GHSA-HFQ9-RFPV-J8R8 Command Injection in pidusage

Affected versions of pidusage pass unsanitized input to childprocess.exec, resulting in arbitrary code execution in the ps method. This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX. Windows and Linux are not vulnerable. Proof of Concept var pid = require'pidusage';...

FreeBSD : ark -- extraction outside of extraction directory (38fdf07b-e8ec-11ea-8bbe-e0d55e2a8bf9)

Albert Astals Cid reports : Overview A maliciously crafted TAR archive containing symlink entries would install files anywhere in the user's home directory upon extraction. Proof of concept For testing, an example of malicious archive can be found at dirsymlink.tar Impact Users can unwillingly...

FreeBSD : php72 -- use of freed hash key (ee261034-b95e-4479-b947-08b0877e029f)

grigoritchy at gmail dot com reports : The pharparsezipfile function had use-after-free vulnerability because of mishandling of the actualalias variable. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

CVE-2020-24717

OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777...

CVE-2020-24717

OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777...

CVE-2020-24716

OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories...

CVE-2020-24716

OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories...

Design/Logic Flaw

OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories...

Code injection

OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777...

CVE-2020-24716

OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories...

CVE-2020-24716

CVE-2020-24716 concerns OpenZFS prior to 2.0.0-rc1 when used on FreeBSD, where directories incorrectly expose execute permissions to all users. The connected Red Hat/NVD/OSV entries corroborate the same description: vulnerable component is OpenZFS; affected version range is before 2.0.0-rc1; plat...

CVE-2020-24717

OpenZFS before 2.0.0-rc1, when used on FreeBSD, misinterprets group permissions as user permissions, as demonstrated by mode 0770 being equivalent to mode 0777...

CVE-2020-24717

CVE-2020-24717 affects OpenZFS prior to 2.0.0-rc1 when used on FreeBSD, where group permissions are misinterpreted as user permissions, making mode 0770 effectively as permissive as 0777. The Red Hat advisory and other listings confirm OpenZFS on FreeBSD as the affected context. The vulnerability...

FreeBSD : chromium -- multiple vulnerabilities (d73bc4e6-e7c4-11ea-a878-e09467587c17)

Chrome Releases reports : This update includes 20 security fixes, including : - 1109120 High CVE-2020-6558: Insufficient policy enforcement in iOS. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2020-07-24 - 1116706 High CVE-2020-6559: Use after free in presentation API...

FreeBSD : xorg-server -- Multiple input validation failures in X server extensions (ffa15b3b-e6f6-11ea-8cbf-54e1ad3d6335)

The X.org project reports : All theses issuses can lead to local privileges elevation on systems where the X server is running privileged. The handler for the XkbSetNames request does not validate the request length before accessing its contents. An integer underflow exists in the handler for the...

FreeBSD : jasper -- multiple vulnerabilities (6842ac7e-d250-11ea-b9b7-08002728f74c)

JasPer NEWS : - Fix CVE-2018-9154 - Fix CVE-2018-19541 - Fix CVE-2016-9399, CVE-2017-13751 - Fix CVE-2018-19540 - Fix CVE-2018-9055 - Fix CVE-2017-13748 - Fix CVE-2017-5503, CVE-2017-5504, CVE-2017-5505 - Fix CVE-2018-9252 - Fix CVE-2018-19139 - Fix CVE-2018-19543, CVE-2017-9782 - Fix...

FreeBSD : libX11 -- Doublefree in locale handlng code (8da79498-e6f6-11ea-8cbf-54e1ad3d6335)

The X.org project reports : There is an integer overflow and a double free vulnerability in the way LibX11 handles locales. The integer overflow is a necessary precursor to the double free. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

FreeBSD : chrony <= 3.5.1 data corruption through symlink vulnerability writing the pidfile (719f06af-e45e-11ea-95a1-c3b8167b8026)

Miroslav Lichvar reports : chrony-3.5.1 ... fixes a security issue in writing of the pidfile. When chronyd is configured to save the pidfile in a directory where the chrony user has write permissions e.g. /var/run/chrony - the default since chrony-3.4, an attacker that compromised the chrony user...

FreeBSD : textproc/elasticsearch6 -- field disclosure flaw (fbca6863-e2ad-11ea-9d39-00a09858faf5)

Elastic reports : A field disclosure flaw was found in Elasticsearch when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker...

FreeBSD : sysutils/openzfs-kmod -- critical permissions issues (2ed7e8db-e234-11ea-9392-002590bc43be)

Andrew Walker reports : Issue 1 : Users are always granted permissions to cd into a directory. The check for whether execute is present on directories is a de-facto no-op. This cannot be mitigated without upgrading. Even setting an explicit 'deny - execute' NFSv4 ACE will be bypassed. Issue 2 : A...