CVE-2020-7450

The CVE-2020-7450 issue affects FreeBSD where libfetch URL handling for URLs containing username and/or password components is vulnerable to a heap buffer overflow. The root cause is in libfetch’s URL parsing, leading to program misbehavior or potential code execution. Affected are FreeBSD releas...

CVE-2020-7450

In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3-RELEASE-p6, URL handling in libfetch with URLs containing username and/or password components is vulnerable to a heap buffer...

FreeBSD : FreeBSD -- kernel stack data disclosure (6025d173-4279-11ea-b184-f8b156ac3ff9)

Due to incorrect initialization of a stack data structure, up to 20 bytes of kernel data stored previously stored on the stack will be exposed to a crashing user process. Impact : Sensitive kernel data may be disclosed. C Tenable Network Security, Inc. The descriptive text and package checks in...

FreeBSD : FreeBSD -- Missing IPsec anti-replay window check (5797c807-4279-11ea-b184-f8b156ac3ff9)

A missing check means that an attacker can reinject an old packet and it will be accepted and processed by the IPsec endpoint. Impact : The impact depends on the higher-level protocols in use over IPsec. For example, an attacker who can capture and inject packets could cause an action that was...

FreeBSD : FreeBSD -- libfetch buffer overflow (22b41bc5-4279-11ea-b184-f8b156ac3ff9)

A programming error allows an attacker who can specify a URL with a username and/or password components to overflow libfetch3 buffers. Impact : An attacker in control of the URL to be fetched possibly via HTTP redirect may cause a heap buffer overflow, resulting in program misbehavior or maliciou...

FreeBSD : Gitlab -- Vulnerability (1ece5591-4ea9-11ea-86f0-001b217b3468)

Gitlab reports : Incorrect membership handling of group sharing feature C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrine and contributors Redistribution and use in source...

FreeBSD : dovecot -- multiple vulnerabilities (74db0d02-b140-4c32-aac6-1f1e81e1ad30)

Aki Tuomi reports : lib-smtp doesn't handle truncated command parameters properly, resulting in infinite loop taking 100% CPU for the process. This happens for LMTP where it doesn't matter so much and also for submission-login where unauthenticated users can trigger it. Aki also reports : Snippet...

FreeBSD : grub2-bhyve -- multiple privilege escalations (9d6a48a7-4dad-11ea-8a1d-7085c25400ea)

Reno Robert reports : FreeBSD uses a two-process model for running a VM. For booting non-FreeBSD guests, a modified grub-emu is used grub-bhyve. Grub-bhyve executes command from guest grub.cfg file. This is a security problem because grub was never written to handle inputs from OS as untrusted. I...

FreeBSD : Flash Player -- arbitrary code execution (d460b640-4cdf-11ea-a59e-6451062f0f7a)

Adobe reports : - This update resolves a type confusion vulnerability that could lead to arbitrary code execution CVE-2020-3757. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques...

FreeBSD : libexif -- privilege escalation (00f30cba-4d23-11ea-86ba-641c67a117d8)

Mitre reports : In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. C Tenable Network Security,...

FreeBSD : NGINX -- HTTP request smuggling (c1202de8-4b29-11ea-9673-4c72b94353b5)

NGINX Team reports : NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. C Tenable Network Security, Inc. The...

FreeBSD : ksh93 -- certain environment variables interpreted as arithmetic expressions on startup, leading to code injection (8b20d716-49df-11ea-9f7b-206a8a720317)

Upstream ksh93 maintainer Siteshwar Vashisht reports : A flaw was found in the way ksh evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated...

FreeBSD : clamav -- Denial-of-Service (DoS) vulnerability (e7bc2b99-485a-11ea-bff9-9c5c8e75236a)

Micah Snyder reports : A denial-of-service DoS condition may occur when using the optional credit card data-loss-prevention DLP feature. Improper bounds checking of an unsigned variable resulted in an out-of-bounds read, which causes a crash. C Tenable Network Security, Inc. The descriptive text...

FreeBSD Kernel Stack Data Disclosure Vulnerability

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A stack data disclosure vulnerability exists in the FreeBSD kernel. The vulnerability is due to incorrect initialization of stack data structures and can be exploited by an attacker to cause a user process to crash...

FreeBSD Security Vulnerabilities

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. FreeBSD has a security vulnerability. An attacker can re-inject old packets, which will be accepted and processed by the IPsec endpoint. No details of the vulnerability are provided at this time...

FreeBSD libfetch Buffer Overflow Vulnerability

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A buffer overflow vulnerability exists in FreeBSD libfetch. An attacker can exploit this vulnerability to cause a libfetch3 buffer overflow by specifying a URL using a username and/or password component...

FreeBSD : Django -- potential SQL injection vulnerability (5a45649a-4777-11ea-bdec-08002728f74c)

MITRE CVE reports : Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitab...

FreeBSD : sudo -- Potential bypass of Runas user restrictions (b4e5f782-442d-11ea-9ba9-206a8a720317)

Todd C. Miller reports : Sudo's pwfeedback option can be used to provide visual feedback when the user is inputting their password. For each key press, an asterisk is printed. This option was added in response to user confusion over how the standard Password: prompt disables the echoing of key...

FreeBSD : libssh -- Unsanitized location in scp could lead to unwanted command execution (1e7fa41b-f6ca-4fe8-bd46-0e176b42b14f)

The libssh team reports : In an environment where a user is only allowed to copy files and not to execute applications, it would be possible to pass a location which contains commands to be executed in additon. When the libssh SCP client connects to a server, the scp command, which includes a...

FreeBSD : MariaDB -- Vulnerability in C API (cb0183bb-45f6-11ea-a1c7-b499baebfeaf)

MariaDB reports : Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...