FreeBSD : powerdns-recursor -- multiple vulnerabilities (f9c5a410-9b4e-11ea-ac3f-6805ca2fa271)

PowerDNS Team reports : CVE-2020-10995: An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between...

FreeBSD : chromium -- multiple vulnerabilities (38c676bd-9def-11ea-a94c-3065ec8fd3ec)

Google Chrome Releases reports : This release includes 38 security fixes, including CVEs CVE-2020-6465 through CVE-2020-6491. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrin...

FreeBSD : drupal -- Multiple Vulnerabilities (c5ec57a9-9c2b-11ea-82b8-4c72b94353b5)

Drupal Security Team reports : The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are: ... Security issues in jQuerys DOM manipulation methods, as in .html, .append, and the...

FreeBSD : Apache Tomcat Remote Code Execution via session persistence (676ca486-9c1e-11ea-8b5e-b42e99a1b9c3)

The Apache Software Foundation reports : Under certain circumstances an attacker will be able to trigger remote code execution via deserialization of the file under their control C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBS...

FreeBSD : piwigo -- Multible Vulnerabilities (436d7f93-9cf0-11ea-82b8-4c72b94353b5)

Piwigo reports : Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the grouplist page. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrine and contributors...

FreeBSD : unbound -- mutliple vulnerabilities (a2cb7c31-9c79-11ea-a9c2-d05099c0ae8c)

NLNetLabs reports : This release fixes CVE-2020-12662 and CVE-2020-12663. Bug Fixes : - CVE-2020-12662 Unbound can be tricked into amplifying an incoming query into a large number of queries directed to a target. - CVE-2020-12663 Malformed answers from upstream name servers can be used to make...

FreeBSD : Zabbix -- Remote code execution (4d11d37e-9a8d-11ea-b9b8-641c67a117d8)

Zabbix reports : Fixed security vulnerability cve-2020-11800 remote code execution. ZBX-17600 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrine and contributors Redistributio...

FreeBSD : Rails -- multiple vulnerabilities (85fca718-99f6-11ea-bf1d-08002728f74c)

Ruby on Rails blog : Hi everyone! Rails 5.2.4.3 and 6.0.3.1 have been released! These releases contain important security fixes, so please upgrade when you can. Both releases contain the following fixes : CVE-2020-8162: Circumvention of file size limits in ActiveStorage CVE-2020-8164: Possible...

FreeBSD : Dovecot -- Multiple vulnerabilities (37d106a8-15a4-483e-8247-fcb68b16eaf8)

Aki Tuomi reports : Vulnerability Details : Sending malformed NOOP command causes crash in submission, submission-login or lmtp service. Risk : Remote attacker can keep submission-login service down, causing denial of service attack. For lmtp the risk is neglible, as lmtp is usually behind a...

FreeBSD Kernel NAT Out-Of-Bounds Access Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of FreeBSD Kernel. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of NAT. The issue results from the lack of proper validation of...

FreeBSD Kernel NAT Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of FreeBSD Kernel. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of NAT. The issue results from the lack of proper validation of...

FreeBSD Kernel NAT Out-Of-Bounds Access Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of FreeBSD Kernel. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of NAT. The issue results from the lack of proper validation of...

FreeBSD : salt -- multiple vulnerabilities in salt-master process (6bf55af9-973b-11ea-9f2c-38d547003487)

F-Secure reports : CVE-2020-11651 - Authentication bypass vulnerabilities The ClearFuncs class processes unauthenticated requests and unintentionally exposes the sendpub method, which can be used to queue messages directly on the master publish server. Such messages can be used to trigger minions...

FreeBSD : clamav -- multiple vulnerabilities (91ce95d5-cd15-4105-b942-af5ccc7144c1)

Micah Snyder reports : CVE-2020-3327: Fixed a vulnerability in the ARJ archive-parsing module in ClamAV 0.102.2 that could cause a denial-of-service condition. Improper bounds checking of an unsigned variable results in an out-of-bounds read which causes a crash. Special thanks to Daehui Chang an...

FreeBSD : Rails -- remote code execution vulnerability (ce6db19b-976e-11ea-93c4-08002728f74c)

Ruby on Rails blog : Due to an unfortunate oversight, Rails 4.2.11.2 has a missing constant error. To address this Rails 4.2.11.3 has been released. The original announcement for CVE-2020-8163 has a follow-up message with an updated patch if you're unable to use the gems. C Tenable Network...

FreeBSD : json-c -- integer overflow and out-of-bounds write via a large JSON file (abc3ef37-95d4-11ea-9004-25fadb81abf4)

Tobias Stockmann reports : I have discovered a way to trigger an out of boundary write while parsing a huge json file through a malicious input source. It can be triggered if an attacker has control over the input stream or if a huge load during filesystem operations can be triggered. C Tenable...

FreeBSD Input Validation Error Vulnerability

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. An input validation error vulnerability exists in FreeBSD, which arises from a program's failure to adequately validate the length of a packet, and can be exploited by a remote attacker to execute arbitrary code by sendi...

FreeBSD Competitive Conditions Issue Loophole

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. FreeBSD contains a Competitive Condition Problem vulnerability, which stems from a cryptodev module that allows data structures in the kernel to be re-exploited after they have been freed, and can be exploited by an...

FreeBSD Resource Management Error Vulnerability

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A resource management error vulnerability in FreeBSD versions prior to 12.1-STABLE r352509, prior to 11.3-STABLE r352509, and prior to 11.3-RELEASE p9, which stems from a failure of the SCTP layer to properly check when ...

FreeBSD Buffer Overflow Vulnerability (CNVD-2020-32360)

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A buffer overflow vulnerability exists in the cryptodev module in FreeBSD versions prior to 12.1-STABLE r356911 and prior to 12.1-RELEASE p5, which stems from a program that fails to adequately validate the length of a...