Design/Logic Flaw

Unspecified vulnerability in Guest Additions in Sun xVM VirtualBox 1.6.x and 2.0.x before 2.0.12, 2.1.x, and 2.2.x, and Sun VirtualBox before 3.0.10, allows guest OS users to cause a denial of service memory consumption on the guest OS via unknown vectors...

CVE-2009-3940

Unspecified vulnerability in Guest Additions in Sun xVM VirtualBox 1.6.x and 2.0.x before 2.0.12, 2.1.x, and 2.2.x, and Sun VirtualBox before 3.0.10, allows guest OS users to cause a denial of service memory consumption on the guest OS via unknown vectors...

CVE-2009-3940

Unspecified vulnerability in Guest Additions in Sun xVM VirtualBox 1.6.x and 2.0.x before 2.0.12, 2.1.x, and 2.2.x, and Sun VirtualBox before 3.0.10, allows guest OS users to cause a denial of service memory consumption on the guest OS via unknown vectors...

CVE-2009-3940

CVE-2009-3940 affects Sun xVM VirtualBox Guest Additions in VirtualBox 1.6.x and 2.0.x (before 2.0.12), 2.1.x, 2.2.x, and Sun VirtualBox before 3.0.10. A guest OS user can cause a denial of service (memory consumption) on the guest via unknown vectors. Connected advisories confirm the issue acros...

Mandriva Linux Security Advisory : ffmpeg (MDVSA-2009:297-1)

Vulnerabilities have been discovered and corrected in ffmpeg : - The ffmpeg lavf demuxer allows user-assisted attackers to cause a denial of service application crash via a crafted GIF file CVE-2008-3230 - FFmpeg 0.4.9, as used by MPlayer, allows context-dependent attackers to cause a denial of...

Memory corruption

Memory leak in Solaris TCP sockets in Sun OpenSolaris snv106 through snv126 allows local users to cause a denial of service kernel memory consumption via unspecified vectors involving tcpsendmsg processing "ancillary data."...

CVE-2009-3899

CVE-2009-3899: Memory leak in the Sockets Direct Protocol (SDP) driver affects Solaris 10 and OpenSolaris snv_57–snv_94, enabling remote attackers to trigger a denial of service via memory consumption. The connected documents do not specify a patch/workaround.

CVE-2009-3876

Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.127, and SDK and JRE 1.4.x before 1.4.224 allows remote attackers to cause a denial of service memory consumption via crafted DER encoded data, which is not...

Code injection

Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.127, and SDK and JRE 1.4.x before 1.4.224 allows remote attackers to cause a denial of service memory consumption via crafted HTTP headers, which are not...

CVE-2009-3876

CVE-2009-3876 affects Sun Java SE/JRE/JDK components. The vulnerability stems from the ASN.1 DER input stream parser failing to properly decode crafted DER-encoded data, allowing remote attackers to cause a denial of service via memory consumption. Affected products include Sun JRE/JDK 5.0 before...

CVE-2009-3876

Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.127, and SDK and JRE 1.4.x before 1.4.224 allows remote attackers to cause a denial of service memory consumption via crafted DER encoded data, which is not...

CVE-2009-3877

CVE-2009-3877 affects Sun Java SE/JRE/JDK across multiple releases: JRE/JDK 5.0 before Update 22, JRE/JDK 6 before Update 17, and older 1.3.x before 1.3.1_27 and 1.4.x before 1.4.2_24. Root cause: the ASN.1 DER input stream parser fails to properly parse crafted HTTP headers, enabling a remote at...

CVE-2009-3876

Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.127, and SDK and JRE 1.4.x before 1.4.224 allows remote attackers to cause a denial of service memory consumption via crafted DER encoded data, which is not...

openSUSE 10 Security Update : libneon-devel (libneon-devel-6550)

neon did not properly handle embedded NUL characters in X.509 certificates when comparing host names. Attackers could exploit that to spoof SSL servers CVE-2009-2408. Specially crafted XML documents that contain a large number of nested entity references could cause neon to consume large amounts ...

SuSE 10 Security Update : neon (ZYPP Patch Number 6548)

neon did not properly handle embedded NUL characters in X.509 certificates when comparing host names. Attackers could exploit that to spoof SSL servers. CVE-2009-2408 Specially crafted XML documents that contain a large number of nested entity references could cause neon to consume large amounts ...

Crash with recursive web-worker calls — Mozilla

Security researcher Orlando Berrera of Sec Theory reported that recursive creation of JavaScript web-workers can be used to create a set of objects whose memory could be freed prior to their use. These conditions often result in a crash which could potentially be used by an attacker to run...

openSUSE 10 Security Update : libapr-util1 (libapr-util1-6288)

This update of libapr-util1 fixes a memory consumption bug in the XML parser that can cause a remote denial-of-service vulnerability in applications using APR WebDAV for example CVE-2009-1955. Additionally a one byte buffer overflow in function aprbrigadevprintf CVE-2009-1956 and buffer underflow...

SuSE 10 Security Update : libapr-util1 (ZYPP Patch Number 6289)

This update of libapr-util1 fixes a memory consumption bug in the XML parser that can cause a remote denial-of-service vulnerability in applications using APR WebDAV for example CVE-2009-1955. Additionally a one byte buffer overflow in function aprbrigadevprintf CVE-2009-1956 and buffer underflow...

SuSE 11 Security Update : libapr-util1 (SAT Patch Number 969)

This update of libapr-util1 fixes a memory consumption bug in the XML parser that can cause a remote denial-of-service vulnerability in applications using APR WebDAV for example CVE-2009-1955. Additionally a one byte buffer overflow in function aprbrigadevprintf CVE-2009-1956 and buffer underflow...

neon: billion laughs DoS attack

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to...