CVE-2012-4460: Improper Restriction of Operations within the Bounds of a Memory Buffer

The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service assertion failure and daemon exit via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not...

PT-2013-1673

Name of the Vulnerable Software and Affected Versions Apache Qpid versions 0.20 and earlier Description The issue is related to an integer overflow in the qpid::framing::Buffer::checkAvailable function, which allows remote attackers to cause a denial of service crash via a crafted message. This...

CVE-2012-4458: Undefined Security Weakness

The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service memory consumption and server crash via a large number of zero width elements in the client-properties map in a connection.start-ok message...

PT-2013-1672

Name of the Vulnerable Software and Affected Versions Apache Qpid versions 0.20 and earlier Description The issue allows remote attackers to cause a denial of service, resulting in memory consumption and server crash. This is achieved by sending a connection.start-ok message with a large number o...

CVE-2012-2145

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service file descriptor consumption via a large number of incomplete connections...

CVE-2012-2145

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service file descriptor consumption via a large number of incomplete connections...

Design/Logic Flaw

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service file descriptor consumption via a large number of incomplete connections...

CVE-2012-2145

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service file descriptor consumption via a large number of incomplete connections...

CVE-2012-2145

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service file descriptor consumption via a large number of incomplete connections...

CVE-2012-2145

CVE-2012-2145 affects Apache Qpid 0.17 and earlier. The vulnerability arises from insufficient restriction of incoming client connections, enabling remote attackers to cause a denial of service through file descriptor exhaustion by establishing a large number of incomplete connections. Public ref...

CVE-2012-2145: Undefined Security Weakness

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service file descriptor consumption via a large number of incomplete connections...

RedHat Update for qpid RHSA-2012:1269-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

qpid-cpp-server-cluster: unauthorized broker access caused by the use of NullAuthenticator catch-up shadow connections

Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication...

Moderate: Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.2 update

Updated Messaging component packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.2 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common...

Moderate: Red Hat Security Advisory: qpid security, bug fix, and enhancement update

Updated qpid packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, whic...

qpid-cpp: not closing incomplete connections exhausts file descriptors, leading to DoS

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service file descriptor consumption via a large number of incomplete connections...

qpid-cpp: not closing incomplete connections exhausts file descriptors, leading to DoS

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service file descriptor consumption via a large number of incomplete connections...

qpid-cpp-server-cluster: unauthorized broker access caused by the use of NullAuthenticator catch-up shadow connections

Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication...

Moderate: Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.2 update

Updated Messaging component packages that fix two security issues, multiple bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.2 for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common...

PT-2012-3835

Name of the Vulnerable Software and Affected Versions Apache Qpid versions 0.17 and earlier Description The issue allows remote attackers to cause a denial of service by consuming file descriptors via a large number of incomplete connections, due to improper restriction of incoming client...