FreeBSD 缓冲区错误漏洞

FreeBSD is a set of Unix-like operating systems from the Freebsd Foundation. A buffer error vulnerability exists in the FreeBSD ggatec daemon, which originates when a networked system or product performs an operation in memory without properly validating data boundaries, resulting in an incorrect...

FreeBSD-SA-21:16.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:16.openssl Security Advisory The FreeBSD Project Topic: Multiple OpenSSL vulnerabilities Category: contrib Module: openssl Announced: 2021-08-24 Credits: See...

FreeBSD-SA-21:17.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:17.openssl Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in OpenSSL Category: contrib Module: openssl Announced: 2021-08-24 Affects:...

FreeBSD-SA-21:13.bhyve

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:13.bhyve Security Advisory The FreeBSD Project Topic: Missing error handling in bhyve8 device models Category: core Module: bhyve Announced: 2021-08-24...

FreeBSD -- libfetch out of bounds read

Problem Description: The passive mode in FTP communication allows an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for p == '\0' one byte too late because...

FreeBSD-SA-21:14.ggatec

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:14.ggatec Security Advisory The FreeBSD Project Topic: Remote code execution in ggatec8 Category: core Module: ggatec Announced: 2021-08-24 Credits: Johannes...

FreeBSD-SA-21:15.libfetch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:15.libfetch Security Advisory The FreeBSD Project Topic: libfetch out of bounds read Category: core Module: libfetch Announced: 2021-08-24 Credits: Samanta...

FreeBSD -- Missing error handling in bhyve(8) device models

Problem Description: Certain VirtIO-based device models failed to handle errors when fetching I/O descriptors. Such errors could be triggered by a malicious guest. As a result, the device model code could be tricked into operating on uninitialized I/O vectors, leading to memory corruption. Impact...

FreeBSD -- Remote code execution in ggatec(8)

Problem Description: The ggatec8 daemon does not validate the size of a response before writing it to a fixed-sized buffer. This allows to overwrite the stack of ggatec8. Impact: A malicious ggated8 or an attacker in a priviledged network position can overwrite the stack with crafted content and...

FreeBSD : gitea -- multiple vulnerabilities (d3180f02-031e-11ec-875f-0800273f11ea)

The Gitea Team reports for release 1.15.0 : - Encrypt LDAP bind password in db with SECRETKEY 15547 - Remove random password in Dockerfiles 15362 - Upgrade to the latest version of golang-jwt and increase minimum go to 1.15 16590 16606 - Correctly create of git-daemon-export-ok files 16508 16514 ...

FreeBSD : bouncycastle15 -- bcrypt password checking vulnerability (70e71a24-0151-11ec-bf0c-080027eedc6a)

The Bouncy Castle team reports : The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

FreeBSD : bouncycastle15 -- EC math vulnerability (89d5bca6-0150-11ec-bf0c-080027eedc6a)

The Bouncy Castle team reports: : Bouncy Castle BC Java before 1.66 has a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures. %NASLMINLEVEL...

FreeBSD : gitea -- multiple vulnerabilities (733afd81-01cf-11ec-aec9-0800273f11ea)

The Gitea Team reports for release 1.14.6 : - Bump github.com/markbates/goth from v1.67.1 to v1.68.0 16538 16540 - Switch to maintained JWT lib 16532 16535 - Upgrade to latest version of golang-jwt as forked for 1.14 16590 16607 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

ICMP 'Etherleak' Information Disclosure

The remote host is prone to an information disclosure vulnerability over ICMP dubbed SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...

FreeBSD : binutils -- excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c read_section() (f4c54b81-bcc8-11eb-a7a6-080027f515ea)

Hao Wang reports : There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of excessive memory consumption. %NASLMINLEVE...

FreeBSD : chromium -- multiple vulnerabilities (128deba6-ff56-11eb-8514-3065ec8fd3ec)

Chrome Releases reports : This release contains 9 security fixes, including : - 1234764 High CVE-2021-30598: Type Confusion in V8. Reported by Manfred Paul on 2021-07-30 - 1234770 High CVE-2021-30599: Type Confusion in V8. Reported by Manfred Paul on 2021-07-30 - 1231134 High CVE-2021-30600: Use...

FreeBSD : lynx -- SSL certificate validation error (e9200f8e-fd34-11eb-afb1-c85b76ce9b5a)

Axel Beckert reports : ... I was able to capture the password given on the commandline in traffic of an TLS handshake using tcpdump and analysing it with Wireshark: ... %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

FreeBSD : PostgreSQL server -- Memory disclosure in certain queries (b471130b-fb86-11eb-87db-6cc21735f730)

The PostgreSQL Project reports : A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include...

FreeBSD : x11/cde -- Local privilege escalation via CDE dtsession (848bdd06-f93a-11eb-9f7d-206a8a720317)

Marco Ivaldi marco.ivaldi mediaservice net reports : A buffer overflow in the CheckMonitor function in the Common Desktop Environment 2.3.1 and earlier and 1.6 and earlier, as distributed with Oracle Solaris 10 1/13 Update 11 and earlier, allows local users to gain root privileges via a long...

FreeBSD : xtrlock -- xtrlock does not block multitouch events (e80073d7-f8ba-11eb-b141-589cfc007716)

Debian reports : xtrlock did not block multitouch events so an attacker could still input and thus control various programs such as Chromium, etc. via so-called 'multitouch' events including pan scrolling, 'pinch and zoom' or even being able to provide regular mouse clicks by depressing the...