CVE-2015-5695

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted resource record set.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.openstack.org/pipermail/openstack/2015-July/013548.htmlPatch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/07/28/11Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/07/29/6Mailing List, Third Party Advisory
https://bugs.launchpad.net/designate/+bug/1471161Exploit, Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1245241Issue Tracking, Third Party Advisory
https://launchpadlibrarian.net/211525251/bug-1471161-quotas-master.patchMailing List, Patch, Third Party Advisory
http://lists.openstack.org/pipermail/openstack/2015-July/013548.htmlPatch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/07/28/11Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/07/29/6Mailing List, Third Party Advisory
https://bugs.launchpad.net/designate/+bug/1471161Exploit, Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1245241Issue Tracking, Third Party Advisory
https://launchpadlibrarian.net/211525251/bug-1471161-quotas-master.patchMailing List, Patch, Third Party Advisory

Timeline

Published: Aug 31, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-56965.0Dell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request.CVE-2015-56972.1The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which CVE-2015-56987.5Cross-site request forgery (CSRF) vulnerability in the web server on Siemens SIMATIC S7-1200 CPU devices with firmware before 4.1.3 allows r CVE-2015-56997.8The Switch Configuration Tools Backend (clcmd_server) in Cumulus Linux 2.5.3 and earlier allows local users to execute arbitrary commands vi CVE-2015-57006.1mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.CVE-2015-57016.1mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary files via a symlink attac CVE-2015-57036.5SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated user CVE-2015-57047.8scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands.CVE-2015-57057.5Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and c CVE-2015-57064.6Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to ca CVE-2015-57074.6Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x before 4.1 allows local users to ca CVE-2015-57114.0TIBCO Managed File Transfer Internet Server before 7.2.5, Managed File Transfer Command Center before 7.2.5, Slingshot before 1.9.4, and Vau