FreeBSD : LibreSSL -- use-after-free (eeca52dc-866c-11eb-b8d6-d4c9ef517024)

OpenBSD reports : A TLS client using session resumption may cause a use-after-free. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributors Redistribution and use ...

FreeBSD : chromium -- multiple vulnerabilities (b81ad6d6-8633-11eb-99c5-e09467587c17)

Chrome Releases reports : This release includes 5 security fixes, including : - 1167357 High CVE-2021-21191: Use after free in WebRTC. Reported by raven @raidakame on 2021-01-15 - 1181387 High CVE-2021-21192: Heap buffer overflow in tab groups. Reported by Abdulrahman Alqabandi, Microsoft Browser...

FreeBSD : squashfs-tools -- Integer overflow (317487c6-85ca-11eb-80fa-14dae938ec40)

Phillip Lougher reports : Integer overflow in the readfragmenttable4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service application crash via a crafted input, which triggers a stack-based buffer overflow. C Tenable Network Security, Inc. The...

FreeBSD : go -- encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader; archive/zip: panic when calling Reader.Open (72709326-81f7-11eb-950a-00155d646401)

The Go project reports : The Decode, DecodeElement, and Skip methods of an xml.Decoder provided by xml.NewTokenDecoder may enter an infinite loop when operating on a custom xml.TokenReader which returns an EOF in the middle of an open XML element. The Reader.Open API, new in Go 1.16, will panic...

FreeBSD : mantis -- multiple vulnerabilities (2dc8927b-54e0-11eb-9342-1c697a013f4b)

Mantis 2.24.4 release reports : Security and maintenance release, addressing 6 CVEs : - 0027726: CVE-2020-29603: disclosure of private project name - 0027727: CVE-2020-29605: disclosure of private issue summary - 0027728: CVE-2020-29604: full disclosure of private issue contents, including bugnot...

FreeBSD : gitea -- multiple vulnerabilities (502ba001-7ffa-11eb-911c-0800278d94f0)

The Gitea Team reports for release 1.13.3 : - Turn default hash password algorithm back to pbkdf2 from argon2 until we find a better one The Gitea Team reports for release 1.13.4 : - Fix issue popups C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD : Node.js -- February 2021 Security Releases (2f3cd69e-7dee-11eb-b92e-0022489ad614)

Node.js reports : HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion Critical CVE-2021-22883 Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file...

FreeBSD : Gitlab -- Multiple vulnerabilities (8bf856ea-7df7-11eb-9aad-001b217b3468)

Gitlab reports : JWT token leak via Workhorse Stored XSS in wiki pages Group Maintainers are able to use the Group CI/CD Variables API Insecure storage of GitLab session keys C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD...

FreeBSD : asterisk -- Crash when negotiating T.38 with a zero port (9e8f0766-7d21-11eb-a2be-001999f8d30b)

The Asterisk project reports : When Asterisk sends a re-invite initiating T.38 faxing and the endpoint responds with a m=image line and zero port, a crash will occur in Asterisk. This is a reoccurrence of AST-2019-004. C Tenable Network Security, Inc. The descriptive text and package checks in th...

FreeBSD : chromium -- multiple vulnerabilities (f00b65d8-7ccb-11eb-b3be-e09467587c17)

Chrome Releases reports : This release includes 47 security fixes, including the below. Google is aware of reports that an exploit for CVE-2021-21166 exists in the wild. Please see URL for details. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD : jasper -- multiple vulnerabilities (3a469cbc-7a66-11eb-bd3f-08002728f74c)

JasPer Releases : - Fix memory-related bugs in the JPEG-2000 codec resulting from attempting to decode invalid code streams. 264, 265 This fix is associated with CVE-2021-26926 and CVE-2021-26927. - Fix wrong return value under some compilers 260 - Fix CVE-2021-3272 heap buffer overflow in...

FreeBSD : vault -- unauthenticated license read (52bd2d59-4ab5-4bef-a599-7aac4e92238b)

vault developers report : Limited Unauthenticated License Read: We addressed a security vulnerability that allowed for the unauthenticated reading of Vault licenses from DR Secondaries. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

FreeBSD : FreeBSD -- jail_attach(2) relies on the caller to change the cwd (bba850fd-770e-11eb-b87a-901b0ef719ab)

When a process, such as jexec8 or killall1, calls jailattach2 to enter a jail, the jailed root can attach to it using ptrace2 before the current working directory is changed. Impact : A process with superuser privileges running inside a jail could change the root directory outside of the jail,...

FreeBSD : FreeBSD -- jail_remove(2) fails to kill all jailed processes (31ad2f10-7711-11eb-b87a-901b0ef719ab)

Due to a race condition in the jailremove2 implementation, it may fail to kill some of the processes. Impact : A process running inside a jail can avoid being killed during jail termination. If a jail is subsequently started with the same root path, a lingering jailed process may be able to explo...

FreeBSD : FreeBSD -- login.access fails to apply rules (a8654f1d-770d-11eb-b87a-901b0ef719ab)

A regression in the login.access5 rule processor has the effect of causing rules to fail to match even when they should not. This means that rules denying access may be ignored. Impact : The configuration in login.access5 may not be applied, permitting login access to users even when the system i...

FreeBSD : FreeBSD -- Xen grant mapping error handling issues (5b8c6e1e-770f-11eb-b87a-901b0ef719ab)

Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failur...

FreeBSD Information Disclosure Vulnerability (CNVD-2021-14798)

FreeBSD is a set of Unix-like operating systems from the Freebsd Foundation. A security vulnerability exists in FreeBSD that allows a local attacker to read memory fragments via VOP READDIR to obtain sensitive information. No details of the vulnerability are provided at this time...

FreeBSD-SA-21:06.xen

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:06.xen Security Advisory The FreeBSD Project Topic: Xen grant mapping error handling issues Category: contrib Module: xen Announced: 2021-02-24 Credits: See...

FreeBSD-SA-21:05.jail_chdir

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:05.jailchdir Security Advisory The FreeBSD Project Topic: jailattach2 relies on the caller to change the cwd Category: core Module: jail Announced: 2021-02-2...

FreeBSD : redis -- Integer overflow on 32-bit systems (0e38b8f8-75dd-11eb-83f2-8c164567ca3c)

Redis Development team reports : Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer...