FreeBSD-SA-21:03.pam_login_access

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:03.pamloginaccess Security Advisory The FreeBSD Project Topic: login.access fails to apply rules Category: core Module: pamloginaccess Announced: 2021-02-24...

FreeBSD -- jail_remove(2) fails to kill all jailed processes

Problem Description: Due to a race condition in the jailremove2 implementation, it may fail to kill some of the processes. Impact: A process running inside a jail can avoid being killed during jail termination. If a jail is subsequently started with the same root path, a lingering jailed process...

FreeBSD -- jail_attach(2) relies on the caller to change the cwd

Problem Description: When a process, such as jexec8 or killall1, calls jailattach2 to enter a jail, the jailed root can attach to it using ptrace2 before the current working directory is changed. Impact: A process with superuser privileges running inside a jail could change the root directory...

FreeBSD -- login.access fails to apply rules

Problem Description: A regression in the login.access5 rule processor has the effect of causing rules to fail to match even when they should not. This means that rules denying access may be ignored. Impact: The configuration in login.access5 may not be applied, permitting login access to users ev...

Freebsd FreeBSD Competitive Conditions Problem Vulnerability

FreeBSD is a Unix-like operating system from the Freebsd Foundation. FreeBSD has a security vulnerability that can be exploited by an attacker to bypass restrictions via jail remove Unkilled Processes of FreeBSD to escalate his privileges...

Freebsd FreeBSD Competitive Conditions Problem Vulnerability

FreeBSD is a Unix-like operating system from the Freebsd Foundation. pts is a pseudo-terminal driver used in it. FreeBSD has a security vulnerability that can be exploited by an attacker to bypass access restrictions and read or modify data on the host system via jail attach...

Freebsd FreeBSD Security Vulnerability

FreeBSD is a set of Unix-like operating systems from the Freebsd Foundation. FreeBSD has a security vulnerability that can be exploited by an attacker to bypass restrictions by logging in to escalate privileges...

FreeBSD-SA-21:04.jail_remove

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:04.jailremove Security Advisory The FreeBSD Project Topic: jailremove2 fails to kill all jailed processes Category: core Module: jail Announced: 2021-02-24...

FreeBSD -- Xen grant mapping error handling issues

Problem Description: Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on...

FreeBSD : zeek -- Remote crash vulnerability (3e9624b3-e92b-4460-8a5a-93247c52c5a1)

Jon Siwek of Corelight reports : Fix ASCII Input reader's treatment of input files containing null-bytes. An input file containing null-bytes could lead to a buffer-over-read, crash Zeek, and be exploited to cause Denial of Service. C Tenable Network Security, Inc. The descriptive text and packag...

FreeBSD : raptor2 -- malformed input file can lead to a segfault (9c03845c-7398-11eb-bc0e-2cf05d620ecc)

Redland Issue Tracker reports : due to an out of bounds array access in raptorxmlwriterstartelementcommon. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributors...

FreeBSD : jenkins -- Privilege escalation vulnerability in bundled Spring Security library (a45d945a-cc2c-4cd7-a941-fb58fdb1b01e)

Jenkins Security Advisory : Descriptionhigh SECURITY-2195 / CVE-2021-22112 Privilege escalation vulnerability in bundled Spring Security library C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

FreeBSD : asterisk -- An unsuspecting user could crash Asterisk with multiple hold/unhold requests (ca21f5e7-7228-11eb-8386-001999f8d30b)

The Asterisk project reports : Due to a signedness comparison mismatch, an authenticated WebRTC client could cause a stack overflow and Asterisk crash by sending multiple hold/unhold requests in quick succession. C Tenable Network Security, Inc. The descriptive text and package checks in this...

FreeBSD : asterisk -- Remote crash possible when negotiating T.38 (e3894955-7227-11eb-8386-001999f8d30b)

The Asterisk project reports : When re-negotiating for T.38 if the initial remote response was delayed just enough Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream then Asterisk would crash. C Tenable Network Security, Inc...

FreeBSD : asterisk -- Remote attacker could prematurely tear down SRTP calls (5d8ef725-7228-11eb-8386-001999f8d30b)

The Asterisk project reports : An unauthenticated remote attacker could replay SRTP packets which could cause an Asterisk instance configured without strict RTP validation to tear down calls prematurely. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD : asterisk -- Remote Crash Vulnerability in PJSIP channel driver (1bb2826b-7229-11eb-8386-001999f8d30b)

The Asterisk project reports : Given a scenario where an outgoing call is placed from Asterisk to a remote SIP server it is possible for a crash to occur. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

FreeBSD : asterisk -- Remote crash in res_pjsip_diversion (b330db5f-7225-11eb-8386-001999f8d30b)

The Asterisk project reports : If a registered user is tricked into dialing a malicious number that sends lots of 181 responses to Asterisk, each one will cause a 181 to be sent back to the original caller with an increasing number of entries in the 'Supported' header. Eventually the number of...

FreeBSD : Rails -- multiple vulnerabilities (8e670b85-706e-11eb-abb2-08002728f74c)

Ruby on Rails blog : Rails version 5.2.4.5, 6.0.3.5 and 6.1.2.1 have been released! Those version are security releases and addresses two issues : CVE-2021-22880: Possible DoS Vulnerability in Active Record PostgreSQL adapter. CVE-2021-22881: Possible Open Redirect in Host Authorization Middlewar...

FreeBSD : chromium -- multiple vulnerabilities (48514901-711d-11eb-9846-e09467587c17)

Chrome Releases reports : This release contains 10 security fixes, including : - 1138143 High CVE-2021-21149: Stack overflow in Data Transfer. Reported by Ryoya Tsukasaki on 2020-10-14 - 1172192 High CVE-2021-21150: Use after free in Downloads. Reported by Woojin Oh@pwnexploit of STEALIEN on...

FreeBSD : OpenSSL -- Multiple vulnerabilities (96a21236-707b-11eb-96d8-d4c9ef517024)

The OpenSSL project reports : NULL pointer deref in X509issuerandserialhash CVE-2021-23841Moderate The OpenSSL public API function X509issuerandserialhash attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to...