Jon Oberheide

The issue allows remote attackers to cause a denial of service (crash) via a sequence of beacon frames. This is achieved by sending one frame that omits an SSID Information Element (IE) and a subsequent frame that contains an SSID IE, which triggers a NULL pointer dereference in the `cmp ies` function.

The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and daemon crash. This can be achieved via a DTLS ChangeCipherSpec packet that occurs before the ClientHello packet.

The issue is related to multiple memory leaks in the dtls1 process out of seq message function in ssl/d1 both.c. Remote attackers can cause a denial of service (memory consumption) via DTLS records that are duplicates or have sequence numbers much greater than current sequence numbers.

Name of the Vulnerable Software and Affected Versions: Quagga versions 0.99.11 and earlier Description: The issue allows remote attackers to cause a denial of service, resulting in a crash, by sending an AS path with ASN elements whose string representation exceeds the expected length, triggering an assert error. Recommendations: For Quagga versions 0.99.11 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows remote attackers to cause a denial of service, potentially disrupting the availability of protected information. This can be achieved by sending a crafted mDNS packet with a source port of 0, which triggers an assertion failure in the `originates from local legacy unicast socket` function. The estimated number of potentially affected devices worldwide is not specified.

The issue allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pstopdf.log temporary file.

The issue makes it easy for users to accept self-signed certificates for the auto-update mechanism. This might allow remote user-assisted attackers to use DNS spoofing to trick users into visiting a malicious site and accepting a malicious certificate for the Mozilla update site. The malicious certificate can then be used to install arbitrary code on the next update.

The issue allows remote attackers to inject arbitrary web script or HTML via the filename of an attached file, which can lead to cross-site scripting (XSS) attacks.

The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the subject line to `follow.php` or the subject line in the user's personal control panel.

The issue concerns multiple vulnerabilities in the udev package and related libraries, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally, allowing local users to gain privileges by sending a NETLINK message from user space. The estimated number of potentially affected devices worldwide is not specified.