CVE-2014-2828

openstack-keystone: denial of service via V3 API authentication chaining

The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining."

CVSS 2.0 · 7.8 High EPSS 3.2% KEV · Not listed

Vendors

Openstack Redhat

Products

Keystone Openstack

CVE-2014-3506

openssl: DTLS memory exhaustion

d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.

CVSS 2.0 · 5.0 Medium EPSS 46.1% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Enterprise Application Platform and 2 more

CVE-2014-3555

openstack-neutron: Denial of Service in Neutron allowed address pair

OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (crash or long firewall rule updates) by creating a large number of allowed address pairs.

CVSS 2.0 · 4.0 Medium EPSS 2.2% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2014-3608

openstack-nova: incomplete fix for CVE-2014-2573, Nova VMware driver still leaks rescued images

The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573.

CVSS 2.0 · 2.7 Low EPSS 1.7% KEV · Not listed

Vendors

Openstack Redhat

Products

Nova Openstack

CVE-2014-3637

dbus: denial of service by creating unkillable D-Bus connections

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Freedesktop Opensuse

Products

Dbus Opensuse

CVE-2014-3639

dbus: denial of service flaw in incomplete connection handling

The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

D-bus Project Freedesktop Opensuse

Products

D-bus Dbus Opensuse

CVE-2014-3660

libxml2: denial of service via recursive entity expansion

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.

CVSS 2.0 · 5.0 Medium EPSS 3.8% KEV · Not listed

Vendors

Apple Canonical Debian and 2 more

Products

Mac Os X Ubuntu Linux Debian Linux and 2 more

CVE-2014-3661

jenkins: denial of service (SECURITY-87)

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-3672

xen: Unrestricted qemu logging

The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Xen

Products

Libvirt Xen

CVE-2014-3687

kernel: net: sctp: fix panic on duplicate ASCONF chunks

The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.

CVSS 3.1 · 7.5 High EPSS 8.6% KEV · Not listed

Vendors

Canonical Debian Linux and 5 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 12 more

CVE-2014-3690

kernel: kvm: vmx: invalid host cr4 handling across vm entries

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 4 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 8 more

CVE-2014-7960

openstack-swift: Swift metadata constraints are not correctly enforced

OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when combined.

CVSS 2.0 · 4.0 Medium EPSS 3.1% KEV · Not listed

Vendors

Openstack Redhat

Products

Swift Openstack Storage

CVE-2014-7970

Kernel: fs: VFS denial of service

The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Novell and 1 more

Products

Ubuntu Linux Linux Kernel Suse Linux Enterprise Server and 2 more

CVE-2014-9684

openstack-glance: potential resource exhaustion and denial of service using images manipulation API

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed

Vendors

Openstack Redhat

Products

Image Registry And Delivery Service \(glance\) Openstack

CVE-2015-0573

kernel: DoS in drivers/media/platform/msm/broadcast/tsc.c in TSC driver

drivers/media/platform/msm/broadcast/tsc.c in the TSC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via a crafted application that makes a TSC_GET_CARD_STATUS ioctl call.

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2015-1201

privoxy: denial of service (file descriptor consumption) via unspecified vectors

Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CVSS 2.0 · 5.0 Medium EPSS 1.3% KEV · Not listed

Vendors

Privoxy

Products

Privoxy

CVE-2015-1881

openstack-glance: potential resource exhaustion and denial of service using images manipulation API

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684.

CVSS 2.0 · 4.0 Medium EPSS 2.1% KEV · Not listed

Vendors

Openstack Redhat

Products

Image Registry And Delivery Service \(glance\) Openstack

CVE-2015-5286

openstack-glance: Storage overrun by deleting images

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

CVSS 2.0 · 6.8 Medium EPSS 2.5% KEV · Not listed

Vendors

Openstack Redhat

Products

Image Registry And Delivery Service \(glance\) Openstack

CVE-2015-5295

openstack-heat: Vulnerability in Heat template validation leading to DoS

The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.

CVSS 3.0 · 5.4 Medium EPSS 2.9% KEV · Not listed

Vendors

Fedoraproject Openstack Oracle and 1 more

Products

Fedora Orchestration Api Solaris and 1 more

CVE-2015-8786

rabbitmq-server: DoS via lengths_age or lengths_incr parameter in the management plugin

The Management plugin in RabbitMQ before 3.6.1 allows remote authenticated users with certain privileges to cause a denial of service (resource consumption) via the (1) lengths_age or (2) lengths_incr parameter.

CVSS 3.0 · 6.5 Medium EPSS 3.5% KEV · Not listed

Vendors

Oracle Pivotal Software Redhat

Products

Solaris Rabbitmq Openstack