Page 46 of 293 results (0.007 seconds)

CVSS: 6.8EPSS: 17%CPEs: 228EXPL: 0

CVE-2016-1285 – bind: malformed packet sent to rndc can trigger assertion failure

https://notcve.org/view.php?id=CVE-2016-1285

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c. named en ISC BIND 9.x en versiones anteriores a 9.9.8-P4 y 9.10.x en versiones anteriores a 9.10.3-P4 no maneja adecuadamente los archivos DNAME cuando analiza gramaticalmente la recuperación de mensajes contestados, lo que permite a atacantes remotos provocar una denegación de servicio (fallo de aserción y salida de demonio) a través de un paquete mal formado en la interfaz rndc (también conocido como canal de control), relacionado con alist.c y sexpr.c. A denial of service flaw was found in the way BIND processed certain control channel input. A remote attacker able to send a malformed packet to the control channel could use this flaw to cause named to crash. • http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181036.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181037.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178831.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178880.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179904.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179911.html http://lists.opensuse.org/opensuse- • CWE-617: Reachable Assertion •

CVSS: 8.6EPSS: 73%CPEs: 228EXPL: 0

CVE-2016-1286 – bind: malformed signature records for DNAME records can trigger assertion failure

https://notcve.org/view.php?id=CVE-2016-1286

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c. named en ISC BIND 9.x en versiones anteriores a 9.9.8-P4 y 9.10.x en versiones anteriores a 9.10.3-P4 permite a atacantes remotos provocar una denegación de servicio (fallo de aserción y salida de demonio) a través de un registro de firma manipulado para un registro DNAME, relacionada con db.c y resolver.c. A denial of service flaw was found in the way BIND parsed signature records for DNAME records. By sending a specially crafted query, a remote attacker could use this flaw to cause named to crash. • http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181036.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181037.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178831.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178880.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179904.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179911.html http://lists.opensuse.org/opensuse- • CWE-617: Reachable Assertion •

CVSS: 5.3EPSS: 0%CPEs: 64EXPL: 0

CVE-2016-1258

https://notcve.org/view.php?id=CVE-2016-1258

Embedthis Appweb, as used in J-Web in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R8, 14.1 before 14.1R6, and 14.2 before 14.2R5, allows remote attackers to cause a denial of service (J-Web crash) via unspecified vectors. Embedthis Appweb, tal como se utiliza en J-Web en Juniper Junos OS en versiones anteriores a 12.1X44-D60, 12.1X46 en versiones anteriores a 12.1X46-D45, 12.1X47 en versiones anteriores a 12.1X47-D30, 12.3 en versiones anteriores a 12.3R10, 12.3X48 en versiones anteriores a 12.3X48-D20, 13.2X51 en versiones anteriores a 13.2X51-D20, 13.3 en versiones anteriores a 13.3R8, 14.1 en versiones anteriores a 14.1R6 y 14.2 en versiones anteriores a 14.2R5, permite a atacantes remotos provocar una denegación de servicio (caída de J-Web) a través de vectores no especificados. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10720 http://www.securitytracker.com/id/1035116 • CWE-20: Improper Input Validation •

CVSS: 5.9EPSS: 0%CPEs: 35EXPL: 0

CVE-2016-1257

https://notcve.org/view.php?id=CVE-2016-1257

The Routing Engine in Juniper Junos OS 13.2R5 through 13.2R8, 13.3R1 before 13.3R8, 13.3R7 before 13.3R7-S3, 14.1R1 before 14.1R6, 14.1R3 before 14.1R3-S9, 14.1R4 before 14.1R4-S7, 14.1X51 before 14.1X51-D65, 14.1X53 before 14.1X53-D12, 14.1X53 before 14.1X53-D28, 14.1X53 before 4.1X53-D35, 14.2R1 before 14.2R5, 14.2R3 before 14.2R3-S4, 14.2R4 before 14.2R4-S1, 15.1 before 15.1R3, 15.1F2 before 15.1F2-S2, and 15.1X49 before 15.1X49-D40, when LDP is enabled, allows remote attackers to cause a denial of service (RPD routing process crash) via a crafted LDP packet. El Routing Engine en Juniper Junos OS 13.2R5 hasta la versión 13.2R8, 13.3R1 en versiones anteriores a 13.3R8, 13.3R7 en versiones anteriores a 13.3R7-S3, 14.1R1 en versiones anteriores a 14.1R6, 14.1R3 en versiones anteriores a 14.1R3-S9, 14.1R4 en versiones anteriores a 14.1R4-S7, 14.1X51 en versiones anteriores a 14.1X51-D65, 14.1X53 en versiones anteriores a 14.1X53-D12, 14.1X53 en versiones anteriores a 14.1X53-D28, 14.1X53 en versiones anteriores a 4.1X53-D35, 14.2R1 en versiones anteriores a 14.2R5, 14.2R3 en versiones anteriores a 14.2R3-S4, 14.2R4 en versiones anteriores a 14.2R4-S1, 15.1 en versiones anteriores a 15.1R3, 15.1F2 en versiones anteriores a 15.1F2-S2 y 15.1X49 en versiones anteriores a 15.1X49-D40, cuando LDP está habilitado, permite a atacantes remotos provocar una denegación de servicio (caída del proceso de enrutamiento RPD) a través de un paquete LDP manipulado. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10715 http://www.securitytracker.com/id/1035117 • CWE-20: Improper Input Validation •

CVSS: 5.9EPSS: 0%CPEs: 9EXPL: 0

CVE-2016-1262

https://notcve.org/view.php?id=CVE-2016-1262

Juniper Junos OS before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.1X48 before 12.3X48-D20, and 15.1X49 before 15.1X49-D30 on SRX series devices, when the Real Time Streaming Protocol Application Layer Gateway (RTSP ALG) is enabled, allow remote attackers to cause a denial of service (flowd crash) via a crafted RTSP packet. Juniper Junos OS en versiones anteriores a 12.1X46-D45, 12.1X47 en versiones anteriores a 12.1X47-D30, 12.1X48 en versiones anteriores a 12.3X48-D20 y 15.1X49 en versiones anteriores a 15.1X49-D30 en dispositivos de las series SRX, cuando el Real Time Streaming Protocol Application Layer Gateway (RTSP ALG) está habilitado, permite a atacantes remotos provocar una denegación de servicio (caída de flowd) a través de un paquete RTSP manipulado. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10721 http://www.securitytracker.com/id/1035108 • CWE-20: Improper Input Validation •