CVE-2016-4555

squid: SegFault from ESIInclude::Start

client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.

CVSS 3.0 · 7.5 High EPSS 18.2% KEV · Not listed

Vendors

Canonical Oracle Redhat and 1 more

Products

Ubuntu Linux Linux Enterprise Linux and 1 more

CVE-2016-4450

nginx: NULL pointer dereference while writing client request body

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

CVSS 3.1 · 7.5 High EPSS 16.4% KEV · Not listed

Vendors

Canonical Debian F5 and 1 more

Products

Ubuntu Linux Debian Linux Nginx and 1 more

CVE-2014-3469

libtasn1: asn1_read_value_type() NULL pointer dereference

The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue argument.

CVSS 2.0 · 5.0 Medium EPSS 3.8% KEV · Not listed

Vendors

Debian Gnu Redhat and 1 more

Products

Debian Linux Gnutls Libtasn1 and 12 more

CVE-2013-4118

freerdp: Multiple security fixes in versions after 1.1.0-beta1

FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.

CVSS 3.0 · 7.5 High EPSS 3.6% KEV · Not listed

Vendors

Freerdp Opensuse

Products

Freerdp Leap Opensuse

CVE-2013-4119

freerdp: Multiple security fixes in versions after 1.1.0-beta1

FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by disconnecting before authentication has finished.

CVSS 3.0 · 7.5 High EPSS 4.3% KEV · Not listed

Vendors

Freerdp

Products

Freerdp

CVE-2013-7339

kernel: net: rds: dereference of a NULL device in rds_ib_laddr_check()

The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2014-2678

kernel: net: rds: dereference of a NULL device in rds_iw_laddr_check()

The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Oracle and 1 more

Products

Fedora Linux Kernel Linux and 3 more

CVE-2014-3465

gnutls: gnutls_x509_dn_oid_name NULL pointer dereference

The gnutls_x509_dn_oid_name function in lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x before 3.2.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted X.509 certificate, related to a missing LDAP description for an OID when printing the DN.

CVSS 2.0 · 5.0 Medium EPSS 4.1% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux

CVE-2014-3470

openssl: client-side denial of service when using anonymous ECDH

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.

CVSS 2.0 · 4.3 Medium EPSS 85.8% KEV · Not listed

Vendors

Fedoraproject Mariadb Openssl and 3 more

Products

Fedora Mariadb Openssl and 8 more

CVE-2014-3510

openssl: DTLS anonymous (EC)DH denial of service

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.

CVSS 2.0 · 4.3 Medium EPSS 18.4% KEV · Not listed

Vendors

Openssl Redhat

Products

Openssl Enterprise Linux Jboss Enterprise Application Platform and 2 more

CVE-2014-3535

Kernel: netdevice.h: NULL pointer dereference over VxLAN

include/linux/netdevice.h in the Linux kernel before 2.6.36 incorrectly uses macros for netdev_printk and its related logging implementation, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) by sending invalid packets to a VxLAN interface.

CVSS 2.0 · 7.8 High EPSS 4.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2014-3569

openssl: denial of service in ssl23_get_client_hello function

The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue became relevant after the CVE-2014-3568 fix.

CVSS 2.0 · 5.0 Medium EPSS 19.5% KEV · Not listed

Vendors

Openssl

Products

Openssl

CVE-2014-3580

subversion: NULL pointer dereference flaw in mod_dav_svn when handling REPORT requests

The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVSS 2.0 · 5.0 Medium EPSS 11.0% KEV · Not listed

Vendors

Apache Apple Debian and 1 more

Products

Subversion Xcode Debian Linux and 6 more

CVE-2014-3581

httpd: NULL pointer dereference in mod_cache if Content-Type has empty value

The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.

CVSS 2.0 · 5.0 Medium EPSS 13.5% KEV · Not listed

Vendors

Apache Canonical Oracle and 1 more

Products

Http Server Ubuntu Linux Enterprise Manager Ops Center and 9 more

CVE-2014-3640

qemu: slirp: NULL pointer deref in sosendto()

The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Qemu and 1 more

Products

Ubuntu Linux Debian Linux Qemu and 5 more

CVE-2014-4342

krb5: denial of service flaws when handling RFC 1964 tokens

MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session.

CVSS 2.0 · 5.0 Medium EPSS 6.5% KEV · Not listed

Vendors

Debian Mit Redhat

Products

Debian Linux Kerberos Kerberos 5 and 5 more

CVE-2014-4344

krb5: NULL pointer dereference flaw in SPNEGO acceptor for continuation tokens

The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.

CVSS 2.0 · 7.8 High EPSS 6.6% KEV · Not listed

Vendors

Debian Mit Redhat

Products

Debian Linux Kerberos 5 Enterprise Linux and 4 more

CVE-2014-5077

Kernel: net: SCTP: fix a NULL pointer dereference during INIT collisions

The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.

CVSS 2.0 · 7.1 High EPSS 5.8% KEV · Not listed

Vendors

Canonical Linux Redhat and 1 more

Products

Ubuntu Linux Linux Kernel Enterprise Linux and 9 more

CVE-2014-5116

cairo: NULL pointer dereference in cairo_image_surface_get_data()

The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a large string.

CVSS 2.0 · 5.0 Medium EPSS 7.6% KEV · Not listed

Vendors

Cairographics

Products

Cairo

CVE-2014-5139

openssl: crash with SRP ciphersuite in Server Hello message

The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

CVSS 2.0 · 4.3 Medium EPSS 16.3% KEV · Not listed

Vendors

Openssl

Products

Openssl