in

Action

Pack

in

Ruby

on

Rails

before

and

before

before

and

before

does

not

properly

restrict

use

of

the

MIME

type

cache

which

allows

remote

attackers

to

cause

a

denial

of

service

(memory

consumption)

via

a

crafted

HTTP

Accept

header.


OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.


IBM DB2 9.7 through FP11 9.8 10.1 through FP5 and 10.5 through FP7 on Linux UNIX and Windows allows remote authenticated users to cause a denial of service (daemon crash) via a crafted DRDA message.


Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework a different vulnerability than CVE-2016-0456. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability which allows remote attackers to read arbitrary files cause a denial of service conduct server-side request forgery (SSRF) attacks or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/lcmServiceController.jsp.


Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors.


slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and connection blocking) by leveraging an abnormally closed connection.


IBM WebSphere MQ 7.5 before 7.5.0.7 and 8.0 before 8.0.0.5 mishandles protocol flows which allows remote authenticated users to cause a denial of service (channel outage) by leveraging queue-manager rights.


Android allows users to cause a denial of service.


Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to cause a denial of service (cold start) by sending two crafted ping requests.


The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application aka an \I/O vector array overrun.\ NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.


IBM Spectrum Scale 4.1 before 4.1.1.5 and 4.2 before 4.2.0.2 and General Parallel File System 3.5 before 3.5.0.30 allow local users to gain privileges or cause a denial of service via a crafted mmapplypolicy command.


XML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1 4.0 before 4.0.7 iFix10 5.0 before 5.0.2 iFix15 and 6.0 before 6.0.1 iFix4 allows remote authenticated users to cause a denial of service via crafted XML data. IBM X-Force ID: 109693.


Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework a different vulnerability than CVE-2016-0457. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability which allows remote attackers to read arbitrary files cause a denial of service conduct server-side request forgery (SSRF) attacks or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/copxmllcmservicecontroller.js.


It was discovered that cf-release v231 and lower Pivotal Cloud Foundry Elastic Runtime 1.5.x versions prior to 1.5.17 and Pivotal Cloud Foundry Elastic Runtime 1.6.x versions prior to 1.6.18 do not properly enforce disk quotas in certain cases. An attacker could use an improper disk quota value to bypass enforcement and consume all the disk on DEAs/CELLs causing a potential denial of service for other applications.


Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt related to apps/s_server.c and crypto/srp/srp_vfy.c.


The Self-Service Portal in EMC RSA Authentication Manager (AM) Prime Self-Service 3.0 and 3.1 before 3.1 1915.42871 allows remote authenticated users to cause a denial of service (PIN change for an arbitrary user) via a modified token serial number within a PIN change request related to a \direct object reference vulnerability.\


IBM Cognos TM1 10.2.2 before FP5 when the host/pmhub/pm/admin AdminGroups setting is empty allows remote authenticated users to cause a denial of service (configuration outage) via a non-empty value.


IBM WebSphere Commerce 6.x through 6.0.0.11 7.x through 7.0.0.9 and 8.x before 8.0.0.3 allows remote attackers to cause a denial of service (order-processing outage) via unspecified vectors.


The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.


OpenStack Object Storage (Swift) before 2.3.1 (Kilo) 2.4.x and 2.5.x before 2.5.1 (Liberty) do not properly close server connections which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.


Memory leak in queue-manager agents in IBM WebSphere MQ 8.x before 8.0.0.5 allows remote attackers to cause a denial of service (heap memory consumption) by triggering many errors.


Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.


The forms-based authentication implementation in Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2 allows remote attackers to cause a denial of service (daemon outage) via crafted data aka \Microsoft Active Directory Federation Services Denial of Service Vulnerability.\


The XML parser in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF10 allows remote authenticated users to read arbitrary files or cause a denial of service via an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


The

setGlobalContext

method

in

in

Apache

Tomcat

before

before

and

before

does

not

consider

whether

ResourceLinkFactory.setGlobalContext

callers

are

authorized

which

allows

remote

authenticated

users

to

bypass

intended

SecurityManager

restrictions

and

read

or

write

to

arbitrary

application

data

or

cause

a

denial

of

service

(application

disruption)

via

a

web

application

that

sets

a

crafted

global

context.


The mustendd driver in IBM AIX 5.3 6.1 7.1 and 7.2 and VIOS 2.2.x when the jumbo_frames feature is not enabled allows remote attackers to cause a denial of service (FC1763 or FC5899 adapter crash) via crafted packets.


Memory leak on Moxa Secure Router EDR-G903 devices before 3.4.12 allows remote attackers to cause a denial of service (memory consumption) by executing the ping function.


Microsoft .NET Framework 2.0 SP2 3.5 3.5.1 4.5.2 4.6 and 4.6.1 does not prevent recursive compilation of XSLT transforms which allows remote attackers to cause a denial of service (performance degradation) via crafted XSLT data aka \.NET Framework Stack Overflow Denial of Service Vulnerability.\


The

XML

parser

in

IBM

Rational

Collaborative

Lifecycle

Management

before

before

before

and

before

Rational

Quality

Manager

before

before

before

and

before

Rational

Team

Concert

before

before

before

and

before

Rational

DOORS

Next

Generation

before

before

and

before

Rational

Engineering

Lifecycle

Manager

before

before

and

before

Rational

Rhapsody

Design

Manager

before

before

and

before

and

Rational

Software

Architect

Design

Manager

before

before

and

before

allows

remote

authenticated

users

to

read

arbitrary

files

or

cause

a

denial

of

service

via

an

XML

document

containing

an

external

entity

declaration

in

conjunction

with

an

entity

reference

related

to

an

XML

External

Entity

(XXE)

issue.


Network Policy Server (NPS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 misparses username queries which allows remote attackers to cause a denial of service (RADIUS authentication outage) via crafted requests aka \Network Policy Server RADIUS Implementation Denial of Service Vulnerability.\


The XML parser in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote authenticated administrators to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


Sync Framework in Microsoft Windows 8.1 Windows Server 2012 R2 and Windows RT 8.1 allows remote attackers to cause a denial of service (SyncShareSvc service outage) via crafted \change batch\ data aka \Windows DLL Loading Denial of Service Vulnerability.\


The Adobe Type Manager Library in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via a crafted OpenType font aka \OpenType Font Parsing Vulnerability.\


XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allows remote authenticated users to read arbitrary files or cause a denial of service via crafted XML data. IBM X-Force ID: 110510.


The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.


http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.


Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 on Linux make cairo _cairo_surface_get_extents calls that do not properly interact with libav header allocation in FFmpeg 0.10 which allows remote attackers to cause a denial of service (application crash) via a crafted video.


The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake aka a read-timeout vulnerability.


iRZ RUH2 before 2b does not validate firmware patches which allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.


The get_abbrev_array_info function in libdwarf-20151114 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted elf file.


VMX in Xen 4.6.x and earlier when using an Intel or Cyrix CPU allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP.


resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4 when DNS cookies are enabled allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option.


fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes.


epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.


The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array read access) via crafted JPEG 2000 data.


Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings which allows remote attackers to cause a denial of service (UI outage) or conduct clickjacking or spoofing attacks via a crafted web site.


libavcodec/gif.c in FFmpeg before 2.8.6 does not properly calculate a buffer size which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .tga file related to the gif_image_write_image gif_encode_init and gif_encode_close functions.


SampleTable.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-06-01 allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file aka internal bug 28076789.


The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.


libswscale/swscale_unscaled.c in FFmpeg before 2.8.6 does not validate certain height values which allows remote attackers to cause a denial of service (out-of-bounds array read access) or possibly have unspecified other impact via a crafted .cine file related to the bayer_to_rgb24_wrapper and bayer_to_yv12_wrapper functions.


F5 BIG-IP LTM AFM Analytics APM ASM Link Controller and PEM 11.3.x 11.4.x before 11.4.1 build 685-HF10 11.5.1 before build 10.104.180 11.5.2 before 11.5.4 build 0.1.256 11.6.0 before build 6.204.442 and 12.0.0 before build 1.14.628; BIG-IP AAM 11.4.x before 11.4.1 build 685-HF10 11.5.1 before build 10.104.180 11.5.2 before 11.5.4 build 0.1.256 11.6.0 before build 6.204.442 and 12.0.0 before build 1.14.628; BIG-IP DNS 12.0.0 before build 1.14.628; BIG-IP Edge Gateway WebAccelerator and WOM 11.3.0; BIG-IP GTM 11.3.x 11.4.x before 11.4.1 build 685-HF10 11.5.1 before build 10.104.180 11.5.2 before 11.5.4 build 0.1.256 and 11.6.0 before build 6.204.442; BIG-IP PSM 11.3.x and 11.4.x before 11.4.1 build 685-HF10; BIG-IQ Cloud Device and Security 4.2.0 through 4.5.0; and BIG-IQ ADC 4.5.0 do not properly regenerate certificates and keys when deploying cloud images in Amazon Web Services (AWS) Azure or Verizon cloud services environments which allows attackers to obtain sensitive information or cause a denial of service (disruption) by leveraging a target instance configuration.


The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.


buffer.c in named in ISC BIND 9 before 9.9.9-P3 9.10.x before 9.10.4-P3 and 9.11.x before 9.11.0rc3 does not properly construct responses which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.


The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before 341.95 and R352 before 354.74 on Windows allows local users to obtain sensitive information from kernel memory cause a denial of service (crash) or possibly gain privileges via unspecified vectors which trigger uninitialized or out-of-bounds memory access.


IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43 8.0.0.x before 8.0.0.13 8.5.0.x before 8.5.5.10 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3 and 9.0.0.x before 9.0.0.1 allows remote attackers to cause a denial of service via crafted SIP messages.


The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.


Asterisk Open Source 1.8.x 11.x before 11.21.1 12.x and 13.x before 13.7.1 and Certified Asterisk 1.8.28 11.6 before 11.6-cert12 and 13.1 before 13.1-cert3 allow remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a zero length error correcting redundancy packet for a UDPTL FAX packet that is lost.


The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read which allows remote attackers to cause a denial of service (worker process crash web server deadlock or memory consumption) via a large amount of POST data.


libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr chrominance subsampling factors which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF file related to the tiff_decode_tag and decode_frame functions.


The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h.


The Qualcomm hardware video codec in Android before 2016-05-01 on Nexus 5 devices allows remote attackers to cause a denial of service (reboot) via a crafted file aka internal bug 26221024.


The tcp_cwnd_reduction function in net/ipv4/tcp_input.c in the Linux kernel before 4.3.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via crafted TCP traffic.


The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.


The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string as demonstrated by a large amount of ASN.1 data a different vulnerability than CVE-2016-0799.


Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.


GlobespanVirata ftpd 1.0 as used on Huawei SmartAX MT882 devices V200R002B022 Arg allows remote authenticated users to cause a denial of service (device outage) by using the FTP MKD command to create a directory with a long name and then using certain other commands.


The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image.


The TSymbolTableLevel class in ANGLE as used in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 on Windows allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact by triggering use of a WebGL shader that writes to an array.


Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.


epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to gain privileges and cause a denial of service (system crash) via a crafted URL.


The Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.


ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via malformed options data in an OPT resource record.


The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records related to rec_layer_d1.c and ssl3_record.c.


The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.


sound/core/timer.c in the Linux kernel before 4.4.1 retains certain linked lists after a close or stop action which allows local users to cause a denial of service (system crash) via a crafted ioctl call related to the (1) snd_timer_close and (2) _snd_timer_stop functions.


HPE Network Node Manager i (NNMi) 9.20 9.23 9.24 9.25 10.00 and 10.01 allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.


ISC BIND 9.x before 9.9.9-P2 9.10.x before 9.10.4-P2 and 9.11.x before 9.11.0b2 when lwresd or the named lwres option is enabled allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.


The Windows-based Host Interface Program (WHIP) service on Huawei SmartAX MT882 devices V200R002B022 Arg relies on the client to send a length field that is consistent with a buffer size which allows remote attackers to cause a denial of service (device outage) or possibly have unspecified other impact via crafted traffic on TCP port 8701.


The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data.


http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.


The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delta escapes in a crafted BMP image.


server/content/SyncStorageEngine.java in SyncStorageEngine in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-04-01 mismanages certain authority data which allows attackers to cause a denial of service (reboot loop) via a crafted application aka internal bug 26513719.


Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string as demonstrated by a crafted HTTP Vary header.


The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6 as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not initialize memory for an unspecified data structure which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.


The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before 341.95 and R352 before 354.74 on Windows allows local users to obtain sensitive information cause a denial of service (crash) or gain privileges via unspecified vectors related to an untrusted pointer which trigger uninitialized or out-of-bounds memory access.


The __read_etc_hosts_r function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via a crafted packet.


chan_sip in Asterisk Open Source 1.8.x 11.x before 11.21.1 12.x and 13.x before 13.7.1 and Certified Asterisk 1.8.28 11.6 before 11.6-cert12 and 13.1 before 13.1-cert3 when the timert1 sip.conf configuration is set to a value greater than 1245 allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values.


The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c.


libavcodec/pngenc.c in FFmpeg before 2.8.5 uses incorrect line sizes in certain row calculations which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .avi file related to the apng_encode_frame and encode_apng functions.


Sure Start on HP Commercial PCs 2015 allows local users to cause a denial of service (BIOS recovery failure) by leveraging administrative access.


in

Blink

as

used

in

Google

Chrome

before

does

not

properly

determine

when

anonymous

block

wrappers

may

exist

which

allows

remote

attackers

to

cause

a

denial

of

service

(incorrect

cast

and

assertion

failure)

or

possibly

have

unspecified

other

impact

via

crafted

JavaScript

code.


NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd which changes the value of trustedkey controlkey or requestkey. NOTE: this vulnerability exists because of a CVE-2016-2516 regression.


The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document related to esi/CustomParser.cc and esi/CustomParser.h.


The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously related to d1_lib.c statem_dtls.c statem_lib.c and statem_srvr.c.


The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers involving ring buffer control.


The AMF framework in Granite Data Services 3.1.1-SNAPSHOT allows remote authenticated users to read arbitrary files send TCP requests to intranet servers or cause a denial of service via an XML external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


The __decode_dotted function in libc/inet/resolv.c in uClibc-ng before 1.0.12 allows remote DNS servers to cause a denial of service (infinite loop) via vectors involving compressed items in a reply.


The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) via unspecified input to the OS2ECP function related to a composite modulus.


IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.


Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.


NTP before 4.2.8p7 and 4.3.x before 4.3.92 when mode7 is enabled allows remote attackers to cause a denial of service (ntpd abort) by using the same IP address multiple times in an unconfig directive.


The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6 as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not initialize memory for an unspecified data structure which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.


IBM Tealeaf Customer Experience 8.7 8.8 and 9.0.2 could allow a remote attacker under unusual circumstances to read operational data or TLS session state for any active sessions cause denial of service or bypass security. IBM X-Force ID: 113999.


The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.


HPE Insight Control before 7.5.1 allow remote attackers to obtain sensitive information modify data or cause a denial of service via unspecified vectors.


sound/core/hrtimer.c in the Linux kernel before 4.4.1 does not prevent recursive callback access which allows local users to cause a denial of service (deadlock) via a crafted ioctl call.


The broker application in IBM BigFix Remote Control before 9.1.3 allows remote attackers to cause a denial of service via an invalid HTTP request.


ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions.


The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports'utc-millisec' regular expression which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.


Ruckus Wireless H500 web management interface denial of service


NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.


Tremolo/res012.c in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-07-01 does not validate the number of partitions which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file aka internal bug 28556125.


mongod in MongoDB 2.6 when using 2.4-style users and 2.4 allow remote attackers to cause a denial of service (memory consumption and process termination) by leveraging in-memory database representation when authenticating against a non-existent database.


The Java Startup Framework (aka jstart) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted HTTP request aka SAP Security Note 2259547.


IBM AppScan Source 8.7 through 9.0.3.3 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests which allows local guest OS users to gain privileges cause a denial of service (guest OS crash) or obtain sensitive information by leveraging I/O port access.


Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service.


The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references.


Off-by-one error in server/wifi/anqp/VenueNameElement.java in Wi-Fi in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service (reboot) via an access point that provides a crafted (1) Venue Group or (2) Venue Type value aka internal bug 29464811.


IBM FileNet Workplace 4.0.2 before 4.0.2.14 LA012 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


Android 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of locked-screen 911 functionality) via a crafted application that uses the app-pinning feature aka internal bug 28761672.


Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests which allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area.


Huawei AR3200 routers with software before V200R006C10SPC300 allow remote authenticated users to cause a denial of service (restart) via crafted packets.


The fpAcc function in tif_predict.c in the tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted TIFF image.


Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking which allows remote attackers to cause a denial of service via a crafted HTTP response related to Vary headers.


codecs/aacdec/SoftAAC2.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-08-01 allows remote attackers to cause a denial of service (device hang or reboot) via crafted ADTS data aka internal bug 29153599.


decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-08-01 mishandles invalid PPS and SPS NAL units which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file aka internal bug 28835995.


Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor.


Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform.


The rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero) by setting the (1) v or (2) h parameter to 0.


Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service disruption).


Siemens SIMATIC S7-300 Profinet-enabled CPU devices with firmware before 3.2.12 and SIMATIC S7-300 Profinet-disabled CPU devices with firmware before 3.3.12 allow remote attackers to cause a denial of service (defect-mode transition) via crafted (1) ISO-TSAP or (2) Profibus packets.


The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet.


The telephony component in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-08-01 allows remote attackers to cause a denial of service (device crash) via a NITZ time value of 2038-01-19 or later that is mishandled by the system clock aka internal bug 29083635 related to a \Year 2038 problem.\


The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier when used in recovery mode allows context-dependent attackers to cause a denial of service (infinite recursion stack consumption and application crash) via a crafted XML document.


The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of service (host OS infinite loop and hang) via unspecified vectors.


The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 does not initialize certain structure members which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file aka internal bug 29023649.


libc in Android 4.x before 4.4.4 allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file aka internal bug 28740702.


MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-07-01 does not check whether memory allocation succeeds which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file aka internal bug 28471206.


The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses.


The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.


The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface.


The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI error injection through EINJ when securelevel is set.


The (1) brin_page_type and (2) brin_metapage_info functions in the pageinspect extension in PostgreSQL before 9.5.x before 9.5.2 allows attackers to bypass intended access restrictions and consequently obtain sensitive server memory information or cause a denial of service (server crash) via a crafted bytea value in a BRIN index page.


XML

external

entity

(XXE)

vulnerability

in

the

Configuration

Wizard

in

SAP

NetWeaver

Java

AS

through

allows

remote

attackers

to

cause

a

denial

of

service

conduct

SMB

Relay

attacks

or

access

arbitrary

files

via

a

crafted

XML

request

to

_tc~monitoring~webservice~web/ServerNodesWSService

aka

SAP

Security

Note


Bluetooth in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of Bluetooth 911 functionality) via a crafted application that sends a signal to a Bluetooth process aka internal bug 28885210.


PlainSaslServer.java in Apache Qpid Java before 6.0.3 when the broker is configured to allow plaintext passwords allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt which triggers an uncaught exception.


Active Directory in Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service hang) by creating many machine accounts aka \Active Directory Denial of Service Vulnerability.\


The Search component in Microsoft Windows 7 Windows Server 2008 R2 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows local users to cause a denial of service (performance degradation) via a crafted application aka \Windows Search Component Denial of Service Vulnerability.\


drivers/thermal/supply_lm_core.c in the Qualcomm components in Android before 2016-08-05 does not validate a certain count parameter which allows attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted application aka Qualcomm internal bug CR990824.


The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service (process crash) for all VMs.


decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-09-01 mishandles the case of decoding zero MBs which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file aka internal bug 29493002.


codecs/hevcdec/SoftHEVC.cpp in libstagefright in mediaserver in Android 6.0.1 before 2016-08-01 mishandles decoder errors which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file aka internal bug 28816956.


decoder/ih264d_parse_pslice.c in mediaserver in Android 6.x before 2016-07-01 does not properly select concealment frames which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file aka internal bug 28470138.


The MultipartStream class in Apache Commons Fileupload before 1.3.2 as used in Apache Tomcat 7.x before 7.0.70 8.x before 8.0.36 8.5.x before 8.5.3 and 9.x before 9.0.0.M7 and other products allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.


Microsoft Windows 10 Gold and 1511 allows attackers to cause a denial of service via unspecified vectors aka \Windows Denial of Service Vulnerability.\


The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (invalid free and daemon crash) via vectors related to error handling.


OMXCodec.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 6.x before 2016-09-01 and 7.0 before 2016-09-01 does not validate a certain pointer which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file aka internal bug 29421811.


server/wifi/anqp/ANQPFactory.java in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows attackers to cause a denial of service (blocked Wi-Fi usage) via a crafted application aka internal bug 30230534.


The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call.


mediaserver in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-07-01 does not limit process-memory usage which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file aka internal bug 28615448.


The help service in IBM Connections 4.x through 4.5 CR5 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to cause a denial of service (service degradation) via a crafted URL.


id3/ID3.cpp in libstagefright in mediaserver in Android 5.0.x before 5.0.2 5.1.x before 5.1.1 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file aka internal bug 30744884.


Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12 which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.


The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (out-of-bounds memory access and daemon crash) via vectors involving a negative length value.


Telephony in Android 5.0.x before 5.0.2 5.1.x before 5.1.1 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows attackers to cause a denial of service (loss of locked-screen 911 TTY functionality) via a crafted application that modifies the TTY mode by broadcasting an intent aka internal bug 29832693.


The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18 6.0.x before 6.0.13 6.1.x before 6.1.10 and 7.0.x before 7.0.5H2 allows remote attackers to cause a denial of service (service crash) via a crafted request.


Siemens SCALANCE S613 allows remote attackers to cause a denial of service (web-server outage) via traffic to TCP port 443.


The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44 5.5.x before 5.5.28 5.6.x before 5.6.12 and 7.x before 7.0.4 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (type confusion and application crash) via crafted serialized _cookies data related to the SoapClient::__call method in ext/soap/soap.c.


IBM Traveler 8.x and 9.x before 9.0.1.12 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via XML data containing an external entity declaration in conjunction with an entity reference related to an XML External Entity (XXE) issue.


drivers/media/video/msm/msm_mctl_buf.c in the Qualcomm components in Android before 2016-08-05 does not validate the image mode which allows attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted application aka Qualcomm internal bug CR897326.


The cvtClump function in the rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) by setting the \-v\ option to -1.


The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8 which allows guest OS users to read or write to the kvm_arch_vcpu data structure and consequently obtain sensitive information or cause a denial of service (system crash) via a crafted ioctl call.


Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the \full name.\


Computer Associates (CA) eTrust Intrusion Detection 3.0 allows remote attackers to cause a denial of service via large size values that are not properly validated before calling the CPImportKey function in the Crypto API.


The SmartScan feature in the Auto-Protect module for Symantec Norton AntiVirus 2004 and 2005 as also used in Internet Security 2004/2005 and System Works 2004/2005 allows attackers to cause a denial of service (CPU consumption and system crash) by renaming a file on a network share.


Code Ocean FTP server 1.0 allows remote attackers to cause a denial of service via a large number of connections.


Gigafast router (aka CompUSA router) with the DNS proxy option enabled allows remote attackers to cause a denial of service via malformed DNS queries.


A regression error in the Red Hat Enterprise Linux 4 kernel 4GB/4GB split patch omits an \access check \ which allows local users to cause a denial of service (crash).


The php_next_marker function in image.c for PHP 4.2.2 4.3.9 4.3.10 and 5.0.3 as reachable by the getimagesize PHP function allows remote attackers to cause a denial of service (infinite loop) via a JPEG image with an invalid marker value which causes a negative length value to be passed to php_stream_seek.


Cisco IOS 12.0 through 12.3YL with BGP enabled and running the bgp log-neighbor-changes command allows remote attackers to cause a denial of service (device reload) via a malformed BGP packet.


Unknown vulnerability in lshd in Lysator LSH 1.x and 2.x before 2.0.1 allows remote attackers to cause a denial of service via unknown vectors.


The xattr file system code as backported in Red Hat Enterprise Linux 3 on 64-bit systems does not properly handle certain offsets which allows local users to cause a denial of service (system crash) via certain actions on an ext3 file system with extended attributes enabled.


AIO in the Linux kernel 2.6.11 on the PPC64 or IA64 architectures with CONFIG_HUGETLB_PAGE enabled allows local users to cause a denial of service (system panic) via a process that executes the io_queue_init function but exits without running io_queue_release which causes exit_aio and is_hugepage_only_range to fail.


The DNS implementation in DeleGate 8.10.2 and earlier allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset which could trigger an infinite loop.


The daemon for fallback-reboot before 0.995 allows attackers to cause a denial of service (daemon exit) possibly related to verbose debug messages when the daemon is not on a tty.


Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.


PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to Filelist.html.


Breed patch 1 and earlier allows remote attackers to cause a denial of service (application crash) via an empty UDP packet which triggers a null dereference.


The original design of TCP does not check that the TCP sequence number in an ICMP error message is within the range of sequence numbers for data that has been sent but not acknowledged (aka \TCP sequence number checking\) which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service as demonstrated using (1) blind connection-reset attacks with forged \Destination Unreachable\ messages (2) blind throughput-reduction attacks with forged \Source Quench\ messages or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790 CVE-2004-0791 and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065 CVE-2005-0066 CVE-2005-0067 and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.


Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (segmentation fault) by aborting the connection during a (1) PUT or (2) POST request which causes Squid to access previously freed memory.


Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value which causes the host to discard later packets because they appear to be too old.


Soldner Secret Wars 30830 and earlier does not properly handle the \message too long\ socket error which allows remote attackers to cause a denial of service (socket termination) via a long UDP packet.


The /proc handling (proc/base.c) Linux kernel 2.4 before 2.4.17 allows local users to cause a denial of service via unknown vectors that cause an invalid access of free memory.


Sami HTTP Server 1.0.5 allows remote attackers to cause a denial of service via an HTTP request containing two CRLF sequences which triggers a NULL dereference.


Cisco devices running Application and Content Networking System (ACNS) 5.0 before 5.0.17.6 and 5.1 before 5.1.11.6 allow remote attackers to cause a denial of service (process restart) via a \crafted TCP connection.\


Cisco IP/VC Videoconferencing System 3510 3520 3525 and 3530 contain hard-coded default SNMP community strings which allows remote attackers to gain access cause a denial of service and modify configuration.


Cisco IOS 12.1YD 12.2T 12.3 and 12.3T when configured for the IOS Telephony Service (ITS) CallManager Express (CME) or Survivable Remote Site Telephony (SRST) allows remote attackers to cause a denial of service (device reboot) via a malformed packet to the SCCP port.


Linksys PSUS4 running firmware 6032 allows remote attackers to cause a denial of service (device crash) via an HTTP POST request containing an unknown parameter without a value.


Desktop Communication Protocol (DCOP) daemon aka dcopserver in KDE before 3.4 allows local users to cause a denial of service (dcopserver consumption) by \stalling the DCOP authentication process.\


The netfilter/iptables module in Linux before 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) or bypass firewall rules via crafted packets which are not properly handled by the skb_checksum_help function.


The SNMP service in the Belkin 54G (F5D7130) wireless router allows remote attackers to cause a denial of service via unknown vectors.


Nokia Symbian 60 allows remote attackers to cause a denial of service (phone restart) via a Bluetooth nickname.


Unknown vulnerability in Linux kernel 2.4.x 2.5.x and 2.6.x allows NFS clients to cause a denial of service via O_DIRECT.


minis.php in Minis 0.2.1 allows remote attackers to cause a denial of service (infinite loop) via an HTTP request for a file that the web server does not have permission to read as demonstrated using the month parameter.


VERITAS Backup Exec 9.0 through 10.0 for Windows Servers and 9.0.4019 through 9.1.307 for Netware allows remote attackers to cause a denial of service (Remote Agent crash) via (1) a crafted packet in NDMLSRVR.DLL or (2) a request packet with an invalid (non-0) \Error Status\ value which triggers a null dereference.


The original design of ICMP does not require authentication for host-generated ICMP error messages which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service as demonstrated using (1) blind connection-reset attacks with forged \Destination Unreachable\ messages (2) blind throughput-reduction attacks with forged \Source Quench\ messages or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790 CVE-2004-0791 and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065 CVE-2005-0066 CVE-2005-0067 and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.


PHP 4 (PHP4) allows attackers to cause a denial of service (daemon crash) by using the readfile function on a file whose size is a multiple of the page size.


Apple AirPort Express prior to 6.1.1 and Extreme prior to 5.5.1 configured as a Wireless Data Service (WDS) allows remote attackers to cause a denial of service (device freeze) by connecting to UDP port 161 and before link-state change occurs.


init_dev in tty_io.c in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3 does not properly clear controlling tty's in multi-threaded applications which allows local users to cause a denial of service (crash) and possibly gain tty access via unknown attack vectors that trigger an access of a pointer to a freed structure.


vsdatant.sys in Zone Lab ZoneAlarm before 5.5.062.011 ZoneAlarm Wireless before 5.5.080.000 Check Point Integrity Client 4.x before 4.5.122.000 and 5.x before 5.1.556.166 do not properly verify that the ServerPortName argument to the NtConnectPort function is a valid memory address which allows local users to cause a denial of service (system crash) when ZoneAlarm attempts to dereference an invalid pointer.


Apache mod_auth_radius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service (crash) via a RADIUS_REPLY_MESSAGE with a RADIUS attribute length of 1 which leads to a memcpy operation with a -1 length argument.


Microsoft Windows XP SP1 allows local users to cause a denial of service (system crash) via an empty datagram to a raw IP over IP socket (IP protocol 4) as originally demonstrated using code in Python 2.3.


Windows Explorer and Internet Explorer in Windows 2000 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a malformed Windows Metafile (WMF) file.


Stack consumption vulnerability in Microsoft Exchange Server 2003 SP1 allows users to cause a denial of service (hang) by deleting or moving a folder with deeply nested subfolders which causes Microsoft Exchange Information Store service (Store.exe) to hang as a result of a large number of recursive calls.


Unknown vulnerability in the Auto-Protect module in Symantec Norton AntiVirus 2004 and 2005 as also used in Internet Security 2004/2005 and System Works 2004/2005 allows attackers to cause a denial of service (system hang or crash) by triggering a scan of a certain file type.


PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to cause a denial of service (memory exhaustion and process crash) via a large number of HTTP requests.


The Software Development Kit (SDK) and Run Time Environment (RTE) 1.4.1 and 1.4.2 for Tru64 UNIX allows remote attackers to cause a denial of service (Java Virtual Machine hang) via object deserialization.


The GPRS-LLC dissector in Ethereal 0.10.7 through 0.10.9 with the \ignore cipher bit\ option enabled. allows remote attackers to cause a denial of service (application crash).


The Amp II engine as used by Gore: Ultimate Soldier 1.50 and earlier allows remote attackers to cause a denial of service (infinite loop) via a zero byte UDP packet.


The php_handle_iff function in image.c for PHP 4.2.2 4.3.9 4.3.10 and 5.0.3 as reachable by the getimagesize PHP function allows remote attackers to cause a denial of service (infinite loop) via a -8 size value.


Windows Server 2003 and XP SP2 with Windows Firewall turned off allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port aka a reoccurrence of the \Land\ vulnerability (CVE-1999-0016).


Cisco IOS 12.1T 12.2 12.2T 12.3 and 12.3T with Multi Protocol Label Switching (MPLS) installed but disabled allows remote attackers to cause a denial of service (device reload) via a crafted packet sent to the disabled interface.


Multiple \range checking flaws\ in the ISO9660 filesystem handler in Linux 2.6.11 and earlier may allow attackers to cause a denial of service or corrupt memory via a crafted filesystem.


The unw_unwind_to_user function in unwind.c on Itanium (ia64) architectures in Linux kernel 2.6 allows local users to cause a denial of service (system crash).


Xpand Rally 1.0.0.0 allows remote attackers or remote malicious game servers to cause a denial of service (application crash) via a packet with large values that are not properly handled in certain malloc or memcpy operations.


ptrace in Linux kernel 2.6.8.1 does not properly verify addresses on the amd64 platform which allows local users to cause a denial of service (kernel crash).


The WCCP message parsing code in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via malformed WCCP messages with source addresses that are spoofed to reference Squid's home router and invalid WCCP_I_SEE_YOU cache numbers.


The DNS implementation of DNRD before 2.10 allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset which could trigger an infinite loop.


The COPS dissector in Ethereal 0.10.6 through 0.10.8 allows remote attackers to cause a denial of service (infinite loop).


gifload.exe in GIMP 2.0.5 2.2.3 and possibly 2.2.4 allows remote attackers or local users to cause a denial of service (application crash) via the image descriptor (1) height or (2) width fields set to zero.


PY Software Active Webcam WebServer (webcam.exe) 5.5 allows remote attackers to cause a denial of service via a request to a file on the floppy drive as demonstrated using A:\\a.txt.


Gaim 1.1.3 on Windows systems allows remote attackers to cause a denial of service (client crash) via a file transfer in which the filename contains \(\ or \)\ (parenthesis) characters.


Unknown vulnerability in the systems message queue in HP Tru64 Unix 4.0F PK8 through 5.1B-2/PK4 allows local users to cause a denial of service (process crash) for processes such as nfsstat pfstat arp ogated rarpd route sendmail srconfig strsetup trpt netstat and xntpd.


Integer signedness error in the parse_machfile function in the mach-o loader (mach_loader.c) for the Darwin Kernel as used in Mac OS X 10.3.7 and other versions before 10.3.9 allows local users to cause a denial of service (CPU consumption) via a crafted mach-o header.


The DNSPacket::expand method in dnspacket.cc in PowerDNS before 2.9.17 allows remote attackers to cause a denial of service by sending a random stream of bytes.


Unknown vulnerability in BIND 9.2.0 in HP-UX B.11.00 B.11.11 and B.11.23 allows remote attackers to cause a denial of service.


MySQL

MaxDB

for

Windows

and

possibly

earlier

versions

and

other

platforms

allows

remote

attackers

to

cause

a

denial

of

service

(application

crash)

via

invalid

parameters

to

the

or

functions

which

triggers

a

dereference.


Adobe Acrobat Reader 6.0.3 and 7.0.0 allows remote attackers to cause a denial of service (application crash) via a PDF file that contains a negative Count value in the root page node.


The TCP stack (tcp_input.c) in OpenBSD 3.5 and 3.6 allows remote attackers to cause a denial of service (system panic) via crafted values in the TCP timestamp option which causes invalid arguments to be used when calculating the retransmit timeout.


LANChat Pro Revival 1.666c allows remote attackers to cause a denial of service (application crash) via a malformed UDP packet.


Multiple games developed by FUN labs including 4X4 Off-road Adventure III Big Game Hunter Dangerous Hunts Deer Hunt Revolution Secret Service Shadow Force and US Most Wanted allow remote attackers to cause a denial of service via an empty UDP packet to the server which cannot detect that a new packet has arrived using the socket ioctl.


The GetEnhMetaFilePaletteEntries API in GDI32.DLL in Windows 2000 allows remote attackers to cause a denial of service (application crash) via a crafted Enhanced Metafile (EMF) file that causes invalid (1) end (2) emreof or (3) palent offsets to be used aka \Enhanced Metafile Vulnerability.\


ZPanel 2.0 and 2.5 beta 10 does not remove or protect installation scripts after they have been used which allows remote attackers to reinstall the software and possibly cause a denial of service via a direct request to install.php.


The HTML parsing functions in Gaim before 1.1.3 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes \an invalid memory access \ a different vulnerability than CVE-2005-0208.


Linux kernel 2.6 on Itanium (ia64) architectures allows local users to cause a denial of service via a \missing Itanium syscall table entry.\


Cisco IOS 12.0S through 12.3YH allows remote attackers to cause a denial of service (device restart) via a crafted IPv6 packet.


The HTML parsing functions in Gaim before 1.1.4 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes \an invalid memory access \ a different vulnerability than CVE-2005-0473.


The XP Server process (xp_server) in Sybase Adaptive Server Enterprise (ASE) XP Server 12.x before 12.5.3 ESD#1 allows attackers to cause a denial of service (process crash) via malformed data sent to the XP Server TCP port.


Squid 2.5.STABLE8 and earlier allows remote attackers to cause a denial of service (crash) via certain DNS responses regarding (1) Fully Qualified Domain Names (FQDN) in fqdncache.c or (2) IP addresses in ipcache.c which trigger an assertion failure.


Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 and earlier allow remote attackers to cause a denial of service (network disconnection) via an empty UDP packet which is not properly distinguished from the \no new packets\ state of the associated socket.


The NTLM component in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via a malformed NTLM type 3 message that triggers a NULL dereference.


NLSCCSTR.DLL in the web service in IBM Lotus Domino Server 6.5.1 6.0.3 and possibly other versions allows remote attackers to cause a denial of service (deep recursion and nHTTP.exe process crash) via a long GET request containing UNICODE decimal value 430 characters which causes the stack to be exhausted. NOTE: IBM has reported that it is unable to replicate this issue.


The RealServer RealSubscriber on Cisco devices running Application and Content Networking System (ACNS) 5.1 allow remote attackers to cause a denial of service (CPU consumption) via malformed packets.


The original design of TCP does not check that the TCP Acknowledgement number in an ICMP error message generated by an intermediate router is within the range of possible values for data that has already been acknowledged (aka \TCP acknowledgement number checking\) which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service as demonstrated using (1) blind connection-reset attacks with forged \Destination Unreachable\ messages (2) blind throughput-reduction attacks with forged \Source Quench\ messages or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790 CVE-2004-0791 and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065 CVE-2005-0066 CVE-2005-0067 and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.


The shmem_nopage function in shmem.c for the tmpfs driver in Linux kernel 2.6 does not properly verify the address argument which allows local users to cause a denial of service (kernel crash) via an invalid address.


Unknown vulnerability in ImageMagick before 6.1.8 allows remote attackers to cause a denial of service (application crash) via a crafted PSD file.


WarFTPD 1.82 RC9 when running as an NT service allows remote authenticated users to cause a denial of service (access violation) via a CWD command with a crafted pathname as demonstrated using a large string of \%s\ sequences possibly indicating a format string vulnerability.


Multiple format string vulnerabilities in the FTP service in 3Com 3CDaemon 2.0 revision 10 allow remote attackers to cause a denial of service (application crash) via format string specifiers in (1) the username (2) cd (3) delete (4) rename (5) rmdir (6) literal (7) stat or (8) CWD commands.


The Legato PortMapper in EMC Legato NetWorker Sun Solstice Backup 6.0 and 6.1 and StorEdge Enterprise Backup 7.0 through 7.2 does not restrict access to the pmap_set and pmap_unset commands which allows remote attackers to (1) cause a denial of service by using pmap_unset to un-register a NetWorker service or (2) obtain sensitive information from NetWorker services by using pmap_set to register a new service.


Gaim before 1.1.3 allows remote attackers to cause a denial of service (infinite loop) via malformed SNAC packets from (1) AIM or (2) ICQ.


Cisco devices running Application and Content Networking System (ACNS) 5.0 5.1 before 5.1.13.7 or 5.2 before 5.2.3.9 allow remote attackers to cause a denial of service (bandwidth consumption) via \crafted IP packets\ that are continuously forwarded.


Netfilter in Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via crafted IP packet fragments.


Cisco VPN 3000 series Concentrator running firmware 4.1.7.A and earlier allows remote attackers to cause a denial of service (device reload or drop user connection) via a crafted HTTPS packet.


An \incorrect assumption\ in the authvalidated validator function in BIND 9.3.0 when DNSSEC is enabled allows remote attackers to cause a denial of service (named server exit) via crafted DNS packets that cause an internal consistency test (self-check) to fail.


The KAME racoon daemon in ipsec-tools before 0.5 allows remote attackers to cause a denial of service (crash) via malformed ISAKMP packets.


Solaris 7 8 and 9 allows remote attackers to cause a denial of service (hang) via a flood of certain ARP packets.


Soldier of Fortune II 1.03 gold allows remote attackers to cause a denial of service (application crash) via a large cl_guid value which results in an invalid pointer dereference.


The load_elf_library in the Linux kernel before 2.6.11.6 allows local users to cause a denial of service (kernel crash) via a crafted ELF library or executable which causes a free of an invalid pointer.


Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 and earlier allow remote attackers to cause a denial of service (freeze) via a large number of player connections that do not send any data.


The intagg contrib module for PostgreSQL 8.0.0 and earlier allows attackers to cause a denial of service (crash) via crafted arrays.


Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 earlier allows remote attackers to cause a denial of service (application crash) via a packet with a large (1) descriptor ID or (2) claim_id which exceeds the boundaries of an array.


Cisco devices running Application and Content Networking System (ACNS) 4.x 5.0 or 5.1 before 5.1.11.6 allow remote attackers to cause a denial of service (CPU consumption) via malformed IP packets.


profile.php in PunBB 1.2.1 allows remote attackers to cause a denial of service (account lockout) by setting the user's password to NULL.


The original design of TCP does not require that port numbers be assigned randomly (aka \Port randomization\) which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service as demonstrated using (1) blind connection-reset attacks with forged \Destination Unreachable\ messages (2) blind throughput-reduction attacks with forged \Source Quench\ messages or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced. NOTE: CVE-2004-0790 CVE-2004-0791 and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065 CVE-2005-0066 CVE-2005-0067 and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.


Linux kernel 2.4.x and 2.6.x allows local users to cause a denial of service (CPU and memory consumption) and bypass RLIM_MEMLOCK limits via the mlockall call.


The TIFF decoder in ImageMagick before 6.0 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.


The sapdbwa_GetUserData function in MySQL MaxDB 7.5.0.0 and other versions before 7.5.0.21 allows remote attackers to cause a denial of service (crash) via invalid parameters to the WebDAV handler code which triggers a null dereference that causes the SAP DB Web Agent to crash.


The DNS implementation of PowerDNS 2.9.16 and earlier allows remote attackers to cause a denial of service via a compressed DNS packet with a label length byte with an incorrect offset which could trigger an infinite loop.


Scrapland 1.0 and earlier allows remote attackers to cause a denial of service (server termination) by triggering an error which is treated as a fatal error by the server as demonstrated using (1) signed integers for size values (2) an invalid model (3) a \newpos\ value that is less than or equal to a size value or (4) partial packets.


Netcomm 1300NB DSL Modem allows remote attackers to cause a denial of service (device hang) via a large number of ping packets.


ImageMagick before 6.0 allows remote attackers to cause a denial of service (application crash) via a TIFF image with an invalid tag.


FileZilla FTP server before 0.9.6 when using MODE Z (zlib compression) allows remote attackers to cause a denial of service (infinite loop) via certain file uploads or directory listings.


The wu_fnmatch function in wu_fnmatch.c in wu-ftpd 2.6.1 and 2.6.2 allows remote attackers to cause a denial of service (CPU exhaustion by recursion) via a glob pattern with a large number of * (wildcard) characters as demonstrated using the dir command.


The IRC protocol plugin in Gaim 1.2.0 and possibly earlier versions allows (1) remote attackers to inject arbitrary Gaim markup via irc_msg_kick irc_msg_mode irc_msg_part irc_msg_quit (2) remote attackers to inject arbitrary Pango markup and pop up empty dialog boxes via irc_msg_invite or (3) malicious IRC servers to cause a denial of service (application crash) by injecting certain Pango markup into irc_msg_badmode irc_msg_banned irc_msg_unknown irc_msg_nochan functions.


Multiple games developed by FUN labs including 4X4 Off-road Adventure III Big Game Hunter Dangerous Hunts Deer Hunt Revolution Secret Service Shadow Force and US Most Wanted allow remote attackers to cause a denial of service (crash from invalid memory access) via a malformed join packet with values that cause the server to copy more memory than was actually provided in the packet.


fetchnews in leafnode 1.9.48 to 1.11.1 allows remote NNTP servers to cause a denial of service (crash) by closing the connection while fetchnews is reading (1) an article header or (2) an article body which also prevents fetchnews from querying other servers.


Secure Shell (SSH) 2 in Cisco IOS 12.0 through 12.3 allows remote attackers to cause a denial of service (device reload) (1) via a username that contains a domain name when using a TACACS+ server to authenticate (2) when a new SSH session is in the login phase and a currently logged in user issues a send command or (3) when IOS is logging messages and an SSH session is terminated while the server is sending data.


GoodTech SMTP Server 5.14 allows remote attackers to cause a denial of service (application crash) via a RCPT TO command with an invalid argument as demonstrated using an \A\ character.


The TCP/IP stack in multiple operating systems allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the correct sequence number but the wrong Acknowledgement number which generates a large number of \keep alive\ packets. NOTE: some followups indicate that this issue could not be replicated.


The \record packet parsing\ in GnuTLS 1.2 before 1.2.3 and 1.0 before 1.0.25 allows remote attackers to cause a denial of service possibly related to padding bytes in gnutils_cipher.c.


Unknown vulnerability in SMTP authentication for MailEnable allows remote attackers to cause a denial of service (crash).


Unknown vulnerability in NIS+ on Solaris 7 8 and 9 allows remote attackers to cause a denial of service (rpc.nisd disabled and NIS+ unavailable) via unknown vectors.


The bgp_update_print function in tcpdump 3.x does not properly handle a -1 return value from the decode_prefix4 function which allows remote attackers to cause a denial of service (infinite loop) via a crafted BGP packet.


Nortel VPN Router (aka Contivity) allows remote attackers to cause a denial of service (crash) via an IPsec IKE packet with a malformed ISAKMP header.


inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application crash) via an invalid file that causes a large dynamic tree to be produced.


Gearbox Software Halo: Combat Evolved 1.6 allows remote attackers to cause a denial of service (infinite loop) via malformed data.


The GIF parser in ateimg32.dll in AOL Instant Messenger (AIM) 5.9.3797 and earlier allows remote attackers to cause a denial of service (crash) via a malformed buddy icon that causes an integer underflow in a loop counter variable.


The YMSGR URL handler in Yahoo! Messenger 5.x through 6.0 allows remote attackers to cause a denial of service (disconnect) via a room login or a room join request packet with a third : (colon) and an & (ampersand) which causes Messenger to send a corrupted packet to the server which triggers a disconnect from the server.


The administration protocol for Kerio WinRoute Firewall 6.x up to 6.0.10 Personal Firewall 4.x up to 4.1.2 and MailServer up to 6.0.8 allows remote attackers to cause a denial of service (CPU consumption) via certain attacks that force the product to \compute unexpected conditions\ and \perform cryptographic operations.\


The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init (2) snb_en_init (3) snb_ru_init (4) spell_init and (5) syn_init functions as \internal\ even when they do not take an internal argument which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments.


Linux 2.6.11 on 64-bit x86 (x86_64) platforms does not use a guard page for the 47-bit address page to protect against an AMD K8 bug which allows local users to cause a denial of service.


SurgeFTP 2.2m1 allows remote attackers to cause a denial of service (application hang) via the LEAK command.


Rakkarsoft RakNet network library 2.33 and earlier when released before 30 May 2005 and as used in multiple products including nFusion Elite Warriors: Vietnam allows remote attackers to cause a denial of service (infinite loop) via a zero-byte UDP packet.


LG U8120 mobile phone allows remote attackers to cause a denial of service (device crash) via a malformed MIDI file.


WebcamXP PRO v2.16.468 and earlier allows remote attackers to cause a denial of service via a long chat name which takes up too much display space and prevents the chat frame from being properly rendered.


The (1) it87 and (2) via686a drivers in I2C for Linux 2.6.x before 2.6.11.8 and 2.6.12 before 2.6.12-rc2 create the sysfs \alarms\ file with write permissions which allows local users to cause a denial of service (CPU consumption) by attempting to write to the file which does not have an associated store function.


The fetchnews NNTP client in leafnode 1.11.2 and earlier can hang while waiting for input that never arrives which allows remote NNTP servers to cause a denial of service (news loss).


Jeuce Personal Web Server 2.13 allows remote attackers to cause a denial of service (server crash) via a GET request beginning with \://\.


The imap4d server for GNU Mailutils 0.5 and 0.6 and other versions before 0.6.90 allows authenticated remote users to cause a denial of service (CPU consumption) via a large range value in the FETCH command.


DataTrac Activity Console 1.1 allows remote attackers to cause a denial of service via a long HTTP GET request.


The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4 and 7.0 through Service Pack 5 allows remote anonymous binds which may allow remote attackers to view user entries or cause a denial of service.


Linux kernel 2.6 and 2.4 on the IA64 architecture allows local users to cause a denial of service (kernel crash) via ptrace and the restore_sigcontext function.


The key_user_lookup function in security/keys/key.c in Linux kernel 2.6.10 to 2.6.11.8 may allow attackers to cause a denial of service (oops) via SMP.


webadmin.exe in Novell Nsure Audit 1.0.1 allows remote attackers to cause a denial of service via malformed ASN.1 packets in corrupt client certificates to an SSL server as demonstrated using an exploit for the OpenSSL ASN.1 parsing vulnerability.


ZyXEL Prestige 650R-31 router running ZyNOS FW v3.40(KO.1) allows remote attackers to cause a denial of service (CPU consumption and network loss) via crafted fragmented IP packets.


Memory leak in Secure Shell (SSH) in Cisco IOS 12.0 through 12.3 when authenticating against a TACACS+ server allows remote attackers to cause a denial of service (memory consumption) via an incorrect username or password.


MIT Kerberos 5 (krb5) 1.3 through 1.4.1 Key Distribution Center (KDC) allows remote attackers to cause a denial of service (application crash) via a certain valid TCP connection that causes a free of unallocated memory.


NEXTWEB (i)Site allows remote attackers to cause a denial of service (error 500) via a crafted HTTP request possibly involving wildcard requests for .jsp files.


The Microsoft Windows kernel in Microsoft Windows 2000 Server Windows XP and Windows Server 2003 allows remote attackers to cause a denial of service (crash) via crafted Remote Desktop Protocol (RDP) requests.


Terminator 3: War of the Machines 1.16 and earlier allows remote attackers to cause a denial of service (application crash) via a large nickname.


The Data function in class.smtp.php in PHPMailer 1.7.2 and earlier allows remote attackers to cause a denial of service (infinite loop leading to memory and CPU consumption) via a long header field.


Trend Micro ServerProtect EarthAgent for Windows Management Console 5.58 and possibly earlier versions when running with Trend Micro Control Manager 2.5 and 3.0 and Damage Cleanup Server 1.1 allows remote attackers to cause a denial of service (CPU consumption) via a flood of crafted packets with a certain \magic value\ to port 5005 which also leads to a memory leak.


Format string vulnerability in the log function in Net::Server 0.87 and earlier as used in Postfix Greylisting Policy Server (Postgrey) 1.18 and earlier and possibly other products allows remote attackers to cause a denial of service (crash) via format string specifiers that are not properly handled before being sent to syslog as demonstrated using sender addresses to Postgrey.


exif.c in PHP before 4.3.11 allows remote attackers to cause a denial of service (memory consumption and crash) via an EXIF header with a large IFD nesting level which causes significant stack recursion.


Gaim before 1.3.1 allows remote attackers to cause a denial of service (crash) via a malformed MSN message that leads to a memory allocation of a large size possibly due to an integer signedness error.


The default installation of Fastream NETFile FTP/Web Server 7.4.6 which supports FXP does not require that the IP address in a PORT command be the same as the IP of the logged in user which allows remote attackers to conduct FTP Bounce attacks to bypass firewall rules or cause a denial of service.


Apache SpamAssassin 3.0.1 3.0.2 and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.


The dhcpcd DHCP client before 1.3.22 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors that cause an out-of-bounds memory read.


Format string vulnerability in gedit 2.10.2 may allow attackers to cause a denial of service (application crash) via a bin file with format string specifiers in the filename. NOTE: while this issue is triggered on the command line by the gedit user it has been reported that web browsers and email clients could be configured to provide a file name as an argument to gedit so there is a valid attack that crosses security boundaries.


The Linux kernel 2.6 before 2.6.12.1 allows local users to cause a denial of service (kernel panic) via a non group-leader thread executing a different program than was pending in itimer which causes the signal to be delivered to the old group-leader task which does not exist.


The MS-Expand file handling in Clam AntiVirus (ClamAV) before 0.86 allows remote attackers to cause a denial of service (file descriptor and memory consumption) via a crafted file that causes repeated errors in the cli_msexpand function.


** UNVERIFIABLE ** NOTE: this issue describes a problem that can not be independently verified as of 20050421. Adobe Acrobat reader (AcroRd32.exe) 6.0 and earlier allows remote attackers to cause a denial of service (\Invalid-ID-Handle-Error\ error) and modify memory beginning at a particular address possibly allowing the execution of arbitrary code via a crafted PDF file. NOTE: the vendor has stated that the reporter refused to provide sufficient details to confirm the issue. In addition due to the lack of details in the original advisory an independent verification is not possible. Finally the reliability of the original reporter is unknown. This item has only been assigned a CVE identifier for tracking purposes and to serve as a concrete example of the newly defined UNVERIFIABLE and PRERELEASE content decisions in CVE which must be discussed by the Editorial Board. Without additional details or independent verification by reliable sources it is highly likely that this item will be REJECTED.


Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service hang) via a crafted Transaction Internet Protocol (TIP) message that causes DTC to repeatedly connect to a target IP and port number after an error occurs aka the \Distributed TIP Vulnerability.\


NiteEnterprises Remote File Manager 1.0 allows remote attackers to cause a denial of service (crash) via a crafted string to TCP port 7080.


Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to conduct administrator operations and cause a denial of service (server or camera shutdown) via a direct request to admin.html.


Sony Ericsson P900 Beamer allows remote attackers to cause a denial of service (panic) via an obexftp session with a long filename in an OBEX File Transfer or OBEX Object Push.


Memory leak in Windows Management Instrumentation (WMI) service allows attackers to cause a denial of service (memory consumption and crash) by creating security contexts more quickly than they can be cleared from the RPC cache.


The __VIEWSTATE functionality in Microsoft ASP.NET 1.x when not cryptographically signed allows remote attackers to cause a denial of service (CPU consumption) via deeply nested markup.


The IMAP daemon (IMAPD32.EXE) in Ipswitch Collaboration Suite (ICS) allows remote attackers to cause a denial of service (CPU consumption) via an LSUB command with a large number of null characters which causes an infinite loop.


The isis_print function as called by isoclns_print in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a zero length as demonstrated using a GRE packet.


Distributed Transaction Controller in Microsoft Windows allows remote servers to cause a denial of service (MSDTC service exception and exit) via an \unexpected protocol command during the reconnection request \ which is not properly handled by the Transaction Internet Protocol (TIP) functionality.


The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie even when it is not in the cluster which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies.


The fib_seq_start function in fib_hash.c in Linux kernel allows local users to cause a denial of service (system crash) via /proc/net/route.


Gamespy cd-key validation system allows remote attackers to cause a denial of service (cd-key already in use) by capturing and replaying a cd-key authorization session.


The ISA Firewall service in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service (Wspsrv.exe crash) via a large amount of SecureNAT network traffic.


The vCard viewer in Nokia 9500 allows attackers to cause a denial of service (crash) via a vCard with a long Name field which causes the crash when the user views it.


FlatNuke 2.5.3 allows remote attackers to cause a denial of service or obtain sensitive information via (1) a direct request to foot_news.php which triggers an infinite loop or (2) direct requests to unknown scripts which reveals the web document root in an error message.


The DbgMsg.sys driver in Compuware SoftICE DriverStudio 3.1 and 3.2 allows remote attackers to cause a denial of service (application crash) via an invalid Debug Message pointer.


mod_channel in The Ignition Project ignitionServer 0.3.0 to 0.3.6 and possibly earlier versions does not allow protected operators to access channels that have been locked out by a key which allows IRC users to cause a denial of service.


The SMTP service in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to cause a denial of service (server crash) via an EHLO command with a Unicode string.


Multiple unknown dissectors in Ethereal before 0.10.11 allow remote attackers to cause a denial of service (assert error) via an invalid protocol tree item length.


Integer signedness error in certain older versions of the NeL library as used in Mtp-Target 1.2.2 and earlier and possibly other products allows remote attackers to cause a denial of service (memory consumption or server crash) via a negative value in a STLport call which is not caught by a signed comparison.


Unknown vulnerability in WebMail in Kerio MailServer before 6.0.9 allows remote attackers to cause a denial of service (CPU consumption) via certain e-mail messages.


Microsoft Internet Explorer 6 SP2 allows remote attackers to cause a denial of service (infinite loop and application crash) via two embedded files that call each other.


The mmap function in the Linux Kernel 2.6.10 can be used to create memory maps with a start address beyond the end address which allows local users to cause a denial of service (kernel crash).


Unknown vulnerability in Incoming Remote Command (iSeries Access for Windows Remote Command service) in IBM OS/400 R510 R520 and R530 allows attackers to cause a denial of service (IRC shutdown) via certain inputs.


The XWD Decoder in ImageMagick before 6.2.2.3 and GraphicsMagick before 1.1.6-r1 allows remote attackers to cause a denial of service (infinite loop) via an image with a zero color mask.


The rsvp_print function in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted RSVP packet of length 4.


The ENSURE_BITS macro in mszipd.c for Clam AntiVirus (ClamAV) 0.83 and other versions vefore 0.86 allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a cabinet (CAB) file with the cffile_FolderOffset field set to 0xff which causes a zero-length read.


Gaim before 1.3.1 allows remote attackers to cause a denial of service (application crash) via a Yahoo! message with non-ASCII characters in a file name.


Multiple Symantec AntiVirus products including Norton AntiVirus 2005 11.0.0 Web Security Web Security 3.0.1.72 Mail Security for SMTP 4.0.5.66 AntiVirus Scan Engine 4.3.7.27 SAV/Filter for Domino NT 3.1.1.87 and Mail Security for Exchange 4.5.4.743 when running on Windows allows remote attackers to cause a denial of service (component crash) and avoid detection via a crafted RAR file.


Multiple unknown vulnerabilities in the (1) WSP (2) BER (3) SMB (4) NDPS (5) IAX2 (6) RADIUS (7) TCAP (8) MRDISC (9) 802.3 Slow (10) SMBMailslot or (11) SMB PIPE dissectors in Ethereal before 0.10.11 allow remote attackers to cause a denial of service (assert error).


The IPv6 support in Windows XP SP2 2003 Server SP1 and Longhorn with Windows Firewall turned off allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet with the SYN flag set and the same destination and source address and port a variant of CVE-2005-0688 and a reoccurrence of the \Land\ vulnerability (CVE-1999-0016).


Multiple unknown vulnerabilities in the (1) WSP (2) Q.931 (3) H.245 (4) KINK (5) MGCP (6) RPC (7) SMBMailslot and (8) SMB NETLOGON dissectors in Ethereal before 0.10.11 allow remote attackers to cause a denial of service (crash) via unknown vectors that lead to a null dereference.


User32.DLL in Microsoft Windows 98SE and possibly other operating systems allows local and remote attackers to cause a denial of service (crash) via an icon (.ico) bitmap file with large width and height values.


Firefly Studios Stronghold 2 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a packet with a large size value for the nickname which causes a memory allocation failure and generates an exception.


AOL Instant Messenger 5.5.x and earlier allows remote attackers to cause a denial of service (client crash) via an invalid smiley icon location in the sml parameter of a font tag.


FreeBSD 5.x to 5.4 on AMD64 does not properly initialize the IO permission bitmap used to allow user access to certain hardware which allows local users to bypass intended access restrictions to cause a denial of service obtain sensitive information and possibly gain privileges.


The ptrace call in the Linux kernel 2.6.8.1 and 2.6.10 for the AMD64 platform allows local users to cause a denial of service (kernel crash) via a \non-canonical\ address.


Nokia 7610 and 3210 phones allows attackers to cause a denial of service via certain characters in the filename of a Bluetooth OBEX transfer.


The OLE2 unpacker in clamd in Clam AntiVirus (ClamAV) 0.87-1 allows remote attackers to cause a denial of service (segmentation fault) via a DOC file with an invalid property tree which triggers an infinite recursion in the ole2_walk_property_tree function.


The sys_set_mempolicy function in mempolicy.c in Linux kernel 2.6.x allows local users to cause a denial of service (kernel BUG()) via a negative first argument.


Apple Safari allows remote attackers to cause a denial of service (application crash) via a crafted data:// URL.


The Internet Key Exchange version 1 (IKEv1) implementation (isakmp_agg.c) in racoon in ipsec-tools before 0.6.3 when running in aggressive mode allows remote attackers to cause a denial of service (null dereference and crash) via crafted IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.


Multiple unspecified vulnerabilities in multiple unspecified implementations of Internet Key Exchange version 1 (IKEv1) have multiple unspecified attack vectors and impacts related to denial of service as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of information in the original sources it is likely that this candidate will be REJECTed once it is known which implementations are actually vulnerable. In addition since \denial of service\ is an impact and not a vulnerability it is unknown which underlying vulnerabilities are actually covered by this particular candidate.


Compuware DriverStudio Remote Control service (DSRsvc.exe) 2.7 and 3.0 beta 2 allows remote attackers to cause a denial of service (reboot) via a UDP packet sent directly to port 9110.


INSO service in IBM DB2 Content Manager before 8.2 Fix Pack 10 on AIX allows attackers to cause a denial of service (application crash) via unknown attack vectors involving LZH files.


The atm module in Linux kernel 2.6 before 2.6.14 allows local users to cause a denial of service (panic) via certain socket calls that produce inconsistent reference counts for loadable protocol modules.


IMAP service (meimaps.exe) of MailEnable Professional 1.7 and Enterprise 1.1 allows remote authenticated attackers to cause a denial of service (application crash) by using RENAME with a non-existent mailbox a different vulnerability than CVE-2005-3690.


The SigComp UDVM in Ethereal 0.10.12 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.


httpAdapter.c in sblim-sfcb before 0.9.2 allows remote attackers to cause a denial of service (resource consumption) by connecting to sblim-sfcb but not sending any data.


Macromedia Flash Communication Server MX 1.0 and 1.5 does not sufficiently validate certain RTMP data which allows attackers to cause a denial of service (instability or crash) as demonstrated using an alpha release build of Flash Player 8.5 (build 133).


The Internet Key Exchange version 1 (IKEv1) implementation in Check Point products allows remote attackers to cause a denial of service via certain crafted IKE packets as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory it is unclear which of CVE-2005-3666 CVE-2005-3667 and/or CVE-2005-3668 this issue applies to.


The auto-reap of child processes in Linux kernel 2.6 before 2.6.15 includes processes with ptrace attached which leads to a dangling ptrace reference and allows local users to cause a denial of service (crash) and gain root privileges.


Memory leak in the VFS file lease handling in locks.c in Linux kernels 2.6.10 to 2.6.15 allows local users to cause a denial of service (memory exhaustion) via certain Samba activities that cause an fasync entry to be re-allocated by the fcntl_setlease function after the fasync queue has already been cleaned by the locks_delete_lock function.


Serv-U FTP Server before 6.1.0.4 allows attackers to cause a denial of service (crash) via (1) malformed packets and possibly other unspecified issues with unknown impact and attack vectors including (2) use of \~\ in a pathname and (3) memory consumption of the daemon. NOTE: it is not clear whether items (2) and above are vulnerabilities.


Cerulean Studios Trillian 3.0 allows remote attackers to cause a denial of service (crash) via a reverse direct connection from a different client as demonstrated using LICQ.


Memory leak in Gadu-Gadu 7.20 allows remote attackers to cause a denial of service via multiple DCC packets with a code other than 2 and a large size field which allocates memory for the packet but does not free it after the packet has been dropped.