CVE-2012-4460

The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service assertion failure and daemon exit via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not...

CVE-2012-4458

CVE-2012-4458 affects Apache Qpid up to version 0.20, where the AMQP type decoder could be triggered by a connection.start-ok message containing a large number of zero-width elements in the client-properties map, leading to memory consumption and a potential denial of service (server crash). Publ...

CVE-2012-4458: Undefined Security Weakness

The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service memory consumption and server crash via a large number of zero width elements in the client-properties map in a connection.start-ok message...

CVE-2012-4460: Improper Restriction of Operations within the Bounds of a Memory Buffer

The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service assertion failure and daemon exit via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not...

PT-2013-1673

Name of the Vulnerable Software and Affected Versions Apache Qpid versions 0.20 and earlier Description The issue is related to an integer overflow in the qpid::framing::Buffer::checkAvailable function, which allows remote attackers to cause a denial of service crash via a crafted message. This...

PT-2013-1671

Name of the Vulnerable Software and Affected Versions Apache Qpid versions 0.20 and earlier Description The issue concerns the default configuration of Apache Qpid when the federation tag attribute is enabled. In this setup, the software accepts AMQP connections without verifying the source user...

PT-2013-1674 · Apache · Apache Qpid

Name of the Vulnerable Software and Affected Versions: Apache Qpid versions 0.20 and earlier Description: The issue affects the serializing/deserializing functions in the qpid::framing::Buffer class, allowing remote attackers to cause a denial of service through unspecified vectors, potentially...

CVE-2012-4446: Improper Authentication

The default configuration for Apache Qpid 0.20 and earlier, when the federationtag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request...

PT-2013-1672

Name of the Vulnerable Software and Affected Versions Apache Qpid versions 0.20 and earlier Description The issue allows remote attackers to cause a denial of service, resulting in memory consumption and server crash. This is achieved by sending a connection.start-ok message with a large number o...

CVE-2012-4459: Undefined Security Weakness

Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service crash via a crafted message, which triggers an out-of-bounds read...

qpid-cpp: qpid authentication bypass

It was found that the Apache Qpid daemon qpidd treated AMQP connections with the federationtag attribute set as a broker-to-broker connection, rather than a client-to-server connection. This resulted in the source user ID of messages not being checked. A client that can establish an AMQP connecti...

qpid-cpp: crash due to qpid::framing::Buffer::checkAvailable() wraparound

Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service crash via a crafted message, which triggers an out-of-bounds read...

qpid-cpp: long arrays of zero-width types cause a denial of service

The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service memory consumption and server crash via a large number of zero width elements in the client-properties map in a connection.start-ok message...

qpid-cpp: crash due to qpid::framing::Buffer::checkAvailable() wraparound

Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service crash via a crafted message, which triggers an out-of-bounds read...

qpid-cpp: long arrays of zero-width types cause a denial of service

The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service memory consumption and server crash via a large number of zero width elements in the client-properties map in a connection.start-ok message...

qpid-cpp: qpid authentication bypass

It was found that the Apache Qpid daemon qpidd treated AMQP connections with the federationtag attribute set as a broker-to-broker connection, rather than a client-to-server connection. This resulted in the source user ID of messages not being checked. A client that can establish an AMQP connecti...

CVE-2012-2145

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service file descriptor consumption via a large number of incomplete connections...

Design/Logic Flaw

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service file descriptor consumption via a large number of incomplete connections...

CVE-2012-2145

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service file descriptor consumption via a large number of incomplete connections...

CVE-2012-2145

CVE-2012-2145 affects Apache Qpid 0.17 and earlier. The vulnerability arises from insufficient restriction of incoming client connections, enabling remote attackers to cause a denial of service through file descriptor exhaustion by establishing a large number of incomplete connections. Public ref...