OpenJDK: incomplete XML parse tree size enforcement (JAXP, 8169011)

It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory...

April 18, 2017—KB4015553 (Preview of Monthly Rollup)

None None...

CVE-2017-2669

Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through varexpand to perform %variable expansion. Sending specially crafted %variable fields could result in...

BSA-2017-201

Security Advisory ID : BSA-2017-201 Component : OpenSSL Revision : 1.0: Interim It was found that function "ssl3readbytes" inssl/s3pkt.c might lead to higher CPU usage due to improper handling of warning packets.An attacker could repeat the undefined plaintext warning packets of "SSL3ALWARNING"...

CVE-2017-6444

The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection, which allows remote attackers to cause a denial of service CPU consumption by sending many ACK packets. After the attacker stops the exploit, the CPU usage is 10...

Denial Of Service (DoS)

ImageMagick is vulnerable to denial of service DoS attacks. A malicious user can pass a malicious vicar file that can cause excessive CPU usage that can lead to running out of resources and crashing...

Restoration of HA Backups on Standalone NetScaler MAS Fails at Restoring of the Database

The restoration of the NetScaler MAS backup fails at restoring of the Database as shown in the following screen shot: This will stay at this point and will not continue. Checking process using top or ps commands will show low CPU usage, which indicates that the restore process has stopped. The...

Linux Kernel 3.10.0 (CentOS7) Denial Of Service Exploit

CentOS7 suffers from a kernel crashing denial of service issue triggered by an rsyslog daemon vulnerability. Exploit Title: CentOS7 Kernel Crashing by rsyslog daemon vulnerability | DOS on CentOS7 Exploit Author: Hosein Askari FarazPajohan Vendor HomePage: https://www.centos.org/ Version : 7 Test...

Linux Kernel 3.10.0 (CentOS 7) - Denial of Service

Linux Kernel 3.10.0 CentOS 7 - Denial of Service / Exploit Title: CentOS7 Kernel Crashing by rsyslog daemon vulnerability | DOS on CentOS7 Exploit Author: Hosein Askari FarazPajohan Vendor HomePage: https://www.centos.org/ Version : 7 Tested on: Parrot OS Date: 12-2-2017 Category: Operating Syste...

Cisco ASR 1000 Series Aggregation Services Routers IOS XE SNMP DoS Vulnerability

Cisco ASR 1000 Series Aggregation Services router with Cisco IOS XE Software is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2017-3820

A vulnerability in Simple Network Management Protocol SNMP functions of Cisco ASR 1000 Series Aggregation Services Routers running Cisco IOS XE Software Release 3.13.6S, 3.16.2S, or 3.17.1S could allow an authenticated, remote attacker to cause high CPU usage on an affected device, resulting in a...

CVE-2017-3820

CVE-2017-3820 affects Cisco ASR 1000 Series Aggregation Services Routers running Cisco IOS XE (releases 3.13.6S, 3.16.2S, or 3.17.1S). The vulnerability arises from an incorrect initialized variable in SNMP handling, allowing an authenticated, remote attacker to trigger high CPU usage and DoS via...

Updated pdns-recursor packages fix security vulnerability

Florian Heinz and Martin Kluge reported that pdns-recursor parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the pdns server, resulting in a partial denial of service i...

MGASA-2017-0036 Updated pdns-recursor packages fix security vulnerability

Florian Heinz and Martin Kluge reported that pdns-recursor parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the pdns server, resulting in a partial denial of service i...

Updated pdns packages fix security vulnerabilities

Mathieu Lafon discovered that pdns does not properly validate records in zones. An authorized user can take advantage of this flaw to crash server by inserting a specially crafted record in a zone under their control and then sending a DNS query for that record CVE-2016-2120. Florian Heinz and...

Target Device hangs at Black screen or Windows Logo indefinitely

During the early stages of a Target Device boot process, it hangs indefinitely at a Black Screen or just before showing the Windows Logo. Depending on how many Target Devices are booting at a time, the affected Target might finally finish booting after 30 to 60 minutes. In some cases the Target...

Fedora 25 : webkitgtk4 (2017-b015aa1d33)

This update addresses the following vulnerabilities : - CVE-2016-7656, CVE-2016-7635, CVE-2016-7654, CVE-2016-7639, CVE-2016-7645, CVE-2016-7652, CVE-2016-7641, CVE-2016-7632, CVE-2016-7599, CVE-2016-7592, CVE-2016-7589, CVE-2016-7623, CVE-2016-7586 Additional fixes : - Create GLX OpenGL contexts...

Fedora 24 : webkitgtk4 (2017-d317f6fb61)

This update addresses the following vulnerabilities : - CVE-2016-7656, CVE-2016-7635, CVE-2016-7654, CVE-2016-7639, CVE-2016-7645, CVE-2016-7652, CVE-2016-7641, CVE-2016-7632, CVE-2016-7599, CVE-2016-7592, CVE-2016-7589, CVE-2016-7623, CVE-2016-7586 Additional fixes : - Create GLX OpenGL contexts...

FreeBSD : powerdns -- multiple vulnerabilities (e3200958-dd6c-11e6-ae1b-002590263bf5)

PowerDNS reports : 2016-02: Crafted queries can cause abnormal CPU usage 2016-03: Denial of service via the web server 2016-04: Insufficient validation of TSIG signatures 2016-05: Crafted zone record can cause a denial of service %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

Debian DLA-788-1 : pdns-recursor security update

Florian Heinz and Martin Kluge reported that pdns-recursor, a recursive DNS server, parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the pdns server, resulting in a...