FreeBSD 安全漏洞

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. FreeBSD suffers from a security vulnerability that exists as a result of a race condition in netmap. A local user can trigger the race condition, which can lead to memory corruption and code execution. An attacker...

FreeBSD -- zlib compression out-of-bounds write

Problem Description: Certain inputs can cause zlib's compression routine to overwrite an internal buffer with compressed data. This issue may require the use of uncommon or non-default compression parameters. Impact: The out-of-bounds write may result in memory corruption and an application crash...

FreeBSD -- Bhyve e82545 device emulation out-of-bounds write

Problem Description: The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP checksums, insertion of an Ethernet VLAN header, and TCP segmentation offload "TSO". The e1000 device model uses an...

FreeBSD -- Potential jail escape vulnerabilities in netmap

Problem Description: The total size of the user-provided nmreq to nmreqcopyin was first computed and then trusted during the copyin. This time-of-check to time-of-use bug could lead to kernel memory corruption. CVE-2022-23084 A user-provided integer option was passed to nmreqcopyin without checki...

FreeBSD -- 802.11 heap buffer overflow

Problem Description: The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. Impact: While a FreeBSD Wi-Fi client is in scanning mode i.e., not associated with a SSID a malicious beacon frame may overwrite kernel...

FreeBSD-SA-22:06.ioctl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-22:06.ioctl Security Advisory The FreeBSD Project Topic: mpr/mps/mpt driver ioctl heap out-of-bounds write Category: core Module: mpr, mps, mpt Announced:...

FreeBSD-SA-22:05.bhyve

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-22:05.bhyve Security Advisory The FreeBSD Project Topic: Bhyve e82545 device emulation out-of-bounds write Category: core Module: bhyve Announced: 2022-04-06...

FreeBSD-SA-22:04.netmap

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-22:04.netmap Security Advisory The FreeBSD Project Topic: Potential jail escape vulnerabilities in netmap Category: core Module: netmap Announced: 2022-04-06...

FreeBSD : chromium -- Type confusion in V8 (fe15f30a-b4c9-11ec-94a3-3065ec8fd3ec)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fe15f30a-b4c9-11ec-94a3-3065ec8fd3ec advisory. - Type confusion in V8 in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially...

FreeBSD : mediawiki -- multiple vulnerabilities (79ea6066-b40e-11ec-8b93-080027b24e86)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 79ea6066-b40e-11ec-8b93-080027b24e86 advisory. - An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x...

FreeBSD : Gitlab -- multiple vulnerabilities (8657eedd-b423-11ec-9559-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 8657eedd-b423-11ec-9559-001b217b3468 advisory. - Incorrect authorization in the Asana integration's branch restriction feature in all version...

FreeBSD : dnsmasq -- heap use-after-free in dhcp6_no_relay (3f321a5a-b33b-11ec-80c2-1bb2c6a00592)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3f321a5a-b33b-11ec-80c2-1bb2c6a00592 advisory. - A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an...

FreeBSD : chromium -- multiple vulnerabilities (ab2d7f62-af9d-11ec-a0b8-3065ec8fd3ec)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ab2d7f62-af9d-11ec-a0b8-3065ec8fd3ec advisory. - Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who...

FreeBSD : gitea -- Improper/incorrect authorization (0ff80f41-aefe-11ec-b4b6-d05099c0c059)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0ff80f41-aefe-11ec-b4b6-d05099c0c059 advisory. - Improper Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. CVE-2022-0905 Note that...

FreeBSD : gitea -- Open Redirect on login (83466f76-aefe-11ec-b4b6-d05099c0c059)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 83466f76-aefe-11ec-b4b6-d05099c0c059 advisory. - Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. CVE-2022-1058 Note that...

FreeBSD : chromium -- V8 type confusion (323f900d-ac6d-11ec-a0b8-3065ec8fd3ec)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 323f900d-ac6d-11ec-a0b8-3065ec8fd3ec advisory. - Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially...

FreeBSD : go -- multiple vulnerabilities (e2af876f-a7c8-11ec-9a2a-002324b2fba8)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e2af876f-a7c8-11ec-9a2a-002324b2fba8 advisory. - regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply...

FreeBSD : openhab -- log4j remote code injection (93a1c9a7-5bef-11ec-a47a-001517a2e1a4)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 93a1c9a7-5bef-11ec-a47a-001517a2e1a4 advisory. - Apache Log4j2 2.10 this behavior can be mitigated by setting system property log4j2.formatMsgNoLookup...

FreeBSD : openvpn -- Potential authentication by-pass with multiple deferred authentication plug-ins (45a72180-a640-11ec-a08b-85298243e224)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 45a72180-a640-11ec-a08b-85298243e224 advisory. - OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication...

FreeBSD : Apache httpd -- Multiple vulnerabilities (6601c08d-a46c-11ec-8be6-d4c9ef517024)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6601c08d-a46c-11ec-8be6-d4c9ef517024 advisory. - A carefully crafted request body can cause a read to a random memory area which could cause...