Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
sion 5.3.6.7 and earlier (for RC-S320, RC-S310/J1C, RC-S310/ED4C), PC/SC Activator for Type B Ver.1.2.1.0 and earlier, SFCard Viewer 2 Ver.2.5.0.0 and earlier, NFC Net Installer Ver.1.1.0.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN16136413/index.html
CVE ID: CVE-2017-2287 State: PUBLISHED Published: 2017-08-02T16:00:00 Last Updated: 2024-08-05T13:48:05.231Z Vendors: Sony Corporation Products: NFC Port Software remover Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in NFC Port Software remover Ver.1.3.0.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN33797604/index.html
CVE ID: CVE-2017-2288 State: PUBLISHED Published: 2017-08-02T16:00:00 Last Updated: 2024-08-05T13:48:05.218Z Vendors: Claybird Products: LhaForge Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in LhaForge Ver.1.6.5 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN74554973/index.html
CVE ID: CVE-2017-2289 State: PUBLISHED Published: 2017-08-18T13:00:00 Last Updated: 2024-08-05T13:48:05.316Z Vendors: KDDI CORPORATION Products: Installer of Qua station connection tool for Windows Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in Installer of Qua station connection tool for Windows version 1.00.03 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN81659403/index.html
CVE ID: CVE-2017-2290 State: PUBLISHED Published: 2017-03-03T15:00:00 Last Updated: 2024-08-05T13:48:05.267Z Vendors: Puppet Products: mcollective-puppet-agent plugin Problem Types: Privilege Escalation Description: On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96583 - https://puppet.com/security/cve/cve-2017-2290
CVE ID: CVE-2017-2292 State: PUBLISHED Published: 2017-06-30T20:00:00Z Last Updated: 2024-09-16T23:52:02.685Z Vendors: Puppet Products: mcollective, Puppet, Puppet Enterprise Problem Types: Remote Code Execution Via YAML Deserialization Description: Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-party plugins could rely on this insecure behavior. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com
ould rely on this insecure behavior. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/cve-2017-2292 - https://security.gentoo.org/glsa/201709-01
CVE ID: CVE-2017-2293 State: PUBLISHED Published: 2018-02-01T22:00:00Z Last Updated: 2024-09-16T17:33:31.679Z Vendors: Puppet Products: Puppet Enterprise Problem Types: Privilege Escalation Description: Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. This release adds default configuration to not allow these actions. Customers who rely on this functionality can change this policy. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/cve-2017-2293
CVE ID: CVE-2017-2294 State: PUBLISHED Published: 2017-07-05T15:00:00Z Last Updated: 2024-09-17T02:20:34.679Z Vendors: Puppet Products: Puppet Enterprise Problem Types: client private keys insufficiently protected Description: Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/cve-2017-2294
CVE ID: CVE-2017-2295 State: PUBLISHED Published: 2017-07-05T15:00:00Z Last Updated: 2024-09-16T20:43:40.186Z Vendors: Puppet Products: Puppet server Problem Types: Remote Code Execution Description: Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/cve-2017-2295 - http://www.debian.org/security/2017/dsa
Program Container: References: - https://puppet.com/security/cve/cve-2017-2295 - http://www.debian.org/security/2017/dsa-3862 - http://www.securityfocus.com/bid/98582
CVE ID: CVE-2017-2296 State: PUBLISHED Published: 2018-02-01T22:00:00Z Last Updated: 2024-09-17T03:48:29.424Z Vendors: Puppet Products: Puppet Enterprise Problem Types: Denial of Service Description: In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes errors, effectively causing a DOS to the service. This was resolved in Puppet Enterprise 2017.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/cve-2017-2296
CVE ID: CVE-2017-2297 State: PUBLISHED Published: 2018-02-01T22:00:00Z Last Updated: 2024-09-17T00:56:12.336Z Vendors: Puppet Products: Puppet Enterprise Problem Types: Authentication Bypass Description: Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been fixed in Puppet Enterprise 2016.4.5 and 2017.2.1. This only affects users with labeled tokens, which is not the default for tokens. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/cve-2017-2297
CVE ID: CVE-2017-2298 State: PUBLISHED Published: 2017-06-30T20:00:00Z Last Updated: 2024-09-16T18:08:33.665Z Vendors: Puppet Products: mcollective Problem Types: missing input sanitization Description: The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised server could use this to write a file to an arbitrary location on the client with the filename appended with the string "_pub.pem". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/puppetlabs/mcollective-sshkey-security/blob/0.5.1/CHANGELOG.md - https://puppet.com/security/cve/cve-2017-2298 - https://githu
labs/mcollective-sshkey-security/blob/0.5.1/CHANGELOG.md - https://puppet.com/security/cve/cve-2017-2298 - https://github.com/puppetlabs/mcollective-sshkey-security/commit/3388a3109f4fb1c69fa8505e991bf59ca20d19a2
CVE ID: CVE-2017-2299 State: PUBLISHED Published: 2017-09-15T18:00:00Z Last Updated: 2024-09-16T18:59:14.375Z Vendors: Puppet Products: puppetlabs-apache Problem Types: Unsafe defaults affecting access controls Description: Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parameter but do not specify the `ssl_certs_dir` parameter, a default will be provided for the `ssl_certs_dir` that will trust certificates from any of the system-trusted certificate authorities. This did not affect FreeBSD. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/
d not affect FreeBSD. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100859 - https://puppet.com/security/cve/CVE-2017-2299
CVE ID: CVE-2017-2300 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T13:48:05.266Z Vendors: Juniper Networks Products: Junos OS on SRX Series Services Gateways chassis cluster Problem Types: flowd daemon crash denial of service vulnerability Description: On Juniper Networks SRX Series Services Gateways chassis clusters running Junos OS 12.1X46 prior to 12.1X46-D65, 12.3X48 prior to 12.3X48-D40, 12.3X48 prior to 12.3X48-D60, flowd daemon on the primary node of an SRX Series chassis cluster may crash and restart when attempting to synchronize a multicast session created via crafted multicast packets. Additional Analyst Notes: - CVE Program Container: References: - htt
cast session created via crafted multicast packets. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10768 - http://www.securityfocus.com/bid/95400 - http://www.securitytracker.com/id/1037597
CVE ID: CVE-2017-2301 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T13:48:05.276Z Vendors: Juniper Networks Products: Junos OS with DHCPv6 enabled Problem Types: jdhcpd daemon crash denial of service vulnerability Description: On Juniper Networks products or platforms running Junos OS 11.4 prior to 11.4R13-S3, 12.1X46 prior to 12.1X46-D60, 12.3 prior to 12.3R12-S2 or 12.3R13, 12.3X48 prior to 12.3X48-D40, 13.2X51 prior to 13.2X51-D40, 13.3 prior to 13.3R10, 14.1 prior to 14.1R8, 14.1X53 prior to 14.1X53-D12 or 14.1X53-D35, 14.1X55 prior to 14.1X55-D35, 14.2 prior to 14.2R7, 15.1 prior to 15.1F6 or 15.1R3, 15.1X49 prior to 15.1X49-D60, 15.1X53 prior to 15.1X53-D30 a
-D35, 14.2 prior to 14.2R7, 15.1 prior to 15.1F6 or 15.1R3, 15.1X49 prior to 15.1X49-D60, 15.1X53 prior to 15.1X53-D30 and DHCPv6 enabled, when a crafted DHCPv6 packet is received from a subscriber, jdhcpd daemon crashes and restarts. Repeated crashes of the jdhcpd process may constitute an extended denial of service condition for subscribers attempting to obtain IPv6 addresses. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95396 - http://www.securitytracker.com/id/1037596 - https://kb.juniper.net/JSA10769
CVE ID: CVE-2017-2302 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T13:48:05.249Z Vendors: Juniper Networks Products: Junos OS where the BGP add-path feature is enabled with 'send' option or with both 'send' and 'receive' options Problem Types: rpd daemon crash denial of service Description: On Juniper Networks products or platforms running Junos OS 12.1X46 prior to 12.1X46-D55, 12.1X47 prior to 12.1X47-D45, 12.3R13 prior to 12.3R13, 12.3X48 prior to 12.3X48-D35, 13.3 prior to 13.3R10, 14.1 prior to 14.1R8, 14.1X53 prior to 14.1X53-D40, 14.1X55 prior to 14.1X55-D35, 14.2 prior to 14.2R6, 15.1 prior to 15.1F2 or 15.1R1, 15.1X49 prior to 15.1X49-D20 where the BGP add
ior to 14.1X55-D35, 14.2 prior to 14.2R6, 15.1 prior to 15.1F2 or 15.1R1, 15.1X49 prior to 15.1X49-D20 where the BGP add-path feature is enabled with 'send' option or with both 'send' and 'receive' options, a network based attacker can cause the Junos OS rpd daemon to crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10771 - http://www.securitytracker.com/id/1037595 - http://www.securityfocus.com/bid/95394
CVE ID: CVE-2017-2303 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T13:48:05.339Z Vendors: Juniper Networks Products: Junos OS where RIP is enabled Problem Types: RPD daemon to crash denial of service Description: On Juniper Networks products or platforms running Junos OS 12.1X46 prior to 12.1X46-D50, 12.1X47 prior to 12.1X47-D40, 12.3 prior to 12.3R13, 12.3X48 prior to 12.3X48-D30, 13.2X51 prior to 13.2X51-D40, 13.3 prior to 13.3R10, 14.1 prior to 14.1R8, 14.1X53 prior to 14.1X53-D35, 14.1X55 prior to 14.1X55-D35, 14.2 prior to 14.2R5, 15.1 prior to 15.1F6 or 15.1R3, 15.1X49 prior to 15.1X49-D30 or 15.1X49-D40, 15.1X53 prior to 15.1X53-D35, and where RIP is enable
to 15.1F6 or 15.1R3, 15.1X49 prior to 15.1X49-D30 or 15.1X49-D40, 15.1X53 prior to 15.1X53-D35, and where RIP is enabled, certain RIP advertisements received by the router may cause the RPD daemon to crash resulting in a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95408 - http://www.securitytracker.com/id/1037594 - https://kb.juniper.net/JSA10772
CVE ID: CVE-2017-2304 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T13:48:05.313Z Vendors: Juniper Networks Products: Junos OS running on QFX3500, QFX3600, QFX5100, QFX5200, EX4300, EX4600 devices Problem Types: information leak Description: Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53-D40, 15.1X53 prior to 15.1X53-D40, 15.1 prior to 15.1R2, do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets. This issue is also known as 'Etherleak' Additional Analyst Notes: - CVE Program Container: References: - http://www.secur
his issue is also known as 'Etherleak' Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037593 - http://www.securityfocus.com/bid/95403 - https://kb.juniper.net/JSA10773
CVE ID: CVE-2017-2305 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T13:48:05.222Z Vendors: Juniper Networks Products: Junos Space Problem Types: insufficient authorization check Description: On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can create privileged users, allowing privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98759 - https://kb.juniper.net/JSA10770
CVE ID: CVE-2017-2306 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T13:48:05.310Z Vendors: Juniper Networks Products: Junos Space Problem Types: insufficient authorization check leading to code execution Description: On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10770 - http://www.securityfocus.com/bid/98772
CVE ID: CVE-2017-2307 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T13:48:05.388Z Vendors: Juniper Networks Products: Junos Space Problem Types: reflected cross site scripting vulnerability Description: A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98749 - https://kb.juniper.net/JSA10770
CVE ID: CVE-2017-2308 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T13:48:05.272Z Vendors: Juniper Networks Products: Junos Space Problem Types: XML external entity injection vulnerability Description: An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files on the device. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10770 - http://www.securityfocus.com/bid/98755
CVE ID: CVE-2017-2309 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T13:48:05.397Z Vendors: Juniper Networks Products: Junos Space Problem Types: information leak vulnerability Description: On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos Space cluster, some restricted web services are accessible over the network. This represents an information leak risk. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98750 - https://kb.juniper.net/JSA10770
CVE ID: CVE-2017-2310 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T13:48:05.366Z Vendors: Juniper Networks Products: Junos Space Problem Types: firewall bypass vulnerability Description: A firewall bypass vulnerability in the host based firewall of Juniper Networks Junos Space versions prior to 16.1R1 may permit certain crafted packets, representing a network integrity risk. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98751 - https://kb.juniper.net/JSA10770
CVE ID: CVE-2017-2311 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T13:48:05.266Z Vendors: Juniper Networks Products: Junos Space Problem Types: denial of service vulnerability Description: On Juniper Networks Junos Space versions prior to 16.1R1, an unauthenticated remote attacker with network access to Junos space device can easily create a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10770 - http://www.securityfocus.com/bid/98748
CVE ID: CVE-2017-2312 State: PUBLISHED Published: 2017-04-24T15:00:00 Last Updated: 2024-08-05T13:48:05.290Z Vendors: Juniper Networks Products: Junos OS with LDP enabled Problem Types: denial of service vulnerability due to memory leak Description: On Juniper Networks devices running Junos OS affected versions and with LDP enabled, a specific LDP packet destined to the RE (Routing Engine) will consume a small amount of the memory allocated for the rpd (routing protocol daemon) process. Over time, repeatedly receiving this type of LDP packet(s) will cause the memory to exhaust and the rpd process to crash and restart. It is not possible to free up the memory that has been consumed without re
ust and the rpd process to crash and restart. It is not possible to free up the memory that has been consumed without restarting the rpd process. This issue affects Junos OS based devices with either IPv4 or IPv6 LDP enabled via the [protocols ldp] configuration (the native IPv6 support for LDP is available in Junos OS 16.1 and higher). The interface on which the packet arrives needs to have LDP enabled. The affected Junos versions are: 13.3 prior to 13.3R10; 14.1 prior to 14.1R8; 14.2 prior to 14.2R7-S6 or 14.2R8; 15.1 prior to 15.1F2-S14, 15.1F6-S4, 15.1F7, 15.1R4-S7, 15.1R5; 15.1X49 before 15.1X49-D70; 15.1X53 before 15.1X53-D230, 15.1X53-D63, 15.1X53-D70; 16.1 before 16.1R2. 16.2R1 and a
1R5; 15.1X49 before 15.1X49-D70; 15.1X53 before 15.1X53-D230, 15.1X53-D63, 15.1X53-D70; 16.1 before 16.1R2. 16.2R1 and all subsequent releases have a resolution for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97611 - http://www.securitytracker.com/id/1038252 - https://kb.juniper.net/JSA10777
CVE ID: CVE-2017-2313 State: PUBLISHED Published: 2017-04-24T15:00:00 Last Updated: 2024-08-05T13:48:05.294Z Vendors: Juniper Networks Products: Junos OS with BGP enabled Problem Types: denial of service vulnerability Description: Juniper Networks devices running affected Junos OS versions may be impacted by the receipt of a crafted BGP UPDATE which can lead to an rpd (routing process daemon) crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition. The affected Junos OS versions are: 15.1 prior to 15.1F2-S15, 15.1F5-S7, 15.1F6-S5, 15.1F7, 15.1R4-S7, 15.1R5-S2, 15.1R6; 15.1X49 prior to 15.1X49-D78, 15.1X49-D80; 15.1X53 prior to 15.1X53-D230,
.1F6-S5, 15.1F7, 15.1R4-S7, 15.1R5-S2, 15.1R6; 15.1X49 prior to 15.1X49-D78, 15.1X49-D80; 15.1X53 prior to 15.1X53-D230, 15.1X53-D63, 15.1X53-D70; 16.1 prior to 16.1R3-S3, 16.1R4; 16.2 prior to 16.2R1-S3, 16.2R2; Releases prior to Junos OS 15.1 are unaffected by this vulnerability. 17.1R1, 17.2R1, and all subsequent releases have a resolution for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10778 - http://www.securitytracker.com/id/1038257 - http://www.securityfocus.com/bid/97606
CVE ID: CVE-2017-2314 State: PUBLISHED Published: 2017-07-14T14:00:00Z Last Updated: 2024-09-16T19:25:40.759Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: routing protocol daemon (rpd) crash denial of service Description: Receipt of a malformed BGP OPEN message may cause the routing protocol daemon (rpd) process to crash and restart. By continuously sending specially crafted BGP OPEN messages, an attacker can repeatedly crash the rpd process causing prolonged denial of service. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS 12.3 pr
niper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS 12.3 prior to 12.3R12-S4, 12.3R13, 12.3R3-S4; 12.3X48 prior to 12.3X48-D50; 13.3 prior to 13.3R4-S11, 13.3R10; 14.1 prior to 14.1R8-S3, 14.1R9; 14.1X53 prior to 14.1X53-D40; 14.1X55 prior to 14.1X55-D35; 14.2 prior to 14.2R4-S7, 14.2R6-S4, 14.2R7; 15.1 prior to 15.1F2-S11, 15.1F4-S1-J1, 15.1F5-S3, 15.1F6, 15.1R4; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D33, 15.1X53-D50. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10779 - http://www.securitytracker.com/id/1038889
CVE ID: CVE-2017-2315 State: PUBLISHED Published: 2017-04-24T15:00:00 Last Updated: 2024-08-05T13:48:05.274Z Vendors: Juniper Networks Products: Junos OS on EX series Ethernet Switches with IPv6 enabled Problem Types: denial of service vulnerability due to memory leak Description: On Juniper Networks EX Series Ethernet Switches running affected Junos OS versions, a vulnerability in IPv6 processing has been discovered that may allow a specially crafted IPv6 Neighbor Discovery (ND) packet destined to an EX Series Ethernet Switch to cause a slow memory leak. A malicious network-based packet flood of these crafted IPv6 NDP packets may eventually lead to resource exhaustion and a denial of servic
k-based packet flood of these crafted IPv6 NDP packets may eventually lead to resource exhaustion and a denial of service. The affected Junos OS versions are: 12.3 prior to 12.3R12-S4, 12.3R13; 13.3 prior to 13.3R10; 14.1 prior to 14.1R8-S3, 14.1R9; 14.1X53 prior ro 14.1X53-D12, 14.1X53-D40; 14.1X55 prior to 14.1X55-D35; 14.2 prior to 14.2R6-S4, 14.2R7-S6, 14.2R8; 15.1 prior to 15.1R5; 16.1 before 16.1R3; 16.2 before 16.2R1-S3, 16.2R2. 17.1R1 and all subsequent releases have a resolution for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1038253 - http://www.securityfocus.com/bid/97615 - https://kb.juniper.net/JSA10781