to cause a denial of service (service termination) via a malformed IP packet with an invalid IP option.


The OLE2 parser in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service (resource consumption) via an OLE2 file with (1) a large property size or (2) a loop in the FAT file block chain that triggers an infinite loop as demonstrated via a crafted DOC file.


The BitTorrent implementation in Opera 9.2 allows remote attackers to cause a denial of service (CPU consumption and application crash) via a malformed torrent file. NOTE: the original disclosure refers to this as a memory leak but it is not certain.


SpamAssassin 3.1.x 3.2.0 and 3.2.1 before 20070611 when running as root in unusual configurations using vpopmail or virtual users allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.


(1) Mozilla Firefox 2.0.0.3 and (2) GNU IceWeasel 2.0.0.3 allow remote attackers to cause a denial of service (browser crash or system hang) via JavaScript that matches a regular expression against a long string as demonstrated using /(.)*/.


Unspecified vulnerability in LiveData Server before 5.00.62 allows remote attackers to cause a denial of service (exit) via crafted Connection-Oriented Transport Protocol (COTP) packets.


The IAX2 channel driver (chan_iax2) in Asterisk before 20070504 does not properly null terminate data which allows remote attackers to trigger loss of transmitted data and possibly obtain sensitive information (memory contents) or cause a denial of service (application crash) by sending a frame that lacks a 0 byte.


Unspecified vulnerability in inetd in Sun Solaris 10 before 20070529 allows local users to cause a denial of service (daemon termination) via unspecified manipulations of the /var/run/.inetd.uds Unix domain socket file.


The DHCP relay agent in Cisco Adaptive Security Appliance (ASA) and PIX 7.2 allows remote attackers to cause a denial of service (dropped packets) via a DHCPREQUEST or DHCPINFORM message that causes multiple DHCPACK messages to be sent from DHCP servers to the agent which consumes the memory allocated for a local buffer. NOTE: this issue only occurs when multiple DHCP servers are used.


Ratbox IRC Daemon (aka ircd-ratbox) 2.2.5 and earlier allows remote attackers to cause a denial of service (resource exhaustion) by making many requests from a single client.


Multiple vulnerabilities in the layout engine for Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4 Thunderbird 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4 and SeaMonkey 1.0.9 and 1.1.2 allow remote attackers to cause a denial of service (crash) via vectors related to dangling pointers heap corruption signed/unsigned and other issues.


Mozilla Firefox 2.0.0.3 allows remote attackers to cause a denial of service (application crash) via a long hostname in an HREF attribute in an A element which triggers an out-of-bounds memory access.


The ath_beacon_config function in if_ath.c in MadWifi before 0.9.3.1 allows remote attackers to cause a denial of service (system crash) via crafted beacon interval information when scanning for access points which triggers a divide-by-zero error.


Microsoft Windows Graphics Device Interface (GDI+ GdiPlus.dll) allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero which triggers a divide-by-zero error.


Unspecified vulnerability in Sun Solaris 9 when Solaris Auditing (BSM) is enabled for file read write attribute modify create or delete audit classes allows local users to cause a denial of service (panic) via unknown vectors possibly related to the audit_savepath function.


Foxit Reader 2.0 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document.


The libike library in Sun Solaris 9 before 20070529 contains a logic error related to a certain pointer which allows remote attackers to cause a denial of service (in.iked daemon crash) by sending certain UDP packets with a source port different from 500. NOTE: this issue might overlap CVE-2006-2298.


The PIIX4 power management subsystem in EMC VMware Workstation 5.5.3.34685 and VMware Server 1.0.1.29996 allows local users to write to arbitrary memory locations via a crafted poke to I/O port 0x1004 triggering a denial of service (virtual machine crash) or other unspecified impact a related issue to CVE-2007-1337.


The SaveBarCode function in the Taltech Tal Bar Code ActiveX control allows remote attackers to cause a denial of service (disk consumption) by uploading multiple bar codes as demonstrated by a WSF package.


The fsmsh.dll host module in F-Secure Policy Manager Server 7.00 and earlier allows remote attackers to cause a denial of service (application crash) via NTFS reserved words in filenames in URLs.


The X render (Xrender) extension in X.org X Window System 7.0 7.1 and 7.2 with Xserver 1.3.0 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via crafted values to the (1) XRenderCompositeTrapezoids and (2) XRenderAddTraps functions which trigger a divide-by-zero error.


(1) caloggerd.exe (camt70.dll) and (2) mediasvr.exe (catirpc.dll and rwxdr.dll) in CA BrightStor Backup 11.5.2.0 SP2 allow remote attackers to cause a denial of service (NULL dereference and application crash) via a crafted RPC packet.


The gnu regular expression code in file 4.20 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted document with a large number of line feed characters which is not well handled by OS/2 REXX regular expressions that use wildcards as originally reported for AMaViS.


Java Embedding Plugin 0.9.6.1 allows remote attackers to cause a denial of service (browser crash) via a Thread subclass that calls super.run from its run method.


Parallels allows local users to cause a denial of service (virtual machine abort) via (1) certain INT instructions as demonstrated by INT 0xAA; (2) an IRET instruction when an invalid address is at the top of the stack; (3) a malformed MOVNTI instruction as demonstrated by using a register as a destination; or a write operation to (4) SEGR6 or (5) SEGR7.


The jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer JPEG-2000 library (libjasper) before 1.900 allows remote user-assisted attackers to cause a denial of service (crash) and possibly corrupt the heap via malformed image files as originally demonstrated using imagemagick convert.


BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket.


The IOS FTP Server in Cisco IOS 11.3 through 12.4 allows remote authenticated users to cause a denial of service (IOS reload) via unspecified vectors involving transferring files (aka bug ID CSCse29244).


Unspecified vulnerability in the Initialize function in NetscapeFTPHandler in WS_FTP Home and Professional 2007 allows remote attackers to cause a denial of service (NULL dereference and application crash) via unspecified vectors related to \improper arguments.\


Memory leak in the PPP over Ethernet (PPPoE) socket implementation in the Linux kernel before 2.6.21-git8 allows local users to cause a denial of service (memory consumption) by creating a socket using connect and releasing it before the PPPIOCGCHAN ioctl is initialized.


The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of service (application crash) via a grayscale PNG image with a bad tRNS chunk CRC value.


Apple Safari allows remote attackers to cause a denial of service (browser crash) via JavaScript that matches a regular expression against a long string as demonstrated using /(.)*/.


Unspecified vulnerability in Atheros 802.11 a/b/g wireless adapter drivers before 5.3.0.35 and 6.x before 6.0.3.67 on Windows allows remote attackers to cause a denial of service via a crafted 802.11 management frame.


The wordwrap function in PHP 4 before 4.4.8 and PHP 5 before 5.2.4 does not properly use the breakcharlen variable which allows remote attackers to cause a denial of service (divide-by-zero error and application crash or infinite loop) via certain arguments as demonstrated by a 'chr(0) 0 \\' argument set.


PCSoft WinDEV 11 (01F110053p) allows user-assisted remote attackers to cause a denial of service (infinite loop and resource consumption) via a malformed WDP project file.


The libsldap library in Sun Solaris 8 9 and 10 allows local users to cause a denial of service (Name Service Caching Daemon (nscd) crash) via unspecified vectors.


The sysfs_readdir function in the Linux kernel 2.6 as used in Red Hat Enterprise Linux (RHEL) 4.5 and other distributions allows users to cause a denial of service (kernel OOPS) by dereferencing a null pointer to an inode in a dentry.


The TFTP implementation in IBM Tivoli Provisioning Manager for OS Deployment 5.1 before Fix Pack 3 allows remote attackers to cause a denial of service (rembo.exe crash and multiple service outage) via a read (RRQ) request with an invalid blksize (blocksize) which triggers a divide-by-zero error.


Unspecified vulnerability in the NFS server in Sun Solaris 10 before 20070613 allows remote attackers to cause a denial of service (system crash) via certain XDR data in NFS requests probably related to processing of data by the xdr_bool and xdrmblk_getint32 functions.


Eltima Software Virtual Serial Port (VSPAX) ActiveX control (VSPort.DLL) allows remote attackers to cause a denial of service via certain function calls as demonstrated via the (1) Attach (2) Write and (3) WriteStr functions.


IPSecDrv.sys 10.4.0.12 in SafeNET High Assurance Remote 1.4.0 Build 12 and SoftRemote allows remote attackers to cause a denial of service (infinite loop and system hang) via an invalid packet with certain bytes in an option header possibly related to the IPv6 support for IPSec.


Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service via a certain GIF file as demonstrated by Art.gif.


usr/log.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 uses a semaphore with insecure permissions (world-writable/world-readable) for managing log messages using shared memory which allows local users to cause a denial of service (hang) by grabbing the semaphore.


The Avaya 4602 SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware allows remote attackers to cause a denial of service (device reboot) via a flood of packets to the BOOTP port (68/udp).


The process scheduler in the Linux kernel 2.6.16 gives preference to \interactive\ processes that perform voluntary sleeps which allows local users to cause a denial of service (CPU consumption) as described in \Secretly Monopolizing the CPU Without Superuser Privileges.\


Apple Safari 3.0 and 3.0.1 on Windows XP SP2 allows attackers to cause a denial of service (application crash) via JavaScript that sets the document.location variable as demonstrated by an empty value of document.location.


The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service (exit) via empty TXT data over D-Bus which triggers an assert error.


The Research in Motion BlackBerry 7270 with 4.0 SP1 Bundle 83 allows remote attackers to cause a denial of service (blocked call reception) via a malformed SIP invite message possibly related to multiple format string specifiers in the From field a spoofed source IP address and limitations of the function stack frame.


The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated which triggers an uncaught exception involving the truncate_message function in server/server.cpp. NOTE: this issue affects both clients and servers.


Ipswitch IMail Server 2006 before 2006.21 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving an \overwritten destructor.\


The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map.


The display driver allocattr functions in NetBSD 3.0 through 4.0_BETA2 and NetBSD-current before 20070728 allow local users to cause a denial of service (panic) via a (1) negative or (2) large value in an ioctl call as demonstrated by the vga_allocattr function.


The IKE implementation in Clavister CorePlus before 8.80.03 and 8.80.00 does not properly validate certificates during IKE negotiation which allows remote attackers to cause a denial of service (gateway stop) via certain certificates.


Apache httpd 1.3.37 2.0.59 and 2.2.4 with the Prefork MPM module allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID which is sent a SIGUSR1 signal from the master process aka \SIGUSR1 killer.\


usr/mgmt_ipc.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 checks the client's UID on the listening AF_LOCAL socket instead of the new connection which allows remote attackers to access the management interface and cause a denial of service (iscsid exit or iSCSI connection loss).


Unspecified vulnerability in DomainPOP in Alt-N Technologies MDaemon before 9.61 allows remote attackers to cause a denial of service (crash) via malformed messages.


lighttpd 1.4.15 when run on 32 bit platforms allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors involving the use of incompatible format specifiers in certain debugging messages in the (1) mod_scgi (2) mod_fastcgi and (3) mod_webdav modules.


Memory leak in server/MaraDNS.c in MaraDNS before 1.2.12.05 and 1.3.x before 1.3.03 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors a different set of affected versions than CVE-2007-3115 and CVE-2007-3116.


The process scheduler in the Microsoft Windows XP kernel does not make use of the process statistics kept by the kernel performs scheduling based on CPU billing gathered from periodic process sampling ticks and gives preference to \interactive\ processes that perform voluntary sleeps which allows local users to cause a denial of service (CPU consumption) as described in \Secretly Monopolizing the CPU Without Superuser Privileges.\


The Java Secure Socket Extension (JSSE) in Sun JDK and JRE 6 Update 1 and earlier JDK and JRE 5.0 Updates 7 through 11 and SDK and JRE 1.4.2_11 through 1.4.2_14 when using JSSE for SSL/TLS support allows remote attackers to cause a denial of service (CPU consumption) via certain SSL/TLS handshake requests.


connections.c in lighttpd before 1.4.16 might accept more connections than the configured maximum which allows remote attackers to cause a denial of service (failed assertion) via a large number of connection attempts.


Microsoft MSN Messenger 4.7 on Windows XP allows remote attackers to cause a denial of service (resource consumption) via a flood of SIP INVITE requests to the port specified for voice conversation.


Multiple unspecified vulnerabilities in bbs100 before 3.2 allow remote attackers to cause a denial of service (crash) via unspecified vectors possibly involving certain v*printf and shift_StringIO functions. NOTE: some details were obtained from third party information.


ageet AGEphone before 1.6.2 running on Windows Mobile 5 on the HTC HyTN Pocket PC device allows remote attackers to (1) cause a denial of service (call disruption and device hang) via a SIP message with a malformed header and (2) cause a denial of service (call disruption false ring indication and device outage) via a SIP message with a malformed SDP delimiter.


archive_read_support_format_tar.c in libarchive before 2.2.4 allows user-assisted remote attackers to cause a denial of service (infinite loop) via (1) an end-of-file condition within a pax extension header or (2) a malformed pax extension header in an (a) PAX or a (b) TAR archive.


The process scheduler in the Linux kernel 2.4 performs scheduling based on CPU billing gathered from periodic process sampling ticks which allows local users to cause a denial of service (CPU consumption) by performing voluntary nanosecond sleeps that result in the process not being active during a clock interrupt as described in \Secretly Monopolizing the CPU Without Superuser Privileges.\


The SNMPc Server (crserv.exe) process in Castle Rock Computing SNMPc before 7.0.19 allows remote attackers to cause a denial of service (crash) via a crafted packet to port 165/TCP.


Multiple memory leaks in server/MaraDNS.c in MaraDNS before 1.2.12.06 and 1.3.x before 1.3.05 allow remote attackers to cause a denial of service (memory consumption) via (1) reverse lookups or (2) requests for records in a class other than Internet (IN) a different set of affected versions than CVE-2007-3114 and CVE-2007-3116.