FreeBSD : mediawiki -- multiple vulnerabilities (f84ab297-2285-11ec-9e79-08002789875b)

MediaWiki reports : T285515, CVE-2021-41798 SECURITY: XSS vulnerability in Special:Search. T290379, CVE-2021-41799 SECURITY: ApiQueryBacklinks can cause a full table scan. T284419, CVE-2021-41800 SECURITY: fix PoolCounter protection of Special:Contributions. T279090, CVE-2021-41801 SECURITY:...

FreeBSD : chromium -- multiple vulnerabilities (777edbbe-2230-11ec-8869-704d7b472482)

Chrome Releases/Stable updates reports : This release contains 4 security fixes, including : - 1245578 High CVE-2021-37974: Use after free in Safe Browsing. Reported by Weipeng Jiang @Krace from Codesafe Team of Legendsec at Qi'anxin Group on 2021-09-01 - 1252918 High CVE-2021-37975: Use after fr...

FreeBSD : Node.js -- July 2021 Security Releases (2) (f53dab71-1b15-11ec-9d9d-0022489ad614)

Node.js reports : Use after free on close http2 on stream canceling High CVE-2021-22930 Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

FreeBSD : nexus2-oss -- Apache ActiveMQ JMX vulnerability (730e922f-20e7-11ec-a574-080027eedc6a)

Sonatype reports : - CVE-2020-13920: Apache ActiveMQ JMX is vulnerable to a MITM attack %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributors...

FreeBSD : nexus2-oss -- NXRM2 Directory Traversal vulnerability (b2f1f86f-20e6-11ec-a574-080027eedc6a)

Sonatype reports : - CVE-2020-15012: NXRM2 Directory Traversal vulnerability %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributors...

FreeBSD : webkit2-gtk3 -- multiple vulnerabilities (576aa394-1d85-11ec-8b7d-4f5b624574e2)

The WebKitGTK project reports vulnerabilities : - CVE-2021-30858: Processing maliciously crafted web content may lead to arbitrary code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

FreeBSD : ha -- Directory traversals (5436f9a2-2190-11ec-a90b-0cc47a49470e)

Alexander Cherepanov reports : Version 0.999b and older of ha archiver is susceptible to directory traversal vulnerabilities via absolute and relative paths. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD...

FreeBSD : libpano13 -- arbitrary memory access through format string vulnerability (15e74795-0fd7-11ec-9f2e-dca632b19f10)

libpano13 developers reports : Fix crash and security issue caused by malformed filename prefix %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and...

FreeBSD : chromium -- use after free in Portals (b6c875f1-1d76-11ec-ae80-704d7b472482)

Chrome Releases reports : 1251727 High CVE-2021-37973 : Use after free in Portals. Reported by Clement Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero on 2021-09-21 Google is aware that an exploit for CVE-2021-37973 exists in the wil...

FreeBSD : zeek -- several vulnerabilities (d4d21998-bdc4-4a09-9849-2898d9b41459)

Tim Wojtulewicz of Corelight reports : Paths from log stream make it into system unchecked, potentially leading to commands being run on the system unintentionally. This requires either bad scripting or a malicious package to be installed, and is considered low severity. Fix potential unbounded...

FreeBSD : Apache httpd -- multiple vulnerabilities (882a38f9-17dd-11ec-b335-d4c9ef517024)

The Apache project reports : - moderate: Request splitting via HTTP/2 method injection and modproxy CVE-2021-33193 - moderate: NULL pointer dereference in httpd core CVE-2021-34798 - moderate: modproxyuwsgi out of bound read CVE-2021-36160 - low: apescapequotes buffer overflow CVE-2021-39275 -...

FreeBSD : Node.js -- August 2021 Security Releases (2) (7062bce0-1b17-11ec-9d9d-0022489ad614)

Node.js reports : npm 6 update - node-tar, arborist, npm cli modules These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal...

FreeBSD : libssh -- possible heap-buffer overflow vulnerability (57b1ee25-1a7c-11ec-9376-0800272221cc)

libssh security advisories : The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them is called secrethash and and the other sessionid. Initially, both of them are the same, but after key re-exchange, previous sessionid is kept and used as an input to new...

FreeBSD : Node.js -- August 2021 Security Releases (b092bd4f-1b16-11ec-9d9d-0022489ad614)

Node.js reports : cares upgrade - Improper handling of untypical characters in domain names High CVE-2021-22931 Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of host names returned by Domain Name Servers in the Node.js DNS library which...

FreeBSD : Node.js -- July 2021 Security Releases (c174118e-1b11-11ec-9d9d-0022489ad614)

Node.js reports : libuv upgrade - Out of bounds read Medium CVE-2021-22918 Node.js is vulnerable to out-of-bounds read in libuv's uvidnatoascii function which is used to convert strings to ASCII. This is called by Node's dns module's lookup function and can lead to information disclosures or...

FreeBSD : mod_auth_mellon -- Redirect URL validation bypass (7bba5b3b-1b7f-11ec-b335-d4c9ef517024)

Jakub Hrozek reports : Version 0.17.0 and older of modauthmellon allows the redirect URL validation to be bypassed by specifying an URL formatted as ///fishing-site.example.com/logout.html %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

FreeBSD : chromium -- multiple vulnerabilities (3551e106-1b17-11ec-a8a7-704d7b472482)

Chrome Releases reports : This update contains 19 security fixes, including : - 1243117 High CVE-2021-37956: Use after free in Offline use. Reported by Huyna at Viettel Cyber Security on 2021-08-24 - 1242269 High CVE-2021-37957: Use after free in WebGPU. Reported by Looben Yang on 2021-08-23 -...

FreeBSD : cURL -- Multiple vulnerabilities (c9221ec9-17a2-11ec-b335-d4c9ef517024)

The cURL project reports : - UAF and double-free in MQTT sending CVE-2021-22945 - Protocol downgrade required TLS bypassed CVE-2021-22946 - STARTTLS protocol injection via MITM CVE-2021-22945 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

FreeBSD : seatd-launch -- privilege escalation with SUID (49c35943-0eeb-421c-af4f-78e04582e5fb)

Kenny Levinsen reports : seatd-launch used execlp, which reads the PATH environment variable to search for the requested executable, to execute seatd. This meant that the caller could freely control what executable was loaded by adding a user-writable directory to PATH. If seatd-launch had the SU...

FreeBSD : chromium -- multiple vulnerabilities (47b571f2-157b-11ec-ae98-704d7b472482)

Chrome Releases reports : This release includes 11 security fixes, including : - 1237533 High CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06 - 1241036 High CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin o...