lighttpd -- Remote DOS in CRLF parsing

Lighttpd SA: If the connection aborts during parsing "\r\n\r\n" the server might get into a infinite loop and use 100% of the CPU time. lighttpd still responses to other requests. This can be repeated until either the server limit for concurrent connections or file descriptors is reached. The bug...

libarchive -- Infinite loop in corrupt archives handling in libarchive

Problem Description: If the end of an archive is reached while attempting to "skip" past a region of an archive, libarchive will enter an infinite loop wherein it repeatedly attempts and fails to read further data. Impact: An attacker able to cause a system to extract via "tar -x" or another...

FreeBSD : openssh -- multiple vulnerabilities (32db37a5-50c3-11db-acf3-000c6ec775d9)

Problem Description The CRC compensation attack detector in the sshd8 daemon, upon receipt of duplicate blocks, uses CPU time cubic in the number of duplicate blocks received. CVE-2006-4924 A race condition exists in a signal handler used by the sshd8 daemon to handle the LoginGraceTime option,...

TinyWeb 1.9

The remote host is running TinyWeb version 1.9 or older. A remote user can issue an HTTP GET request for /cgi-bin/.%00./dddd.html and cause the server consume large amounts of CPU time 88%-92%. OpenVAS Vulnerability Test $Id: tinyweb.nasl 8023 2017-12-07 08:36:26Z teissa $ Description: TinyWeb 1....

Roxen counter module

The Roxen Challenger webserver is running and the counter module is installed. Requesting large counter GIFs eats up CPU-time on the server. If the server does not support threads this will prevent the server from serving other clients. OpenVAS Vulnerability Test $Id: roxencounter.nasl 8023...

Roxen counter module

The Roxen Challenger webserver is running and the counter module is installed. Requesting large counter GIFs eats up CPU-time on the server. If the server does not support threads this will prevent the server from serving other clients. SPDX-FileCopyrightText: 2000 Hendrik Scholz Some text...

GLSA-200505-16 : ImageMagick, GraphicsMagick: Denial of Service vulnerability

The remote host is affected by the vulnerability described in GLSA-200505-16 ImageMagick, GraphicsMagick: Denial of Service vulnerability Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a Denial of Service vulnerability in the XWD decoder of ImageMagick and GraphicsMagick when...

ImageMagick, GraphicsMagick: Denial of Service vulnerability

Background Both ImageMagick and GraphicsMagick are collection of tools to read, write and manipulate images in many formats. Description Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a Denial of Service vulnerability in the XWD decoder of ImageMagick and GraphicsMagick when...

wu-ftpd -- remote globbing DoS vulnerability

An iDEFENSE Security Advisory reports: Remote exploitation of an input validation vulnerability in version 2.6.2 of WU-FPTD could allow for a denial of service of the system by resource exhaustion. The vulnerability specifically exists in the wufnmatch function in wufnmatch.c. When a pattern...