CWE-617 vulnerabilities

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.

Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.

In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt.

A denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation functionality of Bloomberg Comdb2 8.1. A specially crafted network packet can lead to a denial of service. An attacker can send a malicious packet to trigger this vulnerability.

A denial of service vulnerability exists in the Bloomberg Comdb2 8.1 database when handling a distributed transaction heartbeat. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability.

If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.

A Reachable Assertion vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When the device receives a specific BGP UPDATE packet, the rpd crashes and restarts. Continuous receipt of this specific packet will cause a sustained DoS condition. For the issue to occur, BGP multipath with "pause-computation-during-churn" must be configured on the device, and the attacker must send the paths via a BGP UPDATE from a established BGP peer. This issue affects: Junos OS: * All versions before 21.4R3-S7, * from 22.3 before 22.3R3-S3, * from 22.4 before 22.4R3-S5, * from 23.2 before 23.2R2, * from 23.4 before 23.4R2. Junos OS Evolved: * All versions before 21.4R3-S7-EVO, * from 22.3 before 22.3R3-S3-EVO, * from 22.4 before 22.4R3-S5-EVO, * from 23.2 before 23.2R2-EVO, * from 23.4 before 23.4R2-EVO.

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).On all Junos OS and Junos OS Evolved devices, when route validation is enabled, a rare condition during BGP initial session establishment can lead to an rpd crash and restart. This occurs specifically when the connection request fails during error-handling scenario. Continued session establishment failures leads to a sustained DoS condition.  This issue affects Junos OS: * All versions before 22.2R3-S6, * from 22.4 before 22.4R3-S6, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S4, * from 24.2 before 24.2R2; Junos OS Evolved: * All versions before 22.2R3-S6-EVO, * from 22.4 before 22.4R3-S6-EVO, * from 23.2 before 23.2R2-S3-EVO, * from 23.4 before 23.4R2-S4-EVO, * from 24.2 before 24.2R2-EVO.

Meshtastic is an open source mesh networking solution. From 1.2.1 until 2.6.2, a packet sent to the routing module that contains want_response==true causes a crash. This can lead to a degradation of service for nodes within range of a malicious sender, or via MQTT if downlink is enabled. This vulnerability is fixed in 2.6.2.

In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".

Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a temporary denial of service.  If a watchdog timer is not enabled, a hard reset is required to recover the device.

An assert may be triggered, causing a temporary denial of service when a peer device sends a specially crafted malformed L2CAP packet. If a watchdog timer is not enabled, a hard reset is required to recover the device.

CVE-2024-47522 is a high-severity vulnerability in Suricata versions prior to 7.0.7. It involves a reachable assertion triggered by invalid ALPN values in TLS/QUIC traffic when JA4 matching and logging is enabled, causing Suricata to abort with a panic. This can lead to a denial of service condition. The issue is addressed in Suricata version 7.0.7. As a temporary mitigation, disabling JA4 matching can prevent the panic. There are no known exploits in the wild at this time.

CVE-2024-45795 is a reachable assertion vulnerability in OISF Suricata versions prior to 7.0.7. It occurs when rules use datasets with the non-functional or unimplemented "unset" option, which can trigger an assertion failure during traffic parsing. This results in a denial of service condition. The issue is resolved in Suricata version 7.0.7. Users are advised to upgrade to this version or use only trusted and well-tested rulesets as a workaround.

CVE-2024-8354 is a vulnerability in QEMU where an assertion failure occurs in the usb_ep_get() function when attempting to retrieve a USB endpoint from a USB device. This flaw can be triggered by a malicious unprivileged guest user to crash the QEMU process on the host, resulting in a denial of service (DoS). The vulnerability is rated medium severity with a CVSS score of 5.5. However, exploitation is considered unlikely under normal circumstances because unprivileged users cannot craft USB Request Blocks (URBs).

A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.

nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.

CVE-2024-32475 is a vulnerability in Envoy proxy where an upstream TLS cluster with auto_sni enabled can cause the Envoy process to terminate abnormally if a request contains a host or :authority header longer than 255 characters. This happens because Envoy attempts to use the header value as the SNI for outbound TLS connections without properly handling errors when the SNI length exceeds the 255-character limit defined by the standard. The issue is fixed in versions 1.30.1, 1.29.4, 1.28.3, and 1.27.5.

CVE-2024-3567 is a reachable assertion vulnerability in QEMU's update_sctp_checksum() function within the net component. It occurs when calculating the checksum of a short-sized fragmented packet, leading to an assertion failure. This flaw allows a malicious guest to crash QEMU, causing a denial of service (DoS) condition. The vulnerability has a CVSS score of 5.5 (medium severity). Red Hat has released security updates addressing this issue in qemu-kvm packages for Red Hat Enterprise Linux 9 and related variants.