Unknown vulnerability in Network Appliance NetCache 5.2 and Data ONTAP 6.0 allows remote attackers to cause a denial of service (panic and reboot) and possibly other impacts via unknown attack vectors possibly related to unspecified worms as identified by bug ID


The PerfectNav plugin for Microsoft Internet Explorer allows remote attackers to cause a denial of service (browser crash) via a malformed URL such as \?\.


The XML parser in Oracle 9i Application Server Release 2 9.0.3.0 and 9.0.3.1 9.0.2.3 and earlier and Release 1 1.0.2.2 and 1.0.2.2.2 and Database Server Release 2 9.2.0.1 and later allows remote attackers to cause a denial of service (CPU and memory consumption) via a SOAP message containing a crafted DTD.


Unspecified vulnerability in SharedX in HP-UX B.11.00 B.11.11 and B.11.22 allows local users to access unspecified files or cause a denial of service via unknown vectors related to handling of \files in a potentially insecure manner.\


The server in IBM Tivoli Storage Manager (TSM) 4.2.x on MVS 5.1.9.x before 5.1.9.1 5.1.x before 5.1.10 5.2.2.x before 5.2.2.3 5.2.x before 5.2.3 5.3.x before 5.3.0 and 6.x before 6.1 when the HTTP communication method is enabled allows remote attackers to cause a denial of service (daemon crash or hang) via unspecified HTTP traffic as demonstrated by the IBM port scanner 1.3.1.


Secure Computing Corporation Sidewinder G2 6.1.0.01 might allow remote attackers to cause a denial of service (proxy failure) via invalid traffic to the (1) T.120 or (2) RTSP proxy or (3) invalid MIME messages to the mail filter. NOTE: this might not be a vulnerability because the embedded monitoring sub-system automatically restarts after the failure.


Axis Network Camera 2.40 and earlier and Video Server 3.12 and earlier allows remote attackers to obtain sensitive information via direct requests to (1) admin/getparam.cgi (2) admin/systemlog.cgi (3) admin/serverreport.cgi and (4) admin/paramlist.cgi modify system information via (5) setparam.cgi and (6) factorydefault.cgi or (7) cause a denial of service (reboot) via restart.cgi.


SMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous open connections to TCP port 25.


Mail server in Gattaca Server 2003 1.1.10.0 allows remote attackers to perform a denial of service (application crash) via a large number of connections to TCP port (1) 25 (SMTP) or (2) 110 (POP).


Mbedthis AppWeb HTTP server before 1.0.2 allows remote attackers to cause a denial of service (crash) via an empty OPTIONS request.


Unspecified vulnerability in 3Com SuperStack 3 4400 switches with firmware version before 3.31 allows remote attackers to cause a denial of service (device reset) via a crafted request to the web management interface. NOTE: the provenance of this information is unknown; details are obtained from third party reports.


Memory leak in direct-io.c in Linux kernel 2.6.x before 2.6.10 allows local users to cause a denial of service (memory consumption) via certain O_DIRECT (direct IO) write requests.


Alcatel OmniSwitch 7000 and 7800 allows remote attackers to cause a denial of service (reboot) via certain network scans as demonstrated using a Nessus port scan of ports 1 through 1024 with safe-checks disabled.


Multiple SQL injection vulnerabilities in Dynix (formerly known as epixtech) WebPAC allow remote attackers to execute arbitrary SQL commands via unknown attack vectors resulting in an ability to execute stored procedures bypass login authentication and cause an unspecified denial of service to backend databases.


POP3 protocol in Gattaca Server 2003 1.1.10.0 allows remote authenticated users to cause a denial of service (application crash) via a large numeric value in the (1) LIST (2) RETR or (3) UIDL commands.


NWFTPD.nlm before 5.04.25 in the FTP server in Novell NetWare does not promptly close DS sessions which allows remote attackers to cause a denial of service (connection slot exhaustion) by establishing many FTP sessions that persist for the lifetime of a DS session.


Multiple features in Ipswitch IMail Server before 8.13 allow remote attackers to cause a denial of service (crash) via (1) a long sender field to the Queue Manager or (2) a long To field to the Web Messaging component.


Matrix FTP Server allows remote attackers to cause a denial of service (crash) by logging in using four spaces as the username and password and then issuing a LIST command.


Unknown vulnerability in SGI IRIX 6.5 through 6.5.22m allows remote attackers to cause a denial of service via a certain UDP packet.


FsPHPGallery before 1.2 allows remote attackers to cause a denial of service via an image with a large size attribute which causes a crash when the server attempts to resize the image.


Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function which prevents a lock from being released and causes a memory leak.


vsftpd before 1.2.2 when under heavy load allows attackers to cause a denial of service (crash) via a SIGCHLD signal during a malloc or free call which is not re-entrant.


Orenosv 0.5.9f allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.


The HTTP administration interface on Conceptronic CADSLR1 ADSL router running firmware 3.04n allows remote attackers to cause a denial of service (device reboot) via an HTTP request with a long username.


Gattaca Server 2003 1.1.10.0 allows remote attackers to cause a denial of service (CPU consumption) via directory specifiers in the LANGUAGE parameter to (1) index.tmpl and (2) web.tmpl such as (a) slash \/\ (b) backslash \\\\ (c) dot \.\ (d) dot dot \..\ and (e) internal slash \lang//en\.


Quake II server before R1Q2 as used in multiple products allows remote attackers to cause a denial of service (application crash) via a modified client that asks the server to send data stored at a negative array offset which is not handled when processing Configstrings and Baselines.


ArGoSoft FTP Server before 1.4.1.6 allows remote authenticated users to cause a denial of service (crash) via a SITE PASS command with a long password parameter which causes the database to be corrupted.


The administrative interface (surgeftpmgr.cgi) for SurgeFTP Server 1.0b through 2.2k1 allows remote attackers to cause a temporary denial of service (crash) via requests with two percent (%) signs in the CMD parameter.


LionMax Software Chat Anywhere 2.72a allows remote attackers to cause a denial of service (server crash and client CPU consumption) via a username beginning with percent (%) followed by a null character.


Macromedia ColdFusion MX before 6.1 does not restrict the size of error messages which allows remote attackers to cause a denial of service (memory consumption and crash) by sending repeated GET or POST requests that trigger error messages that use long strings of data.


Fastream NETFile Server 7.1.2 does not properly handle keep-alive connection timeouts and does not close the connection after a HEAD request which allows remote attackers to perform a denial of service (connection consumption) by sending a large number HTTP HEAD requests.


fetchnews in leafnode 1.9.47 and earlier allows remote attackers to cause a denial of service (process hang) via an empty NNTP news article with missing mandatory headers.


Unknown versions of Symantec Norton AntiVirus and Microsoft Outlook allow attackers to cause a denial of service (crash) via malformed e-mail messages (1) without a body or (2) without a carriage return (\\\n\) separating the headers from the body.


The samiftp.dll library in Sami FTP Server 1.1.3 allows local users to cause a denial of service (pmsystem.exe crash) by issuing (1) a CD command with a tilde (~) character or dot dot (/../) or (2) a GET command for an unavailable file.


Quake II server before R1Q2 as used in multiple products allows remote attackers to cause a denial of service (exhaustion of connection slots) via a large number of connections from the same IP address.


Davenport before 0.9.10 allows attackers to cause a denial of service (resource consumption) via (1) a very large XML file or (2) entity expansion attacks.


HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) via HTTP requests with a large Content-Length.


readObject in (1) Java Runtime Environment (JRE) and (2) Software Development Kit (SDK) 1.4.0 through 1.4.2_05 allows remote attackers to cause a denial of service (JVM unresponsive) via crafted serialized data.


BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service (network port consumption) via unknown actions in HTTPS sessions which prevents the server from releasing the network port when the session ends.


Secure Computing Corporation Sidewinder G2 6.1.0.01 allows remote attackers to cause a denial of service (CPU consumption) via delayed responses to DNS queries.


Chatman 1.1.1 RC1 and earlier allows remote attackers to cause a denial of service (memory consumption or application crash) via a very large data size.


Hitachi Job Management Partner (JP1) JP1/File Transmission Server/FTP 6 and 7 allows remote attackers to cause a denial of service (daemon halt) via a port scan involving reset packets.


Vizer Web Server 1.9.1 allows remote attackers to cause a denial of service (crash) via multiple malformed requests including (1) requests without GET (2) GET requests without HTTP (3) or long GET requests.


The Util_DecodeHTTPAuth function in BNBT BitTorrent Tracker Beta 7.5 Release 2 and earlier allows remote attackers to cause a denial of service (crash) via a Basic Authorization HTTP request with a \A==\ value.


The DecodeTCPOptions function in decode.c in Snort before 2.3.0 when printing TCP/IP options using FAST output or verbose mode allows remote attackers to cause a denial of service (crash) via packets with invalid TCP/IP options which trigger a null dereference.


Unknown multiple vulnerabilities in Oracle9i Database Server 9.0.1.4 9.0.1.5 9.2.0.3 and 9.2.0.4 allow local users with the ability to invoke SQL to cause a denial of service or obtain sensitive information.


shoprestoreorder.asp in VP-ASP 5.0 does not close the database connection when a user restores a previous order which allows remote attackers to cause a denial of service (connection consumption).


Jabber Gadu-Gadu Transport (a.k.a. jabber-gg-transport) 2.0.x before 2.0.8 allows remote attackers to cause a denial of service a message with an empty <priority/> tag.


@Mail 3.64 for Windows allows remote attackers to cause a denial of service (\unusable\ server) via a large number of POP3 connections to the server.


The HTTP daemon in OpenText FirstClass 7.1 and 8.0 allows remote attackers to cause a denial of service (service availability loss) via a large number of POST requests to /Search.


Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (browser crash) via a link with \::{\ (colon colon left brace) which triggers a null dereference when the user attempts to save the link using \Save As\ and Internet Explorer prepares an error message with an attacker-controlled format string.


Multiple unspecified vulnerabilities in the H.323 protocol implementation for Sun SunForum 3.2 and 3D 1.0 allow remote attackers to cause a denial of service (segmentation fault and process crash) as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.


** DISPUTED ** Zone Alarm Pro 1.0 through 5.1 gives full access to %windir%\\Internet Logs\\* to the EVERYONE group which allows local users to cause a denial of service by modifying the folder contents or permissions. NOTE: this issue has been disputed by the vendor who claims that it does not affect product functionality since the same information is also saved in a protected file.


Targem Battle Mages 1.0 allows remote attackers to cause a denial of service (infinite loop) via a UDP packet with incomplete data which causes the server to enter an infinite loop while waiting to read the rest of the data that is not sent.


Unknown vulnerability in Jabber Gadu-Gadu Transport (a.k.a. jabber-gg-transport) 2.0.x before 2.0.8 allows remote attackers to cause a denial of service (infinite loop) via user re-registration.


The Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large out-of-range score parameter.


chat.ghp in Easy Chat Server 1.2 allows remote attackers to add a large number of fake users then eventually cause a denial of service (server crash).


INweb Mail Server 2.40 allows remote attackers to cause a denial of service (crash) via a large number of connect/disconnect actions to the (1) POP3 and (2) SMTP services.


The addUser function in UserManager.java in Free Web Chat 2.0 allows remote attackers to cause a denial of service (uncaught NullPointerException) via unknown attack vectors that cause the usrName variable to be null.


Memory leak in passwd 0.68 allows local users to cause a denial of service (memory consumption) via a large number of failed read attempts from the password buffer.


HTTPMail service in MailEnable Professional 1.18 does not properly handle arguments to the Authorization header which allows remote attackers to cause a denial of service (null dereference and application crash). NOTE: This is a different vulnerability than CVE-2005-1348.


Nadeo Game Engine for Nadeo TrackMania and Nadeo Virtual Skipper 3 allows remote attackers to cause a denial of service (server crash) via malformed data to TCP port 2350 possibly due to long values or incorrect size fields.


The roster import functionality in Jabber Gadu-Gadu Transport (a.k.a. jabber-gg-transport) 2.0.x before 2.0.8 when using libgadu 1.0 and later allows attackers to cause a denial of service via unknown vectors.


Gaim before 0.82 allows remote servers to cause a denial of service (application crash) via a long HTTP Content-Length header which causes Gaim to abort when attempting to allocate memory.


Sybari AntiGen for Domino 7.0 Build 722 SR2 allows remote attackers to cause a denial of service (hang) via an encrypted ZIP file with the \include full path info\ option set as used by certain variants of the Beagle/Bagle worm.


Application Access Server (A-A-S) 1.0.37 and earlier allows remote authenticated users to cause a denial of service (application crash) via a long file request.


Unknown vulnerability in APC PowerChute Business Edition 6.0 through 7.0.1 allows remote attackers to cause a denial of service via unknown attack vectors.


Unspecified vulnerability in 3Com OfficeConnect ADSL 11g Router allows remote attackers to cause a denial of service (crash) via a large amount of UDP traffic.


Free Web Chat 2.0 allows remote attackers to cause a denial of service (CPU consumption) via multiple connections from the same user.


Microsoft Internet Explorer 6.0.2600 on Windows XP allows remote attackers to cause a denial of service (browser crash) via a shell: URI with double backslashes (\\\\) in an HTML tag such as IFRAME or A.


Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via malformed HTTP requests such as (1) a GET request without the HTTP version (HTTP/1.1) or (2) a request without GET or the HTTP version.


msxml3.dll in Internet Explorer 6.0.2600.0 allows remote attackers to cause a denial of service (crash) via a single & (ampersand) in a <Ref href> link which triggers a parsing error possibly due to missing portions of the URI.


The samiftp.dll library in Sami FTP Server 1.1.3 allows remote authenticated users to cause a denial of service (pmsystem.exe crash) via a GET request wit a large number of leading \/\ (slash) characters.


Memory leak in Microsoft Windows XP and Windows Server 2003 allows local users to cause a denial of service (memory exhaustion) by repeatedly creating and deleting directories using a non-standard tool such as smbmount.


Absolute path traversal vulnerability in Quake II server before R1Q2 on Linux as used in multiple products allows remote attackers to cause a denial of service (application crash) via a download command with a full pathname for a directory in the argument which causes the server to crash when it cannot read data.


Multiple Red Storm web-based games including Ghost Recon 1.4 and earlier Desert Siege and The Sum of all Fears 1.1.1.0 and earlier do not properly check return values from certain functions which allows remote attackers to cause a denial of service (hang) via packets that contain text strings with incorrect size values.


Novell iChain 2.3 allows attackers to cause a denial of service via a URL with a \specific string.\


Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (infinite loop and crash) via an IFRAME with \?\ as the file source.


Secure Computing Corporation Sidewinder G2 6.1.0.01 allows remote attackers to cause a denial of service (SMTP proxy failure) via unknown attack vendors involving an \extremely busy network.\ NOTE: this might not be a vulnerability because the embedded monitoring sub-system automatically restarts after the failure.


Kerio WinRoute Firewall before 6.0.9 uses information from PTR queries in response to A queries which allows remote attackers to poison the DNS cache or cause a denial of service (connection loss).


MailEnable Professional Edition before 1.53 and Enterprise Edition before 1.02 allows remote attackers to cause a denial of service (crash) via malformed (1) SMTP or (2) IMAP commands.


NullSoft Winamp 5.02 allows remote attackers to cause a denial of service (crash) by creating a file with a long filename which causes the victim's player to crash when the file is opened from the command line.


Agnitum Outpost Pro Firewall 2.1 allows remote attackers to cause a denial of service (CPU consumption) via a flood of small invalid packets which can not be processed quickly enough by Outpost Pro.


Lords of the Realm III 1.01 and earlier when in the lobby stage allows remote attackers to cause a denial of service (crash from unallocated memory write) via a long user nickname.


Linux VServer 1.27 and earlier 1.3.9 and earlier and 1.9.1 and earlier shares /proc permissions across all virtual and host servers which allows local users with the ability to set permissions in /proc to obtain system information or cause a denial of service on other virtual servers or the host server.


The local and remote desktop login screens in Microsoft Windows XP before SP2 and 2003 allow remote attackers to cause a denial of service (CPU and memory consumption) by repeatedly using the WinKey+\U\ key combination which causes multiple copies of Windows Utility Manager to be loaded more quickly than they can be closed when the copies detect that another instance is running.


Soft3304 04WebServer before 1.41 allows remote attackers to cause a denial of service (resource consumption or crash) via certain data related to OpenSSL which causes a thread to terminate but continue to hold resources.


Unspecified vulnerability in Gyach Enhanced (Gyach-E) before 1.0.4 allows remote attackers to cause a denial of service (crash) via conference packets with error messages.


Multiple vulnerabilities in the H.323 protocol implementation for First Virtual Communications Click to Meet Express (when used with H.323 conferencing endpoints) Click to Meet Premier Conference Server and V-Gate allow remote attackers to cause a denial of service as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.


The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation which allows attackers to obtain the MySQL administrative password in cleartext from an installation form or to cause a denial of service by changing database settings to the default.


Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors.


Mozilla Firefox before 0.10 Mozilla 5.0 and Gecko 20040913 allows remote attackers to cause a denial of service (application crash or memory consumption) via a large binary file with a .html extension.


WS_FTP 5.0.2 allows remote authenticated users to cause a denial of service (CPU consumption) via a CD command that contains an invalid path with a \../\ sequence.


Unknown vulnerability in in.named on Solaris 8 allows remote attackers to cause a denial of service (process crash).


Multiple versions of Cisco ONS 15327 ONS 15454 and ONS 15454 SDH including 4.6(0) and 4.6(1) 4.5(x) 4.1(0) to 4.1(3) 4.0(0) to 4.0(2) and earlier versions allows remote attackers to cause a denial of service (control card reset) via a large number of TCP connections with an invalid response instead of the final ACK (TCP-ACK).


MaxDB WebTools 7.5.00.18 and earlier allows remote attackers to cause a denial of service (application crash) via an HTTP GET request for a file that does not exist followed by two carriage returns which causes a NULL dereference.


Music daemon (musicd) 0.0.3 and earlier allows remote attackers to cause a denial of service (crash) by calling LOAD with a binary file as an argument then calling SHOWLIST.


pGina 1.7.6 and possibly older versions when the Restart or Shutdown options are enabled on the login screen allows remote attackers to cause a denial of service by connecting via Remote Desktop and clicking restart or shutdown.


The Telnet proxy in 602 Lan Suite 2004.0.04.0909 and earlier allows remote attackers to cause a denial of service (socket exhaustion) via a Telnet request to an IP address of the proxy's network interface which causes a loop.


The character converters in the Spamhunter and Language ID modules for Symantec Brightmail AntiSpam 6.0.1 before patch 132 allow remote attackers to cause a denial of service (crash) via messages with the ISO-8859-10 character set which is not recognized by the converters.


load_elf_binary in Linux before 2.4.26 allows local users to cause a denial of service (system crash) via an ELF binary in which the interpreter is NULL.


Microsoft Internet Explorer allows remote attackers to cause a denial of service (application crash from memory consumption) as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.


Unknown vulnerability in ftpd in SGI IRIX 6.5.20 through 6.5.23 allows remote attackers to cause a denial of service (hang) via a link failure with Microsoft Windows.


Ethereal 0.9.0 through 0.10.7 allows remote attackers to cause a denial of service (application hang) and possibly fill available disk space via an invalid RTP timestamp.


Flash Messaging 5.2.0g (rev 1.1.2) and earlier allows remote attackers to cause a denial of service (application crash) via certain wide characters.


Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service by causing mc to free unallocated memory.


The arch_get_unmapped_area function in mmap.c in the PaX patches for Linux kernel 2.6 when Address Space Layout Randomization (ASLR) is enabled allows local users to cause a denial of service (infinite loop) via unknown attack vectors.


Vypress Tonecast 1.3 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed mp2 stream.


Symantec Enterprise Firewall/VPN Appliances 100 200 and 200R running firmware before 1.63 allow remote attackers to cause a denial of service (device freeze) via a fast UDP port scan on the WAN interface.


Direct Rendering Manager (DRM) driver in Linux kernel 2.6 does not properly check the DMA lock which could allow remote attackers or local users to cause a denial of service (X Server crash) and possibly modify the video output.


The TNS Listener in Oracle 10g allows remote attackers to cause a denial of service (listener crash) via a malformed service_register_NSGR request containing a value that is used as an invalid offset for a pointer that references incorrect memory.


Ground Control II: Operation Exodus 1.0.0.7 and earlier allows remote servers to cause a denial of service (client or server crash) via a large packet which generates a \Message too long\ socket error that is treated as a critical error.


Gadu-Gadu 6.1 build 156 allows remote attackers to cause a denial of service (application hang) via a message that contains many special strings that are converted to images.


The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransaction function which leads to a failed malloc call and triggers to a null dereference which allows remote attackers to cause a denial of service (crash).


Gadu-Gadu build 155 and earlier allows remote attackers to cause a denial of service (infinite loop) via a message that contains an image whose filename does not start with restricted characters.


Claim Anti-Virus (ClamAV) 0.68 and earlier allows remote attackers to cause a denial of service (crash) via certain RAR archives such as those generated by the Beagle/Bagle worm.


DiGi Web Server allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request that contains a large number of / (slash) characters which consumes resources when DiGi converts the slashes to \\ (backslash) characters.


Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a join request that contains a memory address that causes the server to read arbitrary memory.


Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service via \use of already freed memory.\


Engenio/LSI Logic storage controllers as used in products such as Storagetek D280 and IBM DS4100 (formerly FastT 100) and Brocade SilkWorm Switches allow remote attackers to cause a denial of service (freeze and possible data corruption) via crafted TCP packets.


The lock manager in Cisco CNS Network Registrar 6.0 through 6.1.1.3 allows remote attackers to cause a denial of service (process crash) via a certain \unexpected packet sequence.\


Multiple drivers in Linux kernel 2.4.19 and earlier do not properly mark memory with the VM_IO flag which causes incorrect reference counts and may lead to a denial of service (kernel panic) when accessing freed kernel pages.


HP Web Jetadmin 7.5.2546 allows remote attackers to cause a denial of service (crash) via a malformed request possibly due to a stricmp() error from an invalid use of the \$\ character.


3com NBX IP VOIP NetSet Configuration Manager allows remote attackers to cause a denial of service (crash) via a Nessus scan in safeChecks mode.


Unknown vulnerability in Ethereal 0.8.13 to 0.10.2 allows attackers to cause a denial of service (segmentation fault) via a malformed color filter file.


A bug in the HTML parser in a certain Microsoft HTML library as used in various third party products may allow remote attackers to cause a denial of service via certain strings as reported in GFI MailEssentials for Exchange 9 and 10 and GFI MailSecurity for Exchange 8 which causes emails to remain in IIS or Exchange mail queues.


Multiple syscalls in the compat subsystem for NetBSD before 2.0 allow local users to cause a denial of service (kernel crash) via a large signal number to (1) xxx_sys_kill (2) xxx_sys_sigaction and possibly other translation functions.


The cmdline pseudofiles in (1) procfs on FreeBSD 4.8 through 5.3 and (2) linprocfs on FreeBSD 5.x through 5.3 do not properly validate a process argument vector which allows local users to cause a denial of service (panic) or read portions of kernel memory. NOTE: this candidate might be SPLIT into 2 separate items in the future.


EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to cause a denial of service (application crash) via a sequence of carriage returns sent to TCP port 66.


Etherlords I 1.07 and earlier and Etherlords II 1.03 and earlier allows remote attackers to cause a denial of service (crash) by sending a packet that specifies the size for the next packet then sending a larger packet than specified which causes Etherlords to read unallocated memory.


Unknown vulnerability in ScreenOS in Juniper Networks NetScreen firewall 3.x through 5.x allows remote attackers to cause a denial of service (device reboot or hang) via a crafted SSH v1 packet.


Multiple integer signedness errors in (1) imapcommon.c (2) main.c (3) request.c and (4) select.c for up-imapproxy IMAP proxy 1.2.2 allow remote attackers to cause a denial of service (server crash) and possibly leak sensitive information via certain literal values that are not properly handled when using the IMAP_Line_Read function.


NtRegmon before 6.12 allows local users to cause a denial of service (crash) while NtRegmon is running via invalid pointers to hook functions such as ZwSetQueryValue.


The Lithtech engine as used in (1) Contract Jack 1.1 and earlier (2) No one lives forever 2 1.3 and earlier (3) Tron 2.0 1.042 and earlier (4) F.E.A.R. (First Encounter Assault and Recon) and possibly other games allows remote attackers to cause a denial of service (connection refused) via a UDP packet that causes recvfrom to generate a return code that causes the listening loop to exit as demonstrated using zero byte packets or packets between 8193 and 12280 bytes which result in conditions that are not \Operation would block.\


The NFS mountd service on SCO UnixWare 7.1.1 7.1.3 7.1.4 and 7.0.1 and possibly other versions when run from inetd allows remote attackers to cause a denial of service (memory exhaustion) via a series of requests which causes inetd to launch a separate process for each request.


The hash_strcmp function in hasch.c in Crackalaka 1.0.8 allows remote attackers to cause a denial of service (crash) via large malformed strings.


Easy File Sharing (EFS) Webserver 1.25 allows remote attackers to cause a denial of service (CPU consumption or crash) via many large HTTP requests.


Remote Execute 2.30 allows remote attackers to cause a denial of service (application crash) by making 7 simultaneous connections.


Master of Orion III 1.2.5 and earlier allows remote attackers to cause a denial of service (game exit) via a data packet that contains a large size specifier which causes a large memory allocation to fail.


Firefox and Mozilla allow remote attackers to cause a denial of service (application crash from memory consumption) as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.


direntry.c in Midnight Commander (mc) 4.5.55 and earlier allows attackers to cause a denial of service by \manipulating non-existing file handles.\


WFTPD Pro Server 3.21 allows remote authenticated users to cause a denial of service (crash) via a series of long MLIST commands.


Ipswitch WS_FTP Server 4.0.2 allows remote attackers to cause a denial of service (disk consumption) and bypass file size restrictions via a REST command with a large size argument followed by a STOR of a smaller file.


Multiple versions of Cisco ONS 15327 ONS 15454 and ONS 15454 SDH including 4.1(0) to 4.1(2) 4.5(x) 4.0(0) to 4.0(2) and earlier versions allows remote attackers to cause a denial of service (control card reset) via malformed SNMP packets.


Unknown vulnerability in ftpd in SGI IRIX 6.5.20 through 6.5.23 allows remote attackers to cause a denial of service (hang) via the PORT mode.


The expat XML parser code as used in the open source Jabber (jabberd) 1.4.3 and earlier jadc2s 0.9.0 and earlier and possibly other packages allows remote attackers to cause a denial of service (application crash) via a malformed packet to a socket that accepts XML connections.


The Rage 1.01 and earlier allows remote attackers to cause a denial of service (infinite loop) via a TCP packet with the port and IP address set to zero.


statd in nfs-utils 1.257 and earlier does not ignore the SIGPIPE signal which allows remote attackers to cause a denial of service (server process crash) via a TCP connection that is prematurely terminated.


Safari 1.2.4 on Mac OS X 10.3.6 allows remote attackers to cause a denial of service (application crash from memory exhaustion) as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.


ascontrol.dll in Panda ActiveScan 5.0 allows remote attackers to cause a denial of service (crash) by calling the SetSitesFile function.


The HTTP dissector in Ethereal 0.10.1 through 0.10.7 allows remote attackers to cause a denial of service (application crash) via a certain packet that causes the dissector to access previously-freed memory.


The CSAdmin web administration interface for Cisco Secure Access Control Server (ACS) 3.2(2) build 15 allows remote attackers to cause a denial of service (hang) via a flood of TCP connections to port 2002.


Multiple TCP/IP and ICMP implementations when using Path MTU (PMTU) discovery (PMTUD) allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP (\Fragmentation Needed and Don't Fragment was Set\) packets with a low next-hop MTU value aka the \Path MTU discovery attack.\ NOTE: CVE-2004-0790 CVE-2004-0791 and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065 CVE-2005-0066 CVE-2005-0067 and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.


Unknown vulnerability in ColdFusion MX 6.0 and 6.1 and JRun 4.0 when a SOAP web service expects an array of objects as an argument allows remote attackers to cause a denial of service (memory consumption).


Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service by triggering a null dereference.


Pigeon Server 3.02.0143 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a long login name sent to port 3103.


Hired Team: Trial 2.0 and earlier and 2.200 allows remote attackers to cause a denial of service (game interruption) via a malformed UDP packet sent to a game port such as port 29200.


Integer underflow in pppd in cbcp.c for ppp 2.4.1 allows remote attackers to cause a denial of service (daemon crash) via a CBCP packet with an invalid length value that causes pppd to access an incorrect memory location.


Microsoft Internet Explorer 5.5 and 6.0 allocates memory based on the memory size written in the BMP file instead of the actual BMP file size which allows remote attackers to cause a denial of service (memory consumption) via a small BMP file with has a large memory size.


X Display Manager (XDM) on Solaris 8 allows remote attackers to cause a denial of service (XDM crash) via an invalid X Display Manager Control Protocol (XDMCP) request.


Eudora 6.1 and 6.0.3 for Windows allows remote attackers to cause a denial of service (crash) via a deeply nested multipart MIME message.


swnet.dll in YaSoft Switch Off 2.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a long packet with two CRLF sequences to the service management port (TCP 8000).


The scripts that handle players in Kreed 1.05 and earlier allow remote attackers to cause a denial of service (server freeze) via a long (1) nickname or (2) model type which generates dialog boxes on the server that must be manually handled before the server continues the game.


Multiple versions of Cisco ONS 15327 ONS 15454 and ONS 15454 SDH including 4.6(0) and 4.6(1) 4.5(x) 4.1(0) to 4.1(3) 4.0(0) to 4.0(2) and earlier versions allows remote attackers to cause a denial of service (control card reset) via malformed (1) IP or (2) ICMP packets.


Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that contains a (1) TEXTAREA (2) INPUT (3) FRAMESET or (4) IMG tag followed by a null character and some trailing characters as demonstrated by mangleme.


A \range check error\ in Skype for Windows before 0.98.0.28 allows local and remote attackers to cause a denial of service (application crash) via long command line arguments or a long callto:// URL a different vulnerability than CVE-2004-1114.


ZoneAlarm and ZoneAlarm Pro before 5.5.062 with ad-blocking enabled allows remote web sites to cause a denial of service (application instability or system hang) via certain JavaScript.


The Base64 function in PopMessenger 1.60 (before 20 Sep 2004) and earlier allows remote attackers to cause a denial of service (application crash) via invalid characters in a message which causes several alert dialogs to be displayed and leads to a crash.


Lynx lynx-ssl and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML email that contains invalid HTML including (1) a TEXTAREA tag with a large COLS value and (2) a large tag name in an element that is not terminated as demonstrated by mangleme. NOTE: a followup suggests that the relevant trigger for this issue is the large COLS value.


The binfmt functionality in the Linux kernel when \memory overcommit\ is enabled allows local users to cause a denial of service (kernel oops) via a malformed a.out binary.


The scm_send function in the scm layer for Linux kernel 2.4.x up to 2.4.28 and 2.6.x up to 2.6.9 allows local users to cause a denial of service (system hang) via crafted auxiliary messages that are passed to the sendmsg function which causes a deadlock condition.


The slip_down function in slip.c for the uml_net program in uml-utilities 20030903 when uml_net is installed setuid root does not verify whether the calling user has sufficient permission to disable an interface which allows local users to cause a denial of service (network service disabled).


The webmail service in 602 Lan Suite 2004.0.04.0909 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) by sending a POST request with a large Content-Length value then disconnecting without sending that amount of data.


The Web Filtering functionality in Kerio Personal Firewall (KPF) 4.0.13 allows remote attackers to cause a denial of service (crash) by sending hex-encoded URLs containing \%13%12%13\.


The WAV file property handler in Windows XP SP1 allows remote attackers to cause a denial of service (infinite loop in Explorer) via a WAV file with an invalid file header whose fmt chunk length is set to 0xFFFFFFFF.


wMCam server 2.1.348 allows remote attackers to cause a denial of service (no new connections) via multiple malformed HTTP requests without the GET command.


Multiple versions of Cisco ONS 15327 ONS 15454 and ONS 15454 SDH including 4.6(0) and 4.6(1) 4.5(x) 4.1(0) to 4.1(3) 4.0(0) to 4.0(2) and earlier versions and ONS 15600 1.x(x) allows remote attackers to cause a denial of service (control card reset) via malformed (1) TCP and (2) UDP packets.


The Windows Animated Cursor (ANI) capability in Windows NT Windows 2000 through SP4 Windows XP through SP1 and Windows 2003 allow remote attackers to cause a denial of service via (1) the frame number set to zero which causes an invalid memory address to be used and leads to a kernel crash or (2) the rate number set to zero which leads to resource exhaustion and hang.


nstxd in Nstx 1.1 beta3 and earlier allows remote attackers to cause a denial of service (crash) via a large packet which triggers a null dereference.


SettingsBase.php in Pinnacle ShowCenter 1.51 allows remote attackers to cause a denial of service (web interface errors) via an invalid Skin parameter.


BlackICE PC Protection and Server Protection installs (1) firewall.ini (2) blackice.ini (3) sigs.ini and (4) protect.ini with Everyone Full Control permissions which allows local users to cause a denial of service (crash) or modify configuration as demonstrated by modifying firewall.ini to contain a large firewall rule.


RIM Blackberry 7230 running RIM Blackberry OS 3.7 SP1 allows remote attackers to cause a denial of service (device reboot and possibly data corruption) via a calendar message with a long Location field which triggers a watchdog while the message is being stored.


The Repair Archive command in WinRAR 3.40 allows remote attackers to cause a denial of service (application crash) via a corrupt ZIP archive.


Bird Chat 1.61 allows remote attackers to cause a denial of service (crash) via invalid users.


Webbsyte Chat 0.9.0 allows remote attackers to cause a denial of service (crash) via a large number of connections.


Cisco IOS 2.2(18)EW 12.2(18)EWA 12.2(14)SZ 12.2(18)S 12.2(18)SE 12.2(18)SV 12.2(18)SW and other versions without the \no service dhcp\ command keep undeliverable DHCP packets in the queue instead of dropping them which allows remote attackers to cause a denial of service (dropped traffic) via multiple undeliverable DHCP packets that exceed the input queue size.


Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections) via a crafted TCP connection to the Telnet or reverse Telnet port.


Ethereal 0.9.0 through 0.10.7 allows remote attackers to cause a denial of service (CPU consumption) via a certain malformed SMB packet.


The FWDRV.SYS driver in Kerio Personal Firewall 4.1.1 and earlier allows remote attackers to cause a denial of service (CPU consumption and system freeze from infinite loop) via a (1) TCP (2) UDP or (3) ICMP packet with a zero length IP Option field.


The Serious engine as used in (1) Alpha Black Zero Intrepid Protocol 1.04 and earlier (2) Nitro family and (3) Serious Sam Second Encounter 1.07 allows remote attackers to cause a denial of service (server crash) via a large number of UDP join requests that exceeds the maximum player limit as originally reported for Alpha Black Zero.


Cisco Secure Access Control Server (ACS) 3.2 when configured as a Light Extensible Authentication Protocol (LEAP) RADIUS proxy allows remote attackers to cause a denial of service (device crash) via certain LEAP authentication requests.


Fastream NETFile FTP/Web Server 6.5.1.980 allows remote attackers to cause a denial of service via a username that does not exist.


The Web Server in DNS4Me 3.0.0.4 allows remote attackers to cause a denial of service (CPU consumption and crash) via a large amount of data.


Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service via \a corrupt section header.\


Hired Team: Trial 2.0 and earlier and 2.200 allows remote attackers to cause a denial of service (application crash) via the status command.


The Sun Solaris Volume Manager (SVM) on Solaris 9 allows local users to cause a denial of service (kernel panic) via a malformed probe request to the SVM.


The Javascript engine in Opera 7.23 allows remote attackers to cause a denial of service (crash) by creating a new Array object with a large size value then writing into that array.


Halo: Combat Evolved 1.05 and earlier allows remote game servers to cause a denial of service (client crash) via a long value in a game server reply which triggers a NULL dereference.


The ZwOpenSection function in Integrity Protection Driver (IPD) 1.4 and earlier allows local users to cause a denial of service (crash) via an invalid pointer in the \oa\ argument.


The quoted-printable decoder in bogofilter 0.17.4 to 0.92.7 allows remote attackers to cause a denial of service (application crash) via mail headers that cause a line feed (LF) to be replaced by a null byte that is written to an incorrect memory address.


Cisco CNS Network Registrar Central Configuration Management (CCM) server 6.0 through 6.1.1.3 allows remote attackers to cause a denial of service (CPU consumption) by ending a connection after sending a certain sequence of packets.


The HTTP client and server in giFT-FastTrack 0.8.6 and earlier allows remote attackers to cause a denial of service (crash) possibly via an empty search query which triggers a NULL dereference.


Multiple implementations of the DNS protocol including (1) Poslib 1.0.2-1 and earlier as used by Posadis (2) Axis Network products before firmware 3.13 and (3) Men & Mice Suite 2.2x before 2.2.3 and 3.5.x before 3.5.2 allow remote attackers to cause a denial of service (CPU and network bandwidth consumption) by triggering a communications loop via (a) DNS query packets with localhost as a spoofed source address or (b) a response packet that triggers a response packet.


CVS 1.12.x through 1.12.8 and 1.11.x through 1.11.16 does not properly handle malformed \Entry\ lines which prevents a NULL terminator from being used and may lead to a denial of service (crash) modification of critical program data or arbitrary code execution.


The char_buffer_read function in the mod_ssl module for Apache 2.x when using reverse proxying to an SSL server allows remote attackers to cause a denial of service (segmentation fault).


Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via a blind throughput-reduction attack using spoofed Source Quench packets aka the \ICMP Source Quench attack.\ NOTE: CVE-2004-0790 CVE-2004-0791 and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065 CVE-2005-0066 CVE-2005-0067 and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.


The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition with DHCP logging enabled does not properly validate the length of certain messages which allows remote attackers to cause a denial of service (application crash) via a malformed DHCP message aka \Logging Vulnerability.\


Unknown vulnerability in mod_python 2.7.9 allows remote attackers to cause a denial of service (httpd crash) via a certain query string a variant of CAN-2003-0973.


Microsoft Outlook Express 5.5 and 6 allows attackers to cause a denial of service (application crash) via a malformed e-mail header.


The GIF parser in the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) via a malformed image file that triggers a null dereference a different vulnerability than CVE-2004-0692.


The mapelf32exec function call in IRIX 6.5.20 through 6.5.24 allows local users to cause a denial of service (system crash) via a \corrupted binary.\


The kernel for Microsoft Windows Server 2003 does not reset certain values in CPU data structures which allows local users to cause a denial of service (system crash) via a malicious program.


SYMNDIS.SYS in Symantec Norton Internet Security 2003 and 2004 Norton Personal Firewall 2003 and 2004 Client Firewall 5.01 and 5.1.1 and Client Security 1.0 and 1.1 allow remote attackers to cause a denial of service (infinite loop) via a TCP packet with (1) SACK option or (2) Alternate Checksum Data option followed by a length of zero.


rpc.mountd in nfs-utils after 1.0.3 and before 1.0.6 allows attackers to cause a denial of service (crash) via an NFS mount of a directory from a client whose reverse DNS lookup name is different from the forward lookup name.


Crob FTP daemon 3.5.2 allows remote attackers to cause a denial of service (crash) by repeatedly connecting to and disconnecting from the server.


FreeBSD 5.1 for the Alpha processor allows local users to cause a denial of service (crash) via an execve system call with an unaligned memory address as an argument.


The CGI module in Ruby 1.6 before 1.6.8 and 1.8 before 1.8.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certain HTTP request.


isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service via an ISAKMP packet with a malformed Cert Request payload which causes an integer underflow that is used in a malloc operation that is not properly handled as demonstrated by the Striker ISAKMP Protocol Test Suite.


QuickTime Streaming Server in MacOS X 10.2.8 and 10.3.2 allows remote attackers to cause a denial of service (crash) via DESCRIBE requests with long User-Agent fields which causes an Assert error to be triggered in the BufferIsFull function.


Cisco IOS 11.1(x) through 11.3(x) and 12.0(x) through 12.2(x) when configured for BGP routing allows remote attackers to cause a denial of service (device reload) via malformed BGP (1) OPEN or (2) UPDATE messages.


Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.


FreeBSD 5.1 and earlier and Mac OS X before 10.3.4 allows remote attackers to cause a denial of service (resource exhaustion of memory buffers and system crash) via a large number of out-of-sequence TCP packets which prevents the operating system from creating new connections.


The Javascript engine in Safari 1.2 and earlier allows remote attackers to cause a denial of service (segmentation fault) by creating a new Array object with a large size value then writing into that array.


TYPSoft FTP Server 1.10 allows remote attackers to cause a denial of service (CPU consumption) via an empty USER name.


isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a malformed IPSEC SA payload as demonstrated by the Striker ISAKMP Protocol Test Suite.


Symantec Norton AntiVirus 2002 and 2003 allows remote attackers to cause a denial of service (CPU consumption) via a compressed archive that contains a large number of directories.


The asn_parse_header function (asn1.c) in the SNMP module for Squid Web Proxy Cache before 2.4.STABLE7 allows remote attackers to cause a denial of service (server restart) via certain SNMP packets with negative length fields that trigger a memory allocation error.


Cisco ONS 15327 before 4.1(3) ONS 15454 before 4.6(1) and ONS 15454 SD before 4.1(3) allows remote attackers to cause a denial of service (reset) by not sending the ACK portion of the TCP three-way handshake and sending an invalid response instead.


The Web administration interface in Microsoft MN-500 Wireless Router allows remote attackers to cause a denial of service (connection refusal) via a large number of open HTTP connections.


RealNetworks Helix Universal Server 9.0.2 for Linux and 9.0.3 for Windows allows remote attackers to cause a denial of service (CPU and memory exhaustion) via a POST request with a Content-Length header set to -1.


The dissect_attribute_value_pairs function in packet-radius.c for Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a malformed RADIUS packet that triggers a null dereference.


TCP when using a large Window Size makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet especially in protocols that use long-lived connections such as BGP.


MySQL MaxDB before 7.5.00.18 allows remote attackers to cause a denial of service (crash) via an HTTP request to webdbm with high ASCII values in the Server field which triggers an assert error in the IsAscii7 function.


OpenBSD 3.4 and NetBSD 1.6 and 1.6.1 allow remote attackers to cause a denial of service (crash) by sending an IPv6 packet with a small MTU to a listening port and then issuing a TCP connect to that port.


The (1) ntlm_fetch_string and (2) ntlm_get_string functions in Squid 2.5.6 and earlier with NTLM authentication enabled allow remote attackers to cause a denial of service (application crash) via an NTLMSSP packet that causes a negative value to be passed to memcpy.


MySQL before 4.0.20 allows remote attackers to cause a denial of service (application crash) via a MATCH AGAINST query with an opening double quote but no closing double quote.


Juniper JUNOS 5.x through JUNOS 7.x allows remote attackers to cause a denial of service (routing disabled) via a large number of MPLS packets which are not filtered or verified before being sent to the Routing Engine which reduces the speed at which other packets are processed.


RealNetworks Helix Universal Server 9.0.1 and 9.0.2 allows remote attackers to cause a denial of service (crash) via malformed requests that trigger a null dereference as demonstrated using (1) GET_PARAMETER or (2) DESCRIBE requests.


Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid.


Fastream NETFile FTP Server 6.7.2.1085 and earlier allows remote attackers to cause a denial of service (temporary hang) via the cd command with an unusual argument possibly due to multiple leading slashes and/or an access to the floppy drive (\A\).


The TCP/IP Networking component in Mac OS X before 10.3.5 allows remote attackers to cause a denial of service (memory and resource consumption) via a \Rose Attack\ that involves sending a subset of small IP fragments that do not form a complete larger packet.


isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (infinite loop) via an ISAKMP packet with a zero-length payload as demonstrated by the Striker ISAKMP Protocol Test Suite.


IBM Cloudscape 5.1 running jdk 1.4.2_03 allows remote attackers to execute arbitrary programs or cause a denial of service via certain SQL code possibly due to a SQL injection vulnerability.


An Activation function in the RPCSS Service involved with DCOM activation for Microsoft Windows 2000 XP and 2003 allows remote attackers to cause a denial of service (memory consumption) via an activation request with a large length field.


Linux kernel 2.4.x and 2.6.x for x86 allows local users to cause a denial of service (system crash) possibly via an infinite loop that triggers a signal handler with a certain sequence of fsave and frstor instructions as originally demonstrated using a \crash.c\ program.


Web-Based Administration in Netgear FVS318 VPN Router allows remote attackers to cause a denial of service (no new connections) via a large number of open HTTP connections.


The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a SAMBA request that contains multiple * (wildcard) characters.


Apache 1.4.x before 1.3.30 and 2.0.x before 2.0.49 when using multiple listening sockets on certain platforms allows remote attackers to cause a denial of service (blocked new connections) via a \short-lived connection on a rarely-accessed listening socket.\


Non-registered IRC users using (1) ircd-hybrid 7.0.1 and earlier (2) ircd-ratbox 1.5.1 and earlier or (3) ircd-ratbox 2.0rc6 and earlier do not have a rate-limit imposed which could allow remote attackers to cause a denial of service by repeatedly making requests which are slowly dequeued.


The get_real_string function in Monkey HTTP Daemon (monkeyd) 0.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request with a sequence of \%\ characters and a missing Host field.


The OSS code for the Sound Blaster (sb16) driver in Linux 2.4.x before 2.4.26 when operating in 16 bit mode does not properly handle certain sample sizes which allows local users to cause a denial of service (crash) via a sample with an odd number of bytes.


The rawprint function in the ISAKMP decoding routines (print-isakmp.c) for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via malformed ISAKMP packets that cause invalid \len\ or \loc\ values to be used in a loop a different vulnerability than CVE-2003-0989.


The SMB SID snooping capability in Ethereal 0.9.15 to 0.10.4 allows remote attackers to cause a denial of service (process crash) via a handle without a policy name which causes a null dereference.


The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.


The client and server of Chaser 1.50 and earlier allow remote attackers to cause a denial of service (crash via exception) via a UDP packet with a length field that is greater than the actual data length which causes Chaser to read unexpected memory.


Multiple TCP/IP and ICMP implementations allow remote attackers to cause a denial of service (reset TCP connections) via spoofed ICMP error messages aka the \blind connection-reset attack.\ NOTE: CVE-2004-0790 CVE-2004-0791 and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065 CVE-2005-0066 CVE-2005-0067 and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability. While CVE normally SPLITs based on vulnerability the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.


The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service (service hang) via a certain UDP packet to the IPP port.


WFTPD Pro Server 3.21 Release 1 allocates memory for a command until a 0Ah byte (newline) is sent which allows local users to cause a denial of service (CPU consumption) by continuing to send a long command that does not contain a newline.


The accept_client function in PureFTPd 1.0.18 and earlier allows remote attackers to cause a denial of service by exceeding the maximum number of connections.


mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop.


The RPC Runtime Library for Microsoft Windows NT 4.0 allows remote attackers to read active memory or cause a denial of service (system crash) via a malicious message possibly related to improper length values.


Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters.


The XPM parser in the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) via a malformed image file that triggers a null dereference a different vulnerability than CVE-2004-0693.


Unknown vulnerability in init for IRIX 6.5.20 through 6.5.24 allows local users to cause a denial of service (system panic) as a result of \page invalidation issues.\


FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet.


telnetd for netkit 0.17 and earlier and possibly other versions on Debian GNU/Linux allows remote attackers to cause a denial of service (free of an invalid pointer) a different vulnerability than CVE-2001-0554.


palmhttpd for PalmOS allows remote attackers to cause a denial of service (crash) by establishing two simultaneous HTTP connections which exceeds the PalmOS accept queue.


WebSphere Edge Component Caching Proxy in WebSphere Edge Server 5.02 with the JunctionRewrite directive enabled allows remote attackers to cause a denial of service via an HTTP GET request without any parameters.


The Content Scanner Server in F-Secure Anti-Virus for Microsoft Exchange 6.21 and earlier F-Secure Anti-Virus for Microsoft Exchange 6.01 and earlier and F-Secure Internet Gatekeeper 6.32 and earlier allow remote attackers to cause a denial of service (service crash due to unhandled exception) via a certain malformed packet.


The HTML form upload capability in ColdFusion MX 6.1 does not reclaim disk space if an upload is interrupted which allows remote attackers to cause a denial of service (disk consumption) by repeatedly uploading files and interrupting the uploads before they finish.


The tcp_find_option function of the netfilter subsystem in Linux kernel 2.6 when using iptables and TCP options rules allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a large option length that produces a negative integer after a casting operation to the char type.


TsFtpSrv.exe in Broker FTP 6.1.0.0 allows remote attackers to cause a denial of service (CPU consumption) via an open idle connection.


The bridge functionality in OpenBSD 3.4 and 3.5 when running a gateway configured as a bridging firewall with the link2 option for IPSec enabled allows remote attackers to cause a denial of service (crash) via an ICMP echo (ping) packet.


The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding.


The tcp_find_option function of the netfilter subsystem for IPv6 in the SUSE Linux 2.6.5 kernel with USAGI patches when using iptables and TCP options rules allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a large option length that produces a negative integer after a casting operation to the char type a similar flaw to CVE-2004-0626.


FreeChat 1.1.1a allows remote attackers to cause a denial of service (crash) via certain unexpected strings as demonstrated using \aaaaa\.


Racoon before 20040408a allows remote attackers to cause a denial of service (memory consumption) via an ISAKMP packet with a large length field.


Memory leak in FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (memory exhaustion) via a series of Access-Request packets with (1) Ascend-Send-Secret (2) Ascend-Recv-Secret or (3) Tunnel-Password attributes.


Internet Explorer 6 allows remote attackers to cause a denial of service (crash) via Javascript that creates a new popup window and disables the imagetoolbar functionality with a META tag which triggers a null dereference.


The Equalizer Load-balancer for serial network interfaces (eql.c) in Linux kernel 2.6.x up to 2.6.7 allows local users to cause a denial of service via a non-existent device name that triggers a null dereference.


IDirectPlay4 Application Programming Interface (API) of Microsoft DirectPlay 7.0a thru 9.0b as used in Windows Server 2003 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed packet.


OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types which allows remote attackers to cause a denial of service (infinite loop) as demonstrated using the Codenomicon TLS Test Tool.


The AIM dissector in Ethereal 0.10.3 allows remote attackers to cause a denial of service (assert error) via unknown attack vectors.


The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI as demonstrated using the Codenomicon HTTP Test Tool.


The Half-Life engine before July 7 2004 allows remote attackers to cause a denial of service (server or client crash) via an empty fragmented packet.


Ratbag game engine as used in products such as Dirt Track Racing Leadfoot and World of Outlaws Spring Cars allows remote attackers to cause a denial of service (CPU consumption) via a TCP packet that specifies the length of data to read and then sends a second TCP packet that contains less data than specified which causes Ratbag to repeatedly check the socket for more data.


The rad_print_request function in logger.c for GNU Radius daemon (radiusd) before 1.2 allows remote attackers to cause a denial of service (crash) via a UDP packet with an Acct-Status-Type attribute without a value and no Acct-Session-Id attribute which causes a null dereference.


The print_attr_string function in print-radius.c for tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a RADIUS attribute with a large length value.


The Remote Control Client service in Microsoft's Systems Management Server (SMS) 2.50.2726.0 allows remote attackers to cause a denial of service (crash) via a data packet to TCP port 2702 that causes the server to read or write to an invalid memory address.


mshtml.dll in Microsoft Internet Explorer 6.0.2800 allows remote attackers to cause a denial of service (crash) via a table containing a form that crosses multiple td elements and whose \float: left\ class is defined in a link to a CSS stylesheet after the end of the table which may trigger a null dereference.


Team Factor 1.25 and earlier allows remote attackers to cause a denial of service (crash) via a packet that uses a negative number to specify the size of the data block that follows which causes Team Factor to read unallocated memory.


Web Crossing 4.x and 5.x allows remote attackers to cause a denial of service (crash) by sending a HTTP POST request with a large or negative Content-Length which causes an integer divide-by-zero.


The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.


TYPSoft FTP Server 1.10 allows remote authenticated users to cause a denial of service (CPU consumption) via \//../\ arguments to (1) mkd (2) xmkd (3) dele (4) size (5) retr (6) stor (7) appe (8) rnfr (9) rnto (10) rmd or (11) xrmd as demonstrated using \//../qwerty\.


WWW File Share Pro 2.42 and earlier allows remote attackers to cause a denial of service (crash) via a large POST request.


libclamav in Clam AntiVirus 0.65 allows remote attackers to cause a denial of service (crash) via a uuencoded e-mail message with an invalid line length (e.g. a lowercase character) which causes an assert error in clamd that terminates the calling program.


NGSEC StackDefender 1.10 allows attackers to cause a denial of service (system crash) via an invalid address for the ObjectAttribues parameter to the hooks for the (1) ZwCreateFile or (2) ZwOpenFile functions.


Integer signedness error in D-Link AirPlus DI-614+ running firmware 2.30 and earlier allows remote attackers to cause a denial of service (IP lease depletion) via a DHCP request with the LEASETIME option set to -1 which makes the DHCP lease valid for thirteen or more years.


The H.323 protocol agent in StoneSoft firewall engine 2.2.8 and earlier allows remote attackers to cause a denial of service (crash) via crafted H.323 packets.


Helix Universal Server/Proxy 9 and Mobile Server 10 allow remote attackers to cause a denial of service via certain HTTP POST messages to the Administration System port.


The TCP MSS (maximum segment size) functionality in netinet allows remote attackers to cause a denial of service (resource exhaustion) via (1) a low MTU which causes a large number of small packets to be produced or (2) via a large number of packets with a small TCP payload which cause a large number of calls to the resource-intensive sowakeup function.


BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles which allows unauthorized users to cause a denial of service (service shutdown).


The do_fork function in Linux 2.4.x before 2.4.26 and 2.6.x before 2.6.6 does not properly decrement the mm_count counter when an error occurs after the mm_struct for a child process has been activated which triggers a memory leak that allows local users to cause a denial of service (memory exhaustion) via the clone (CLONE_VM) system call.


The BMP image processor for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted BMP file.


Multiple vulnerabilities in the samba filesystem (smbfs) in Linux kernel 2.4 and 2.6 allow remote samba servers to cause a denial of service (crash) or gain sensitive information from kernel memory via a samba server (1) returning more data than requested to the smb_proc_read function (2) returning a data offset from outside the samba packet to the smb_proc_readX function (3) sending a certain TRANS2 fragmented packet to the smb_receive_trans2 function (4) sending a samba packet with a certain header size to the smb_proc_readX_data function or (5) sending a certain packet based offset for the data in a packet to the smb_receive_trans2 function.


Cisco 6000 6500 and 7600 series systems with Multilayer Switch Feature Card 2 (MSFC2) and a FlexWAN or OSM module allow local users to cause a denial of service (hang or reset) by sending a layer 2 frame packet that encapsulates a layer 3 packet but has inconsistent length values with that packet.


WFTPD Pro Server 3.21 Release 1 with the XeroxDocutech option enabled allows local users to cause a denial of service (crash) via a (1) MKD or (2) XMKD command that causes an absolute path of 260 characters to be used which overwrites a cookie with a null character possibly due to an off-by-one error.


The process_logon_packet function in the nmbd server for Samba 3.0.6 and earlier when domain logons are enabled allows remote attackers to cause a denial of service via a SAM_UAS_CHANGE request with a length value that is larger than the number of structures that are provided.


Microsoft Internet Explorer 6.0 Outlook 2002 and Outlook 2003 allow remote attackers to cause a denial of service (CPU consumption) if \Do not save encrypted pages to disk\ is disabled via a web site or HTML e-mail that contains two null characters (%00) after the host name.


Sygate Secure Enterprise (SSE) 3.5MR3 and earlier does not change the key used to encrypt data which allows remote attackers to cause a denial of service (resource exhaustion) by capturing a session and repeatedly replaying the session.


The SYMDNS.SYS driver in Symantec Norton Internet Security and Professional 2002 through 2004 Norton Personal Firewall 2002 through 2004 Norton AntiSpam 2004 Client Firewall 5.01 and 5.1.1 and Client Security 1.0 through 2.0 allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a DNS response with a compressed name pointer that points to itself.


The radius daemon (radiusd) for GNU Radius 1.1 when compiled with the -enable-snmp option allows remote attackers to cause a denial of service (server crash) via malformed SNMP messages containing an invalid OID.


QuickTime Streaming Server in Mac OS X Server 10.2.8 10.3.4 and 10.3.5 allows remote attackers to cause a denial of service (application deadlock) via a certain sequence of operations.


The Clear Channel Assessment (CCA) algorithm in the IEEE 802.11 wireless protocol when using DSSS transmission encoding allows remote attackers to cause a denial of service via a certain RF signal that causes a channel to appear busy (aka \jabber\) which prevents devices from transmitting data.


CesarFTP 0.99e allows remote attackers to cause a denial of service (CPU consumption) via a long RETR parameter.


Memory leak in Juniper JUNOS Packet Forwarding Engine (PFE) allows remote attackers to cause a denial of service (memory exhaustion and device reboot) via certain IPv6 packets.


NGSEC StackDefender 2.0 allows attackers to cause a denial of service (system crash) via an invalid address for the BaseAddress parameter to the hooks for the (1) ZwAllocateVirtualMemory or (2) ZwProtectVirtualMemory functions.


HP Integrated Lights-Out (iLO) 1.10 and other versions before 1.55 allows remote attackers to cause a denial of service (hang) by accessing iLO using the TCP/IP reserved port zero.


The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k and 0.9.7a to 0.9.7c allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.


Insecure permissions for the /proc/scsi/qla2300/HbaApiNode file in Linux allows local users to cause a denial of service.


The error handling in the (1) inflate and (2) inflateBack functions in ZLib compression library 1.2.x allows local users to cause a denial of service (application crash).


Mailman before 2.0.13 allows remote attackers to cause a denial of service (crash) via an email message with an empty subject field.


The Microsoft Secure Sockets Layer (SSL) library as used in Windows 2000 Windows XP and Windows Server 2003 allows remote attackers to cause a denial of service via malformed SSL messages.


Titan FTP Server version 3.01 build 163 and possibly other versions before build 169 allows remote authenticated users to cause a denial of service (crash) by disconnecting from the system during a \LIST -L\ command which causes Titan to access an invalid socket.


The Vicam USB driver in Linux before 2.4.25 does not use the copy_from_user function when copying data from userspace to kernel space which crosses security boundaries and allows local users to cause a denial of service.


gdk-pixbuf before 0.20 allows attackers to cause a denial of service (crash) via a malformed bitmap (BMP) file.


racoon before 20040407b allows remote attackers to cause a denial of service (infinite loop and dropped connections) via an IKE message with a malformed Generic Payload Header containing invalid (1) \Security Association Next Payload\ and (2) \RESERVED\ fields.


The ELF loader in Linux kernel 2.4 before 2.4.25 allows local users to cause a denial of service (crash) via a crafted ELF file with an interpreter with an invalid arch (architecture) which triggers a BUG() when an invalid VMA is unmapped.


Cisco 11000 Series Content Services Switches (CSS) running WebNS 5.0(x) before 05.0(04.07)S and 6.10(x) before 06.10(02.05)S allow remote attackers to cause a denial of service (device reset) via a malformed packet to UDP port 5002.


Enterasys XSR-1800 series Security Routers when running firmware 7.0.0.0 and using Policy-Based Routing allow remote attackers to cause a denial of service (crash) via a packet with the IP record route option set.


IP Security VPN Services Module (VPNSM) in Cisco Catalyst 6500 Series Switch and the Cisco 7600 Series Internet Routers running IOS before 12.2(17b)SXA before 12.2(17d)SXB or before 12.2(14)SY03 could allow remote attackers to cause a denial of service (device crash and reload) via a malformed Internet Key Exchange (IKE) packet.


smbd in Samba before 2.2.11 allows remote attackers to cause a denial of service (daemon crash) by sending a FindNextPrintChangeNotify request without a previous FindFirstPrintChangeNotify as demonstrated by the SMB client in Windows XP SP2.


Web Access in Lotus Domino 6.5.1 allows remote attackers to cause a denial of service (server crash) via a large e-mail message as demonstrated using a large image attachment.


FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR vendor-specific attributes (VSA) that cause a memcpy operation with a -1 argument.


Unknown versions of Mozilla allow remote attackers to cause a denial of service (high CPU/RAM consumption) using Javascript with an infinite loop that continues to add input to a form possibly as the result of inserting control characters as demonstrated using an embedded ctrl-U.


Vulnerability in tif_dirread.c for libtiff allows remote attackers to cause a denial of service (application crash) via a TIFF image that causes a divide-by-zero error when the number of row bytes is zero a different vulnerability than CVE-2005-2452.


Ethereal 0.10.1 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector.


Prestige 650HW-31 running Rompager 4.7 software allows remote attackers to cause a denial of service (device reboot) via a long password.


IBM DB2 10.5 and 11.1 contains a denial of service vulnerability. A remote user can cause disruption of service for DB2 Connect Server setup with a particular configuration. IBM X-Force ID: 129829.


IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) during testing of an unsupported configuration where users applications are running on an active ESS I/O server node and utilize direct I/O to perform a read or a write to a Spectrum Scale file. This vulnerability may result in the use of an incorrect memory address leading to a Spectrum Scale/GPFS daemon failure with a Signal 11 and possibly leading to denial of service or undetected data corruption. IBM X-Force ID: 125458.


IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link it could cause the Notes client to hang and have to be restarted. IBM X-Force ID: 121370.


IBM Daeja ViewONE Professional Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to a denial of service when viewing or opening a large file. IBM X-Force ID: 123852.


IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM) Rational DOORS Next Generation (RDNG) Rational Engineering Lifecycle Manager (RELM) Rational Team Concert (RTC) Rational Quality Manager (RQM) Rational Rhapsody Design Manager (Rhapsody DM) and Rational Software Architect (RSA DM) could allow an authenticated user to cause a denial of service due to incorrect authorization for resource intensive scenarios. IBM X-Force ID: 134392.


IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link it would open up many file select dialog boxes which would cause the client hang and have to be restarted. IBM X-Force ID: 121371.


IBM WebSphere MQ 9.0.2 could allow an authenticated user to potentially cause a denial of service by saving an incorrect channel status inquiry. IBM X-Force ID: 124354


A specially crafted message could cause a denial of service in IBM WebSphere MQ 9.0 9.0.0.1 9.0.0.2 9.0.1 9.0.2 9.0.3 and 9.0.4 applications consuming messages that it needs to perform data conversion on. IBM X-Force ID: 135520.


IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user to cause a denial of service to the MQXR channel when trace is enabled. IBM X-Force ID: 121155.


In FreeBSD 10.x before 10.4-STABLE 10.4-RELEASE-p3 and 10.3-RELEASE-p24 named paths are globally scoped meaning a process located in one jail can read and modify the content of POSIX shared memory objects created by a process in another jail or the host system. As a result a malicious user that has access to a jailed system is able to abuse shared memory by injecting malicious content in the shared memory region. This memory region might be executed by applications trusting the shared memory like Squid. This issue could lead to a Denial of Service or local privilege escalation.


IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed which could allow a user to cause a denial of service through resource exhaustion. IBM Reference #: 1999672.


IBM WebSphere Commerce 7.0 and 8.0 contains an unspecified vulnerability in Marketing ESpot's that could cause a denial of service. IBM X-Force ID: 131779.


IBM Tivoli Monitoring 6.2.3 through 6.2.3.5 and 6.3.0 through 6.3.0.7 are vulnerable to both TEPS user privilege escalation and possible denial of service due to unconstrained memory growth. IBM X-Force ID: 137039.


There is an illegal address access in Sass::Eval::operator() in eval.cpp of LibSass 3.4.5 leading to a remote denial of service attack. NOTE: this is similar to CVE-2017-11555 but remains exploitable after the vendor's CVE-2017-11555 fix (available from GitHub after 2017-07-24).


In libquicktime 1.2.4 an allocation failure was found in the function quicktime_read_ftyp in ftyp.c which allows attackers to cause a denial of service via a crafted file.


The access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause a denial of service (assertion failure and host OS crash) by accessing the Performance Monitors Cycle Count Register (PMCCNTR).


The Node_ValidatePtr function in corec/corec/node/node.c in mkclean 0.8.9 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv file.


Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows remote authenticated attacker to exhaust the memory resources of the machine causing a denial of service attack.


Memory leak in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (memory consumption) by leveraging failure to allocate memory for the comp or complen structure member.


The ReadData function in ebmlstring.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted mkv file.


The ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted VIFF file.


The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a crafted file.


The row_is_empty function in base/4bitmap.c:272 in minidjvu 0.8 can cause a denial of service (invalid memory read and application crash) via a crafted djvu file.


ccnl_ccntlv_bytes2pkt in CCN-lite allows context-dependent attackers to cause a denial of service (application crash) via vectors involving packets with \wrong L values.\


A vulnerability in the handling of 802.11w Protected Management Frames (PAF) by Cisco Aironet 3800 Series Access Points could allow an unauthenticated adjacent attacker to terminate a valid user connection to an affected device aka Denial of Service. The vulnerability exists because the affected device does not properly validate 802.11w PAF disassociation and deauthentication frames that it receives. An attacker could exploit this vulnerability by sending a spoofed 802.11w PAF frame from a valid authenticated client on an adjacent network to an affected device. A successful exploit could allow the attacker to terminate a single valid user connection to the affected device. This vulnerability affects Access Points that are configured to run in FlexConnect mode. Cisco Bug IDs: CSCvc20627.


The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount which allows remote attackers to cause a denial of service (memory allocation failure) in the opj_image_create function in lib/openjp2/image.c related to the opj_aligned_alloc_n function in opj_malloc.c.


CDirVector::GetTable in dirfunc.hxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted fpx image.


The ReadBMPImage function in coders/bmp.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted BMP file.


The mdjvu_bitmap_pack_row function in base/4bitmap.c in minidjvu 0.8 can cause a denial of service (invalid memory read and application crash) via a crafted djvu file.


Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash and cause a denial of service.


NetApp Data ONTAP before 8.2.5 when operating in 7-Mode in NFS environments allows remote attackers to cause a denial of service via unspecified vectors.


A Remote Denial of Service vulnerability in HPE Intelligent Management Center (iMC) PLAT version iMC Plat 7.3 E0504P2 was found.


Denial of Service vulnerability in Debut embedded httpd 1.20 in Brother DCP-J132W (and probably other DCP models) allows remote attackers to hang the printer (disrupting its network connection) by sending a large amount of HTTP packets.


GdkPixBuf (aka gdk-pixbuf) possibly 2.32.2 as used by GNOME Nautilus 3.14.3 on Ubuntu 16.04 allows attackers to cause a denial of service (stack corruption) or possibly have unspecified other impact via a crafted file folder.


The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid memory write and application crash) via a crafted gig file.


There are memory leaks in LibSass 3.4.5 triggered by deeply nested code such as code with a long sequence of open parenthesis characters leading to a remote denial of service attack.


The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.


The asn1f_lookup_symbol_impl function in asn1fix_retrieve.c in libasn1fix.a in asn1c 0.9.28 allows remote attackers to cause a denial of service (segmentation fault) via a crafted .asn1 file.


The EBML_IntegerValue function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv file.


Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager (SRM) before 1.1.4-6509 allows remote authenticated attacker to exhaust the memory resources of the machine causing a denial of service attack.


In TagLib 1.11.1 the rebuildAggregateFrames function in id3v2framefactory.cpp has a pointer to cast vulnerability which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted audio file.


An exploitable denial of service vulnerability exists in the Ethernet functionality of the Allen Bradley Micrologix 1400 Series B FRN 21.2 and below. A specially crafted packet can cause a device power cycle resulting in a fault state and deletion of ladder logic. An attacker can send one unauthenticated packet to trigger this vulnerability


The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.


The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information cause a denial of service or gain host OS privileges by leveraging incorrect block IO merge-ability calculation.


The row_is_empty function in base/4bitmap.c:274 in minidjvu 0.8 can cause a denial of service (invalid memory read and application crash) via a crafted djvu file.


An exploitable denial of service vulnerability exists in the processing of snmp-set commands of the Allen Bradley Micrologix 1400 Series B FRN 21.2 and below. A specially crafted snmp-set request when sent without associated firmware flashing snmp-set commands can cause a device power cycle resulting in downtime for the device. An attacker can send one packet to trigger this vulnerability.


The ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a denial of service (memory leak) via a crafted file related to the WriteMSLImage function.


The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ operation.


The JB2BitmapCoder::code_row_by_refinement function in jb2/bmpcoder.cpp in minidjvu 0.8 can cause a denial of service (invalid memory read and application crash) via a crafted djvu file.


An exploitable unhandled exception vulnerability exists in multiple APIs of CPP-Ethereum JSON-RPC. Specially crafted JSON requests can cause an unhandled exception resulting in denial of service. An attacker can send malicious JSON to trigger this vulnerability.


The iwgif_init_screen function in imagew-gif.c:510 in ImageWorsener 1.3.2 allows remote attackers to cause a denial of service (hmemory exhaustion) via a crafted file.


A \Cisco WebEx Network Recording Player Denial of Service Vulnerability\ exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email or URL and convincing the user to launch the file. Exploitation of this could cause an affected player to crash and in some cases could allow arbitrary code execution on the system of a targeted user. Cisco Bug IDs: CSCve11545 CSCve02843 CSCve11548.


The ReadDataFloat function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv file.


Stack overflow in custom XML-parser in Gemalto's HASP SRM Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denial of service.


In ImageMagick 7.0.6-2 a CPU exhaustion vulnerability was found in the function ReadPDBImage in coders/pdb.c which allows attackers to cause a denial of service.


There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.


The UpdateDataSize function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv file.


The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted gig file.


Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF EMF MSG and macros (POI bugs 61338 and 61294) and 2) Out of Memory Exceptions while parsing crafted DOC PPT and XLS (POI bugs 52372 and 61295).


The ReadData function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv file.


In libquicktime 1.2.4 an allocation failure was found in the function quicktime_read_info in lqt_quicktime.c which allows attackers to cause a denial of service via a crafted file.


An exploitable denial of service vulnerability exists in the program download functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a device fault resulting in halted operations. An attacker can send an unauthenticated packet to trigger this vulnerability.


Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain privileges via vectors involving transitive grants.


Arbitrary memory read from controlled memory pointer in Gemalto's HASP SRM Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denial of service.


The TIFFReadDirEntryArray function in tif_read.c in LibTIFF 4.0.8 mishandles memory allocation for short files which allows remote attackers to cause a denial of service (allocation failure and application crash) in the TIFFFetchStripThing function in tif_dirread.c during a tiff2pdf invocation.


The ReadPICTImage function in coders/pict.c in ImageMagick 7.0.6-3 allows attackers to cause a denial of service (memory leak) via a crafted file.


The mdjvu_bitmap_get_bounding_box function in base/4bitmap.c in minidjvu 0.8 can cause a denial of service (invalid memory read and application crash) via a crafted djvu file.


In Bitmap.ccp if Bitmap.nativeCreate fails an out of memory exception is not thrown leading to a java.io.IOException later on. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0 8.1. Android ID: A-33846679.


GraphicsMagick 1.3.26 has a denial of service issue in ReadJNXImage() in coders/jnx.c whereby large amounts of CPU and memory resources may be consumed although the file itself does not support the requests.


The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty function.


In ImageMagick 7.0.6-8 the load_level function in coders/xcf.c lacks offset validation which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.


In the ihevcd_decode function of ihevcd_decode.c there is an infinite loop due to an incomplete frame error. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-64380403.


There are lots of memory leaks in JasPer 2.0.12 triggered in the function jas_strdup() in base/jas_string.c that will lead to a remote denial of service attack.


An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. A denial of service may occur.


In the hardware HEVC decoder some media files could cause a page fault. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-38495900.


In the ihevcd_parse_sps function of ihevcd_parse_headers.c several parameter values could be negative which could lead to negative indexes which could lead to an infinite loop. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-65398821.


In Tidy 5.5.31 the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Fault) as demonstrated by an invalid ISALNUM argument.


There are lots of memory leaks in the GMCommand function in magick/command.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack.


In ImageMagick 7.0.6-8 the WritePDFImage function in coders/pdf.c operates on an incorrect data structure in the \dump uncompressed PseudoColor packets\ step which allows attackers to cause a denial of service (assertion failure in WriteBlobStream in MagickCore/blob.c) via a crafted file.


In bta_scan_results_cb_impl of btif_ble_scanner.cc there is possible resource exhaustion if a large number of repeated BLE scan results are received. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0. Android ID: A-65174158.


XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows remote authenticated users to obtain sensitive information cause a denial of service conduct server-side request forgery (SSRF) attacks conduct internal port scans or have unspecified other impact via an XML request aka bug #572705.


An issue was discovered in certain Apple products. iOS before 11.1 is affected. tvOS before 11.1 is affected. watchOS before 4.1 is affected. The issue involves the \CoreText\ component. It allows remote attackers to cause a denial of service (application crash) via a crafted text file.


In ImageMagick before 6.9.9-1 and 7.x before 7.0.6-2 the ReadOnePNGImage function in coders/png.c allows remote attackers to cause a denial of service (application hang in LockSemaphoreInfo) via a PNG file with a width equal to MAGICK_WIDTH_LIMIT.


In DLSParser of the sonivox library there is possible resource exhaustion due to a memory leak. This could lead to remote temporary denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-68159767.


There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack by triggering an unexpected jpc_ppmstabtostreams return value a different vulnerability than CVE-2018-9154.


The C++ symbol demangler routine in cplus-dem.c in libiberty as distributed in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).


In the ihevcd_parse_slice_header function of ihevcd_parse_slice_header.c a slice address of zero after the first slice could result in an infinite loop. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-64380202.


In several places in ihevcd_decode.c a dead loop could occur due to incomplete frames which could lead to memory leaks. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-63522067.


In ImageMagick 7.0.6-5 a length-validation vulnerability was found in the function ReadPSDLayersInternal in coders/psd.c which allows attackers to cause a denial of service (ReadPSDImage memory exhaustion) via a crafted file.