CVE-2012-1342: Incorrect Authorization

Cisco Carrier Routing System CRS 3.9, 4.0, and 4.1 allows remote attackers to bypass ACL entries via fragmented packets, aka Bug ID CSCtj10975...

PT-2012-3198

Name of the Vulnerable Software and Affected Versions Cisco Carrier Routing System CRS versions 3.9 through 4.1 Description The issue allows remote attackers to bypass ACL entries via fragmented packets. Recommendations For versions 3.9 through 4.1, update to a version that includes the fix for B...

kernel: netfilter: null pointer dereference in nf_ct_frag6_reasm()

net/ipv6/netfilter/nfconntrackreasm.c in the Linux kernel before 2.6.34, when the nfconntrackipv6 module is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and system crash via certain types of fragmented IPv6 packets...

CVE-2011-1927

The ipexpire function in net/ipv4/ipfragment.c in the Linux kernel before 2.6.39 does not properly construct ICMPTIMEEXCEEDED packets after a timeout, which allows remote attackers to cause a denial of service invalid pointer dereference via crafted fragmented packets...

Null pointer dereference

The ipexpire function in net/ipv4/ipfragment.c in the Linux kernel before 2.6.39 does not properly construct ICMPTIMEEXCEEDED packets after a timeout, which allows remote attackers to cause a denial of service invalid pointer dereference via crafted fragmented packets...

CVE-2011-1927

The ipexpire function in net/ipv4/ipfragment.c in the Linux kernel before 2.6.39 does not properly construct ICMPTIMEEXCEEDED packets after a timeout, which allows remote attackers to cause a denial of service invalid pointer dereference via crafted fragmented packets...

CVE-2011-1927

The ipexpire function in net/ipv4/ipfragment.c in the Linux kernel before 2.6.39 does not properly construct ICMPTIMEEXCEEDED packets after a timeout, which allows remote attackers to cause a denial of service invalid pointer dereference via crafted fragmented packets...

CVE-2011-1927: Undefined Security Weakness

The ipexpire function in net/ipv4/ipfragment.c in the Linux kernel before 2.6.39 does not properly construct ICMPTIMEEXCEEDED packets after a timeout, which allows remote attackers to cause a denial of service invalid pointer dereference via crafted fragmented packets...

DEBIAN-CVE-2012-0043

Buffer overflow in the reassemblemessage function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a series of fragmented RLC...

CVE-2012-0043

Buffer overflow in the reassemblemessage function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a series of fragmented RLC...

Buffer overflow

Buffer overflow in the reassemblemessage function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a series of fragmented RLC...

SuSE 11.1 Security Update : Xen and libvirt (SAT Patch Number 5796)

This collective update 2012/02 for Xen provides fixes for the following reports : Xen : - 740165: Fix heap overflow in e1000 device emulation applicable to Xen qemu - CVE-2012-0029 - 739585: Xen block-attach fails after repeated attach/detach - 727515: Fragmented packets hang network boot of HVM...

UBUNTU-CVE-2011-4326

The udp6ufofragment function in net/ipv6/udp.c in the Linux kernel before 2.6.39, when a certain UDP Fragmentation Offload UFO configuration is enabled, allows remote attackers to cause a denial of service system crash by sending fragmented IPv6 UDP packets to a bridge device...

CVE-2011-1927

The ipexpire function in net/ipv4/ipfragment.c in the Linux kernel before 2.6.39 does not properly construct ICMPTIMEEXCEEDED packets after a timeout, which allows remote attackers to cause a denial of service invalid pointer dereference via crafted fragmented packets...

CVE-2010-0751

The ipevictor function in ipfragment.c in libnids before 1.24, as used in dsniff and possibly other products, allows remote attackers to cause a denial of service NULL pointer dereference and crash via crafted fragmented packets...

DEBIAN-CVE-2010-0751

The ipevictor function in ipfragment.c in libnids before 1.24, as used in dsniff and possibly other products, allows remote attackers to cause a denial of service NULL pointer dereference and crash via crafted fragmented packets...

Null pointer dereference

The ipevictor function in ipfragment.c in libnids before 1.24, as used in dsniff and possibly other products, allows remote attackers to cause a denial of service NULL pointer dereference and crash via crafted fragmented packets...

CVE-2010-0751

The ipevictor function in ipfragment.c in libnids before 1.24, as used in dsniff and possibly other products, allows remote attackers to cause a denial of service NULL pointer dereference and crash via crafted fragmented packets...

CVE-2010-0751

The CVE-2010-0751 issue affects libnids ip_evictor in ip_fragment.c before version 1.24, used by dsniff and possibly other products. A remote attacker can trigger a denial of service via crafted fragmented packets, causing a NULL pointer dereference and crash. Public advisories (SUSE, Fedora, SUS...

CVE-2010-0751

The ipevictor function in ipfragment.c in libnids before 1.24, as used in dsniff and possibly other products, allows remote attackers to cause a denial of service NULL pointer dereference and crash via crafted fragmented packets...