CVE-2014-3639

dbus: denial of service flaw in incomplete connection handling

The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

D-bus Project Freedesktop Opensuse

Products

D-bus Dbus Opensuse

CVE-2014-3608

openstack-nova: incomplete fix for CVE-2014-2573, Nova VMware driver still leaks rescued images

The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573.

CVSS 2.0 · 2.7 Low EPSS 1.7% KEV · Not listed

Vendors

Openstack Redhat

Products

Nova Openstack

CVE-2014-3687

kernel: net: sctp: fix panic on duplicate ASCONF chunks

The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.

CVSS 3.1 · 7.5 High EPSS 8.6% KEV · Not listed

Vendors

Canonical Debian Linux and 5 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 12 more

CVE-2014-8500

bind: delegation handling denial of service

ISC BIND 9.0.x through 9.8.x, 9.9.0 through 9.9.6, and 9.10.0 through 9.10.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service (memory consumption and named crash) via a large or infinite number of referrals.

CVSS 2.0 · 7.8 High EPSS 59.0% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux Rhel Aus

CVE-2016-2064

kernel: DoS in MSM QDSP6 audio driver

sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted application that makes an ioctl call specifying many commands.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2016-2061

kernel: DoS in MSM V4L2 video driver

Integer signedness error in the MSM V4L2 video driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (array overflow and memory corruption) via a crafted application that triggers an msm_isp_axi_create_stream call.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2015-3241

openstack-nova: Nova instance migration process does not stop when instance is deleted

OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, which allows remote authenticated users to cause a denial of service (disk, network, and other resource consumption) by resizing and then deleting an instance.

CVSS 2.0 · 6.8 Medium EPSS 3.5% KEV · Not listed

Vendors

Openstack Redhat

Products

Nova Openstack

CVE-2015-3227

rubygem-activesupport: Possible Denial of Service attack in Active Support in merge_element()

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.

CVSS 2.0 · 5.0 Medium EPSS 4.2% KEV · Not listed

Vendors

Opensuse Rubyonrails

Products

Opensuse Rails

CVE-2016-2550

kernel: incorrectly accounted in-flight fds

The Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2016-9633

w3m: Memory exhaustion due to repeatedly appending '<table>'

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (infinite loop and resource consumption) via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Tats

Products

W3m

CVE-2016-9685

kernel: Memory leaks in xfs_attr_list.c error paths

Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel before 4.5.1 allow local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2016-2847

kernel: pipe: limit the per-user amount of pages allocated in pipes

fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes.

CVSS 3.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Novell Redhat

Products

Linux Kernel Suse Linux Enterprise Debuginfo Suse Linux Enterprise Desktop and 9 more

CVE-2014-0180

CFME: app/controllers/application_controller.rb wait_for_task DoS

The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed

Vendors

Redhat

Products

Cloudforms 3.0 Management Engine Cloudforms Managementengine

CVE-2015-5295

openstack-heat: Vulnerability in Heat template validation leading to DoS

The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.

CVSS 3.0 · 5.4 Medium EPSS 2.9% KEV · Not listed

Vendors

Fedoraproject Openstack Oracle and 1 more

Products

Fedora Orchestration Api Solaris and 1 more

CVE-2016-2774

dhcp: unclosed TCP connections to OMAPI or failover ports can cause DoS

ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions.

CVSS 3.1 · 5.9 Medium EPSS 73.6% KEV · Not listed

Vendors

Canonical Debian Isc and 1 more

Products

Ubuntu Linux Debian Linux Dhcp and 1 more

CVE-2015-5286

openstack-glance: Storage overrun by deleting images

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

CVSS 2.0 · 6.8 Medium EPSS 2.5% KEV · Not listed

Vendors

Openstack Redhat

Products

Image Registry And Delivery Service \(glance\) Openstack

CVE-2015-5143

Django: possible DoS by filling session store

The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.

CVSS 2.0 · 7.8 High EPSS 7.2% KEV · Not listed

Vendors

Canonical Debian Djangoproject and 2 more

Products

Ubuntu Linux Debian Linux Django and 2 more

CVE-2014-0221

openssl: DoS when sending invalid DTLS handshake

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

CVSS 2.0 · 4.3 Medium EPSS 87.9% KEV · Not listed

Vendors

Fedoraproject Mariadb Openssl and 3 more

Products

Fedora Mariadb Openssl and 10 more

CVE-2014-1500

Mozilla: onbeforeunload and Javascript navigation DOS (MFSA 2014-20)

Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (resource consumption and application hang) via onbeforeunload events that trigger background JavaScript execution.

CVSS 2.0 · 5.0 Medium EPSS 3.6% KEV · Not listed

Vendors

Mozilla Opensuse Opensuse Project and 2 more

Products

Firefox Seamonkey Opensuse and 5 more

CVE-2014-3122

Kernel: mm: try_to_unmap_cluster() should lock_page() before mlocking

The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires removal of page-table mappings.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 2 more