FreeBSD : wordpress -- multiple issues (7b97b32e-27c4-11ea-9673-4c72b94353b5)

wordpress developers reports : Four security issues affect WordPress versions 5.3 and earlier; version 5.3.1 fixes them, so youll want to upgrade. If you havent yet updated to 5.3, there are also updated versions of 5.2 and earlier that fix the security issues. -Props to Daniel Bachhuber for...

FreeBSD : e2fsprogs -- maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck (ad3451b9-23e0-11ea-8b36-f1925a339a82)

Ted Y. Ts'o reports : A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and...

FreeBSD : OpenSSL -- Overflow vulnerability (d778ddb0-2338-11ea-a1c7-b499baebfeaf)

The OpenSSL project reports : rsaz512sqr overflow bug on x8664 CVE-2019-1551 Low There is an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536,...

FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (3da0352f-2397-11ea-966e-000ffec0b3e1)

Drupal Security Team reports : A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt. Drupal 8 core's filesaveupload function does not strip the leading and trailing dot '.' from filenames, like Drupal 7 did. Users with t...

FreeBSD : py-matrix-synapse -- multiple vulnerabilities (ed8cbad5-21a8-11ea-9b6d-901b0e934d69)

Matrix developers report : The synapse 1.7.1 release includes several security fixes as well as a fix to a bug exposed by the security fixes. All previous releases of Synapse are affected. Administrators are encouraged to upgrade as soon as possible. - Fix a bug which could cause room events to b...

RancherOS < 1.4.0 Information Disclosure

The remote host is running a version of RancherOS prior to 1.4.0, hence is exposted to a side-channel vulnerabilities: - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a...

The vulnerability of the bootpd component of the FreeBSD operating system allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the bootpd component of the FreeBSD operating system relates to operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code...

The vulnerability of the PF IPv6 network firewall in FreeBSD and Solaris systems allows attackers to circumvent existing access control policies or cause service interruptions.

The vulnerability of the PF IPv6 network firewall in FreeBSD and Solaris is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to bypass existing access control policies or cause service failures using a specially crafted IPv6 packet...

The vulnerability of the mqueuefs module in FreeBSD systems allows a hacker to gain unauthorized access to protected information.

The vulnerability of the mqueuefs module in FreeBSD is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

FreeBSD : samba -- multiple vulnerabilities (1edae47e-1cdd-11ea-8c2a-08002743b791)

The Samba Team reports : CVE-2019-14861 : An authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name. CVE-2019-14870 : The DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests...

FreeBSD : dovecot -- NULL pointer deref in notify with empty headers (b7dc4dde-2e48-43f9-967a-c68461537cf2)

Aki Tuomi reports Mail with group address as sender will cause a signal 11 crash in push notification drivers. Group address as recipient can cause crash in some drivers. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

FreeBSD : spamassassin -- multiple vulnerabilities (70111759-1dae-11ea-966a-206a8a720317)

the Apache Spamassassin project reports : An input validation error of user-supplied input parsing multipart emails. Specially crafted emails can consume all resources on the system. A local user is able to execute arbitrary shell commands through specially crafted nefarious CF files. C Tenable...

FreeBSD : Gitlab -- Multiple Vulnerabilities (21944144-1b90-11ea-a2d4-001b217b3468)

Gitlab reports : Path traversal with potential remote code execution Disclosure of private code via Elasticsearch integration Update Git dependency C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

CVE-2019-14899

CVE-2019-14899 is a routing-path/kernel issue affecting macOS (and cited across Linux, FreeBSD, OpenBSD, iOS, Android). The root cause is a VPN-tunnel routing problem that allows a local/adjacent attacker to inject into active VPN connections, enabling data injection and potential VPN hijacking. ...

FreeBSD : Ghostscript -- Security bypass vulnerabilities (22ae307a-1ac4-11ea-b267-001cc0382b2f)

Cedric Buissart Red Hat reports : A flaw was found in, ghostscript versions prior to 9.50, in the .pdfhookDSCCreator procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. A specially crafted PostScript file could disable security...

Linux Bug Opens Most VPNs to Hijacking

A vulnerability in most Linux distros has been uncovered that allows a network-adjacent attacker to hijack VPN connections and inject rogue data into the secure tunnels that victims are using to communicate with remote servers. According to researchers at University of New Mexico and Breakpointin...

New Linux Bug Lets Attackers Hijack Encrypted VPN Connections

A team of cybersecurity researchers has disclosed a new severe vulnerability affecting most Linux and Unix-like operating systems, including FreeBSD, OpenBSD, macOS, iOS, and Android, that could allow remote 'network adjacent attackers' to spy on and tamper with encrypted VPN connections. The...

Multiple Linux Distributions CVE-2019-14899 Security Bypass Vulnerability

Description Multiple Linux Distributions are prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks. Technologies Affected Apple iOS Apple macOS Archlinux Linux 2019.05...

FreeBSD : py-matrix-synapse -- incomplete cleanup of 3rd-party-IDs on user deactivation (9c36d41c-11df-11ea-9b6d-901b0e934d69)

Matrix developers report : Clean up local threepids from user on account deactivation. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution and u...

FreeBSD : webkit2-gtk3 -- Multiple vulnerabilities (3e748551-c732-45f6-bd88-928da16f23a8)

The WebKitGTK project reports multiple vulnerabilities. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution and use in source VuXML and 'compile...