FreeBSD-SA-21:11.smap

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:11.smap Security Advisory The FreeBSD Project Topic: SMAP bypass Category: core Module: amd64 Announced: 2021-05-26 Credits: I lost my dog if you see him...

FreeBSD : libzmq4 -- Stack overflow (6954a2b0-bda8-11eb-a04e-641c67a117d8)

Fang-Pen Lin reports : A remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running...

FreeBSD : libzmq4 -- Denial of Service (21ec4428-bdaa-11eb-a04e-641c67a117d8)

Google's oss-fuzz project reports : Denial-of-Service on CURVE/ZAP-protected servers by unauthenticated clients. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete...

FreeBSD-SA-21:12.libradius

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:12.libradius Security Advisory The FreeBSD Project Topic: Missing message validation in libradius3 Category: core Module: libradius Announced: 2021-05-26...

FreeBSD : texproc/expat2 -- billion laugh attack (5fa90ee6-bc9e-11eb-a287-e0d55e2a8bf9)

Kurt Seifried reports : So here are the CVE's for the two big ones, libxml2 and expat. Both are affected by the expansion of internal entities which can be used to consume resources and external entities which can cause a denial of service against other services, be used to port scan, etc.. A...

FreeBSD : PG Partition Manager -- arbitrary code execution (58b22f3a-bc71-11eb-b9c9-6cc21735f730)

PG Partition Manager reports : In the pgpartman aka PG Partition Manager extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER functions because an explicit searchpath is not set. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

FreeBSD : libxml2 -- Possible denial of service (524bd03a-bb75-11eb-bf35-080027f515ea)

Daniel Veillard reports : A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD TCP/IP Stack - HTTP Detection

Binary data freebsdtcpipstackhttpdetect.nbin...

FreeBSD : PostgreSQL server -- two security issues (62da9702-b4cc-11eb-b9c9-6cc21735f730)

The PostgreSQL project reports : Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can...

FreeBSD : PostgreSQL -- Memory disclosure in partitioned-table UPDATE ... RETURNING (76e0bb86-b4cb-11eb-b9c9-6cc21735f730)

The PostgreSQL project reports : Using an UPDATE ... RETURNING on a purpose-crafted partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user...

FreeBSD : ImageMagick7 -- multiple vulnerabilities (a7c60af1-b3f1-11eb-a5f7-a0f3c100ae18)

CVE reports : Several vulnerabilities have been discovered in ImageMagick : - CVE-2021-20313: A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. - CVE-2021-20312: A flaw was found in ImageMagick in...

FreeBSD : Prosody -- multiple vulnerabilities (fc75570a-b417-11eb-a23d-c7ab331fd711)

The Prosody security advisory 2021-05-12 reports : This advisory details 5 new security vulnerabilities discovered in the Prosody.im XMPP server software. All issues are fixed in the 0.11.9 release default configuration. - CVE-2021-32918: DoS via insufficient memory consumption controls -...

FreeBSD : ImageMagick6 -- multiple vulnerabilities (3e0ca488-b3f6-11eb-a5f7-a0f3c100ae18)

CVE reports : Several vulnerabilities have been discovered in ImageMagick : - CVE-2021-20309: A flaw was found in ImageMagick in versions before 6.9.12, where a division by zero in WaveImage of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an...

FreeBSD : Pillow -- multiple vulnerabilities (f947aa26-b2f9-11eb-a5f7-a0f3c100ae18)

python-pillow reports : This release fixes several vulnerabilities found with OSS-Fuzz. - CVE-2021-25288: Fix OOB read in Jpeg2KDecode. This dates to Pillow 2.4.0. - CVE-2021-28675: Fix DOS in PsdImagePlugin. This dates to the PIL fork. - CVE-2021-28676: Fix FLI DOS. This dates to the PIL fork. -...

FreeBSD : py-matrix-synapse -- malicious push rules may be used for a denial of service attack. (278561d7-b261-11eb-b788-901b0e934d69)

Matrix developers report : 'Push rules' can specify conditions under which they will match, including eventmatch, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when...

FreeBSD : chromium -- multiple vulnerabilities (3cac007f-b27e-11eb-97a0-e09467587c17)

Chrome Releases reports : This release contains 19 security fixes, including : - 1180126 High CVE-2021-30506: Incorrect security UI in Web App Installs. Reported by @retsew0x01 on 2021-02-19 - 1178202 High CVE-2021-30507: Inappropriate implementation in Offline. Reported by Alison Huffman,...

FreeBSD : cyrus-imapd -- Remote authenticated users could bypass intended access restrictions on certain server annotations. (12156786-b18a-11eb-8cba-080027b00c2e)

Cyrus IMAP 3.4.1 Release Notes states : Fixed CVE-2021-32056: Remote authenticated users could bypass intended access restrictions on certain server annotations. Additionally, a long-standing bug in replication did not allow server annotations to be replicated. Combining these two bugs, a remote...

FreeBSD : FLAC -- out-of-bounds read (49346de2-b015-11eb-9bdf-f8b156b6dcc8)

Oss-Fuzz reports : There is a possible out of bounds read due to a heap buffer overflow in FLACbitreaderreadricesignedblock of bitreader.c. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

FreeBSD : Rails -- multiple vulnerabilities (f7a00ad7-ae75-11eb-8113-08002728f74c)

Ruby on Rails blog : Rails versions 6.1.3.2, 6.0.3.7, and 5.2.6 have been released! These releases contain important security fixes. Here is a list of the issues fixed : CVE-2021-22885: Possible Information Disclosure / Unintended Method Execution in Action Pack CVE-2021-22902: Possible Denial of...

FreeBSD : go -- net/http: ReadRequest can stack overflow due to recursion with very large headers (7f242313-aea5-11eb-8151-67f74cf7c704)

The Go project reports : http.ReadRequest can stack overflow due to recursion when given a request with a very large header 8-10MB depending on the architecture. A http.Server which overrides the default max header of 1MB by setting Server.MaxHeaderBytes to a much larger value could also be...