tomcat: non-persistent DoS attack by feeding data by aborting an upload

It was found that Tomcat would keep connections open after processing requests with a large enough request body. A remote attacker could potentially use this flaw to exhaust the pool of available connections and preventing further, legitimate connections to the Tomcat server to be made...

tomcat: non-persistent DoS attack by feeding data by aborting an upload

It was found that Tomcat would keep connections open after processing requests with a large enough request body. A remote attacker could potentially use this flaw to exhaust the pool of available connections and preventing further, legitimate connections to the Tomcat server to be made...

tomcat: non-persistent DoS attack by feeding data by aborting an upload

It was found that Tomcat would keep connections open after processing requests with a large enough request body. A remote attacker could potentially use this flaw to exhaust the pool of available connections and preventing further, legitimate connections to the Tomcat server to be made...

British Intelligence Open-Sources its Large-Scale Graph Database Software

UK's Secretive Spy Agency Government Communications Headquarters GCHQ has open-sourced one of its tools on code-sharing website GitHub for free... A graph database called 'Gaffer.' Gaffer, written in Java, is a kind of database that makes it "easy to store large-scale graphs in which the nodes an...

UBUNTU-CVE-2015-7212

Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering a graphics operation that requires a large texture allocation...

Fast Packet Networking Toolkit: Snabb Switch

Snabb Switch is open source software for solving novel problems in networking. Blending the latest techniques for high-performance x86 packet processing together with a high-level LuaJIT programming interface. The goal is to offer the easiest way to create and deploy new network functions in larg...

DEBIAN-CVE-2015-5309

Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code via an ECH erase characters escape sequence with a large parameter value, which triggers a buffer underflow...

CoreMail XT3.0 Cross Site Scripting

Application: CoreMail Versions Affected: XT3.0 Vendor URL: http://www.coremail.cn/ Bugs: Stored XSS Author:shack.liDBAPPSecurity Ltd Description: Coremail mail system was born in 1999, is widely used in network operators, large enterprises, government institutions, colleges and universities and...

openSUSE Security Update : xen (openSUSE-2015-730)

Xen was updated to fix 6 security issues. These security issues were fixed : - CVE-2014-0222: Validate L2 table size to avoid integer overflows bsc877642. - CVE-2015-4037: Insecure temporary file use in /net/slirp.c bsc932267. - CVE-2015-7835: Uncontrolled creation of large page mappings by PV...

USN-2815-1 libpng vulnerabilities

Mikulas Patocka discovered that libpng incorrectly handled certain large fields. If a user or automated system using libpng were tricked into opening a specially crafted image, an attacker could exploit this to cause libpng to crash, leading to a denial of service. This issue only affected Ubuntu...

wireshark: WaveAgent dissector crash (wnpa-sec-2015-26)

The dissectwapayload function in epan/dissectors/packet-waveagent.c in the WaveAgent dissector in Wireshark 1.12.x before 1.12.7 mishandles large tag values, which allows remote attackers to cause a denial of service application crash via a crafted packet...

LibreOffice and Apache OpenOffice integer overflow vulnerability (CNVD-2015-07520)

LibreOffice and Apache OpenOffice OOo are both open source office software suites. The suite contains text documents, spreadsheets, presentations, drawings, databases and other software. The former by the Document Foundation The Document Foundation, TDF development; the latter by the United State...

UBUNTU-CVE-2015-8041

Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpasupplicant before 2.5 allow remote attackers to cause a denial of service process crash or infinite loop via a large payload length field value in an 1 WPS or 2 P2P NFC NDEF record, which triggers an out-of-bounds...

nspr: arbitrary code execution

A logic bug in the handling of large allocations would allow exceptionally large allocations to be reported as successful, without actually allocating the requested memory. This may allow attackers to bypass security checks and obtain control of arbitrary memory...

The vulnerability of the Radia Client Automation program allows a hacker to execute arbitrary code.

The vulnerability of the Radia Client Automation user automation program arises due to buffer overflow in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a large amount of data...

DEBIAN-CVE-2015-6031

Buffer overflow in the IGDstartelt function in igddescparse.c in the MiniUPnP client aka MiniUPnPc before 1.9.20150917 allows remote UPNP servers to cause a denial of service application crash and possibly execute arbitrary code via an "oversized" XML element name...

CVE-2002-2061

Heap-based buffer overflow in Netscape 6.2.3 and Mozilla 1.0 and earlier allows remote attackers to crash client browsers and execute arbitrary code via a PNG image with large width and height values and an 8-bit or 16-bit alpha channel...

Red Hat Enterprise Application Platform Denial of Service Vulnerability

Red Hat Enterprise Application Platform is the United States Red Hat Red Hat, Inc. of a set of open source , J2EE-based middleware platform , which is mainly used to build, deploy and host Java applications and services. A denial of service vulnerability exists in Red Hat Enterprise Application...

SUSE-SU-2015:1952-1 Security update for xen

xen was updated to fix eight security issues. These security issues were fixed: - CVE-2015-4037: The slirpsmb function in net/slirp.c created temporary files with predictable names, which allowed local users to cause a denial of service instantiation failure by creating /tmp/qemu-smb.- files befo...

x86: Uncontrolled creation of large page mappings by PV guests

ISSUE DESCRIPTION The code to validate level 2 page table entries is bypassed when certain conditions are satisfied. This means that a PV guest can create writeable mappings using super page mappings. Such writeable mappings can violate Xen intended invariants for pages which Xen is supposed to...