CVE-2015-1868

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself.

Metrics

CVSS 2.0 7.8/10AV:N/AC:L/Au:N/C:N/I:N/A:C

Weakness enumeration

CWE-399

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156648.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156655.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156667.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156680.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156725.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156743.htmlThird Party Advisory
http://www.debian.org/security/2015/dsa-3306
http://www.debian.org/security/2015/dsa-3307
http://www.securityfocus.com/bid/74306Third Party Advisory
http://www.securitytracker.com/id/1032220Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156648.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156655.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156667.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156680.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156725.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156743.htmlThird Party Advisory
http://www.debian.org/security/2015/dsa-3306
http://www.debian.org/security/2015/dsa-3307
http://www.securityfocus.com/bid/74306Third Party Advisory
http://www.securitytracker.com/id/1032220Third Party Advisory

Timeline

Published: May 18, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-18697.8The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink CVE-2015-18705.5The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, CVE-2015-18726.8The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Sta CVE-2015-18746.8Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8 CVE-2015-18757.5SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitra CVE-2015-18767.5Directory traversal vulnerability in ES File Explorer 3.2.4.1.CVE-2015-18778.8The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, CVE-2015-18786.8Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign ar CVE-2015-18794.3Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arb CVE-2015-18804.3Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject a CVE-2015-18814.0OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenti CVE-2015-18828.5Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to ga