FreeBSD Security Advisory - FreeBSD-SA-26:34.vt

FreeBSD Security Advisory - The CONSHISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the...

FreeBSD : strongSwan -- Double-free when destroying certain cloned identities that can lead to remote code execution (a207a367-6359-11f1-8c57-000af7b98cf6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a207a367-6359-11f1-8c57-000af7b98cf6 advisory. R. Elliott Childre reports: The clone method of the identificationt class doesn't correctly handle...

FreeBSD : Apache httpd -- Multiple vulnerabilities (7655baae-637d-11f1-8607-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7655baae-637d-11f1-8607-8447094a420f advisory. The Apache httpd project reports: See links for details. Tenable has extracted the preceding...

FreeBSD-SA-26:25.thr

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:25.thr Security Advisory The FreeBSD Project Topic: Missing permission check in thrkill22 Category: core Module: thr Announced: 2026-06-09 Credits: Yuxiang...

FreeBSD-SA-26:31.arm64

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:31.arm64 Security Advisory The FreeBSD Project Topic: Arm CPU errata may bypass page table permission changes Category: core Module: arm64 Announced:...

FreeBSD-SA-26:27.sound

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:27.sound Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in the sound4 mmap path Category: core Module: sound Announced: 2026-06-09...

FreeBSD -- sigqueue(2) missing capability mode restriction

Problem Description: sigqueue2 was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kernsigqueue did not include a capability mode check restricting signal delivery to the calling process's own PID. Impact: A process in capability mode ca...

FreeBSD -- Multiple vulnerabilities in the sound(4) mmap path

Problem Description: The sound4 driver contained two memory-safety errors in its mmap2 support. First, dspmmapsingle validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length...

FreeBSD -- Use-after-free bug in the IPV6_MSFILTER socket option handler

Problem Description: The kernel handler for IPV6MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed...

FreeBSD -- Missing permission check in thr_kill2(2)

Problem Description: When used to deliver a signal to a specific thread, thrkill22 called pcansignal to determine whether the operation was permitted but did not check the result before delivering the signal. The signal was sent even when the permission check failed. The system call returned the...

FreeBSD : Weechat -- Multiple vulnerabilities (df803002-624e-11f1-8607-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the df803002-624e-11f1-8607-8447094a420f advisory. The Weechat project reports: See links for detail. Tenable has extracted the preceding description bloc...

FreeBSD : Weechat -- Multiple vulnerabilities (d31259c0-624d-11f1-8607-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d31259c0-624d-11f1-8607-8447094a420f advisory. The Weechat project reports: See links for detail. Tenable has extracted the preceding description bloc...

FreeBSD : xwayland -- Multiple vulnerabilities (36cb0ced-5e23-11f1-86a2-589cfc10a551)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 36cb0ced-5e23-11f1-86a2-589cfc10a551 advisory. X.Org project reports: Multiple issues have been found in the X server and Xwayland...

FreeBSD : xorg-server -- Multiple vulnerabilities (592ced15-5e20-11f1-86a2-589cfc10a551)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 592ced15-5e20-11f1-86a2-589cfc10a551 advisory. X.Org project reports: Multiple issues have been found in the X server and Xwayland...

FreeBSD : Apache httpd -- DoS exploit in HTTP/2 (0d6d9d9b-5feb-11f1-8607-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0d6d9d9b-5feb-11f1-8607-8447094a420f advisory. Calif security reports: Remote DoS in modhttp2 Tenable has extracted the preceding description block...

FreeBSD : chromium -- security fixes (e725f5d5-5c24-11f1-b189-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e725f5d5-5c24-11f1-b189-a8a1599412c6 advisory. Chrome Releases reports: This update includes 151 security fixes: Tenable has extracted the...

CVE-2026-45158

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability i...

ANT-2026-MVVACQKN · freebsd/freebsd-src · Stack Buffer Overflow

stack-buffer-overflow high CVE-2026-4747 Severity Claude high · Security research firm - · Maintainer high REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-MVVACQKN: Unauthenticated remote code execution via svcrpcgssvalidate stack overflow svcrpcgssvalidate in the FreeBS...

ANT-2026-5DFBSQR9 · freebsd/freebsd-src · Use-After-Free / Type Confusion

use-after-free high CVE-2026-5398 CVE-2026-6386 Severity Claude high · Security research firm - · Maintainer high REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-5DFBSQR9: Local privilege escalation via ttydropctty tsession UAF + pmappkruupdaterange PDPE walk In...

FreeBSD : www/gohugo -- CWE-79: XSS vulnerabilities (20d59b47-5ba3-11f1-bf1b-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 20d59b47-5ba3-11f1-bf1b-b42e991fc52e advisory. https://go.dev/issue/78913 reports: CVE-2026-27142 fixed a vulnerability in which URLs were no...