FreeBSD-SA-20:28.bhyve_vmcs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-20:28.bhyvevmcs Security Advisory The FreeBSD Project Topic: bhyve privilege escalation via VMCS access Category: core Module: bhyve Announced: 2020-09-15...

FreeBSD-SA-20:27.ure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-20:27.ure Security Advisory The FreeBSD Project Topic: ure device driver susceptible to packet-in-packet attack Category: core Module: ure Announced: 2020-09-15...

FreeBSD -- ure device driver susceptible to packet-in-packet attack

Problem Description: A programming error in the ure4 device driver caused some Realtek USB Ethernet interfaces to incorrectly report packets with more than 2048 bytes in a single USB transfer as having a length of only 2048 bytes. An adversary can exploit this to cause the driver to misinterpret...

FreeBSD -- bhyve SVM guest escape

Problem Description: A number of AMD virtualization instructions operate on host physical addresses, are not subject to nested page table translation, and guest use of these instructions was not trapped. Impact: From kernel mode a malicious guest can write to arbitrary host memory with some...

FreeBSD : Rails -- Potential XSS vulnerability (7b630362-f468-11ea-a96c-08002728f74c)

Ruby on Rails blog : Rails 5.2.4.4 and 6.0.3.3 have been released! These releases contain an important security fix, so please upgrade when you can. Both releases contain the following fix: CVE-2020-15169 Potential XSS vulnerability in Action View C Tenable Network Security, Inc. The descriptive...

FreeBSD Buffer Overflow Vulnerability (CNVD-2020-51503)

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. FreeBSD suffers from a buffer overflow vulnerability that can be exploited by an attacker to trigger a denial of service and code execution via an SCTP socket...

FreeBSD : chromium -- multiple vulnerabilities (bed5d41a-f2b4-11ea-a878-e09467587c17)

Chrome Releases reports : This release contains 5 security fixes : - 1116304 High CVE-2020-6573: Use after free in video. Reported by Leecraso and Guang Gong of 360 Alpha Lab working with 360 BugCloud on 2020-08-14 - 1102196 High CVE-2020-6574: Insufficient policy enforcement in installer. Report...

FreeBSD Buffer Overflow Vulnerability (CNVD-2020-51504)

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. The FreeBSD buffer overflow vulnerability can be exploited by an attacker to trigger a denial of service and code execution via the Loopback IPv6 Hop-by-Hop Options...

FreeBSD : zeek -- Various vulnerabilities (2c92fdd3-896c-4a5a-a0d8-52acee69182d)

Jon Siwek of Corelight reports : This release fixes the following security issue : - The AYIYA and GTPv1 parsing/decapsulation logic may leak memory -- These leaks have potential for remote exploitation to cause Denial of Service via resource exhaustion. C Tenable Network Security, Inc. The...

Bpytop - Linux/OSX/FreeBSD Resource Monitor

Resource monitor that shows usage and stats for processor, memory, disks, network and processes. Python port of bashtop. Features Easy to use, with a game inspired menu system. Full mouse support, all buttons with a highlighted key is clickable and mouse scroll works in process list and menu boxe...

FreeBSD : Mbed TLS -- Local side channel attack on classical CBC decryption in (D)TLS (4c69240f-f02c-11ea-838a-0011d823eebd)

Manuel Pegourie-Gonnard reports : When decrypting/authenticating DTLS record in a connection using a CBC ciphersuite without the Encrypt-then-Mac extension RFC 7366, Mbed TLS used dummy rounds of the compression function associated with the hash used for HMAC in order to hide the length of the...

FreeBSD : Django -- multiple vulnerabilities (002432c8-ef6a-11ea-ba8f-08002728f74c)

Django Release notes : CVE-2020-24583: Incorrect permissions on intermediate-level directories on Python 3.7+ On Python 3.7+, FILEUPLOADDIRECTORYPERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files and to intermediate-level collected static...

FreeBSD : Mbed TLS -- Local side channel attack on RSA and static Diffie-Hellman (bcdeb6d2-f02d-11ea-838a-0011d823eebd)

Manuel Pegourie-Gonnard reports : An attacker with access to precise enough timing and memory access information typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world can recover the private keys used in RSA or static finite-field...

FreeBSD : Multi-link PPP protocol daemon MPD5 remotely exploitable crash (cd97c7ca-f079-11ea-9c31-001b216d295b)

Version 5.9 contains security fix for L2TP clients and servers. Insufficient validation of incoming L2TP control packet specially crafted by unauthenticated user might lead to unexpected termination of the process. The problem affects mpd versions since 4.0 that brought in initial support for L2T...

FreeBSD : GnuTLS -- NULL pointer dereference (2272e6f1-f029-11ea-838a-0011d823eebd)

The GnuTLS project reports : It was found by oss-fuzz that the server sending a 'norenegotiation' alert in an unexpected timing, followed by an invalid second handshake can cause a TLS 1.3 client to crash via a NULL pointer dereference. The crash happens in the application's error handling path,...

FreeBSD Buffer Overflow Vulnerability (CNVD-2021-29082)

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. FreeBSD suffers from a buffer overflow vulnerability that can be exploited by an attacker to trigger a denial of service and code execution via Dhclient Option 119...

FreeBSD : FreeBSD -- SCTP socket use-after-free bug (77b877aa-ec18-11ea-88f8-901b0ef719ab)

Due to improper handling in the kernel, a use-after-free bug can be triggered by sending large user messages from multiple threads on the same socket. Impact : Triggering the use-after-free situation may result in unintended kernel behaviour including a kernel panic. C Tenable Network Security,...

FreeBSD : gnupg -- AEAD key import overflow (f9fa7adc-ee51-11ea-a240-002590acae31)

Importing an OpenPGP key having a preference list for AEAD algorithms will lead to an array overflow and thus often to a crash or other undefined behaviour. Importing an arbitrary key can often easily be triggered by an attacker and thus triggering this bug. Exploiting the bug aside from crashes ...

FreeBSD : FreeBSD -- IPv6 Hop-by-Hop options use-after-free bug (74bbde13-ec17-11ea-88f8-901b0ef719ab)

Due to improper mbuf handling in the kernel, a use-after-free bug might be triggered by sending IPv6 Hop-by-Hop options over the loopback interface. Impact : Triggering the use-after-free situation may result in unintended kernel behaviour including a kernel panic. C Tenable Network Security, Inc...

FreeBSD : Gitlab -- multiple vulnerabilities (1fb13175-ed52-11ea-8b93-001b217b3468)

Gitlab reports : Vendor Cross-Account Assume-Role Attack Stored XSS on the Vulnerability Page Outdated Job Token Can Be Reused to Access Unauthorized Resources File Disclosure Via Workhorse File Upload Bypass Unauthorized Maintainer Can Edit Group Badge Denial of Service Within Wiki Functionality...