CVSS: 7.1EPSS: 92%CPEs: 95EXPL: 0CVE-2016-2774 – dhcp: unclosed TCP connections to OMAPI or failover ports can cause DoS
https://notcve.org/view.php?id=CVE-2016-2774
ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions. ISC DHCP 4.1.x en versiones anteriores a 4.1-ESV-R13 y 4.2.x y 4.3.x en versiones anteriores a 4.3.4 no restringe el número de sesiones TCP concurrentes, lo que permite a atacantes remotos provocar una denegación de servicio (fallo de aserción INSIST o interrupción de procesamiento de petición) estableciendo muchas sesiones. A resource-consumption flaw was discovered in the DHCP server. dhcpd did not restrict the number of open connections to OMAPI and failover ports. A remote attacker able to establish TCP connections to one of these ports could use this flaw to cause dhcpd to exit unexpectedly, stop responding requests, or exhaust system sockets (denial of service). • http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183458.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183640.html http://lists.opensuse.org/opensuse-updates/2016-07/msg00066.html http://rhn.redhat.com/errata/RHSA-2016-2590.html http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html http://www.securityfocus.com/bid/84208 http://www.securitytracker.com/id/1035196 https://kb.isc.org/article/AA-01354 https://lists.debian.org&#x • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2016-1284
https://notcve.org/view.php?id=CVE-2016-1284
rdataset.c in ISC BIND 9 Supported Preview Edition 9.9.8-S before 9.9.8-S5, when nxdomain-redirect is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via crafted flag values in a query. rdataset.c en ISC BIND 9 Supported Preview Edition 9.9.8-S en versiones anteriores a 9.9.8-S5, cuando la redirección nxdomain está habilitada, permite a atacantes remotos causar una denegación de servicio (error de aserción REQUIRE y salida de demonio) a través de valores de indicadores manipulados en una consulta. • http://www.securitytracker.com/id/1034935 https://kb.isc.org/article/AA-01348 https://kb.isc.org/article/AA-01438 • CWE-20: Improper Input Validation •
CVSS: 7.0EPSS: 4%CPEs: 59EXPL: 0CVE-2015-8705
https://notcve.org/view.php?id=CVE-2015-8705
buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option. buffer.c en named en ISC BIND 9.10.x en versiones anteriores a 9.10.3-P3, cuando inicio de sesión depurado está habilitado, permite a atacantes remotos provocar una denegación de servicio (error de aserción REQUIRE y salida del demonio, o caída del demonio) o posiblemente tener otro impacto no especificado a través de (1) datos OPT o (2) una opción ECS. • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176564.html http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175977.html http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html http://www.securityfocus.com/bid/81314 http://www.securitytracker.com/id/1034740 https://kb.isc.org/article/AA-01336 https://kb.isc.org/article/AA-01380 https://security.gentoo.org/glsa/201610-07 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 95%CPEs: 59EXPL: 0CVE-2015-8704 – bind: specific APL data could trigger an INSIST in apl_42.c
https://notcve.org/view.php?id=CVE-2015-8704
apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed Address Prefix List (APL) record. apl_42.c en ISC BIND 9.x en versiones anteriores a 9.9.8-P3, 9.9.x y 9.10.x en versiones anteriores a 9.10.3-P3 permite a usuarios remotos autenticados provocar una denegación de servicio (fallo de la afirmación INSIST y salida de demonio) a través de un registro Address Prefix List (APL) mal formado. A denial of service flaw was found in the way BIND processed certain malformed Address Prefix List (APL) records. A remote, authenticated attacker could use this flaw to cause named to crash. • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176564.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178045.html http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175973.html http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175977.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00020.html http://lists.opensuse.org/opensuse-secu • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 5%CPEs: 93EXPL: 0CVE-2015-8605
https://notcve.org/view.php?id=CVE-2015-8605
ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet. ISC DHCP 4.x en versiones anteriores a 4.1-ESV-R12-P1, 4.2.x y 4.3.x en versiones anteriores a 4.3.3-P1 permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación) a través de una longitud de campo no válida en un paquete UDP IPv4. • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175594.html http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176031.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00162.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00168.html http://www.debian.org/security/2016/dsa-3442 http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html http://www.securityfocus.com/bid/80703 http://www.securitytracker.com/id/1034657 http&# • CWE-20: Improper Input Validation •