FreeBSD : Gitlab -- Disclosure Vulnerabilities (0762fa72-e530-11e9-86e9-001b217b3468)

Gitlab reports : Disclosure of Private Code, Merge Requests and Commits via Elasticsearch integration C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors...

FreeBSD : Gitlab -- Multiple Vulnerabilities (b2789b2d-d521-11e9-86e9-001b217b3468)

Gitlab reports : Project Template Functionality Could Be Used to Access Restricted Project Data Security Enhancements in GitLab Pages C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacque...

FreeBSD : Exim -- heap-based buffer overflow in string_vformat leading to RCE (e917caba-e291-11e9-89f1-152fed202bb7)

Exim developers team report : There is a heap overflow in stringvformat.Using a EHLO message, remote code execution seems to be possible. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019...

FreeBSD : go -- invalid headers are normalized, allowing request smuggling (a92dcc5c-e05c-11e9-b589-10c37b4ac2ea)

The Go project reports : net/http through net/textproto used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. If a Go server is used behind a reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse...

FreeBSD : mantis -- multiple vulnerabilities (81fcc2f9-e15a-11e9-abbf-800dd28b22bd)

The Mantis developers report : CVE-2019-15715: Admin Required - Post Authentication Command Execution / Injection Vulnerability CVE-2019-8331: In Bootstrap before 3.4.1, XSS is possible in the tooltip or popover data-template attribute Missing integrity hashes for CSS resources from CDNs C Tenabl...

FreeBSD : jenkins -- multiple vulnerabilities (9720bb39-f82a-402f-9fe4-e2c875bdda83)

Jenkins Security Advisory : DescriptionMedium SECURITY-1498 / CVE-2019-10401 Stored XSS vulnerability in expandable textbox form control Medium SECURITY-1525 / CVE-2019-10402 XSS vulnerability in combobox form control Medium SECURITY-1537 1 / CVE-2019-10403 Stored XSS vulnerability in SCM tag...

FreeBSD : ISC KEA -- Multiple vulnerabilities (20b92374-d62a-11e9-af73-001b217e4ee5)

Internet Systems Consortium, Inc. reports : A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate CVE-2019-6472 Medium An invalid hostname option can cause the kea-dhcp4 server to terminate CVE-2019-6473 Medium An oversight when validating incoming client requests can...

FreeBSD : Mbed TLS -- Side channel attack on deterministic ECDSA (1c948fd3-dac0-11e9-81b2-0011d823eebd)

Janos Follath reports : Mbed TLS does not have a constant-time/constant-trace arithmetic library and uses blinding to protect against side channel attacks. In the ECDSA signature routine previous Mbed TLS versions used the same RNG object for generating the ephemeral key pair and for generating t...

FreeBSD : expat2 -- Fix extraction of namespace prefixes from XML names (6856d798-d950-11e9-aae4-f079596b62f9)

expat project reports : Fix heap overflow triggered by XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber, and deny internal entities closing the doctype C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

FreeBSD -- Improper checking in SCTP-AUTH shared key update

Problem Description: The SCTP layer does improper checking when an application tries to update a shared key. Therefore an unprivileged local user can trigger a use-after- free situation, for example by specific sequences of updating shared keys and closing the SCTP association. Impact: Triggering...

FreeBSD : bro -- invalid memory access or heap buffer over-read (55571619-454e-4769-b1e5-28354659e152)

Jon Siwek of Corelight reports : This is a security patch release to address a potential Denial of Service vulnerability : - The NTLM analyzer did not properly handle AV Pair sequences that were either empty or unterminated, resulting in invalid memory access or heap buffer over-read. The NTLM...

FreeBSD : expat2 -- Fix extraction of namespace prefixes from XML names (c5bd8a25-99a6-11e9-a598-f079596b62f9)

expat project reports : XML names with multiple colons could end up in the wrong namespace, and take a high amount of RAM and CPU resources while processing, opening the door to use for denial-of-service attacks C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

FreeBSD : curl -- multiple vulnerabilities (9fb4e57b-d65a-11e9-8a5f-e5c82b486287)

curl security problems : CVE-2019-5481: FTP-KRB double-free libcurl can be told to use kerberos over FTP to a server, as set with the CURLOPTKRBLEVEL option. During such kerberos FTP data transfer, the server sends data to curl in blocks with the 32 bit size of each block first and then that amou...

FreeBSD : OpenSSL -- Multiple vulnerabilities (9e0c6f7a-d46d-11e9-a1c7-b499baebfeaf)

The OpenSSL project reports : ECDSA remote timing attack CVE-2019-1547 Low Fork Protection CVE-2019-1549 Low OpenSSL 1.1.1 only C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques...

FreeBSD : Flash Player -- multiple vulnerabilities (c6f19fe6-d42a-11e9-b4f9-6451062f0f7a)

Adobe reports : - This update resolves a same origin method execution vulnerability that could lead to arbitrary code execution CVE-2019-8069. - This update resolves a use-after-free vulnerability that could lead to arbitrary code execution CVE-2019-8070. C Tenable Network Security, Inc. The...

FreeBSD : oniguruma -- multiple vulnerabilities (a8d87c7a-d1b1-11e9-a616-0992a4564e7c)

A use-after-free in onignewdeluxe in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte...

FreeBSD : asterisk -- Remote Crash Vulnerability in audio transcoding (7d53d8da-d07a-11e9-8f1a-001999f8d30b)

The Asterisk project reports : When audio frames are given to the audio transcoding support in Asterisk the number of samples are examined and as part of this a message is output to indicate that no samples are present. A change was done to suppress this message for a particular scenario in which...

FreeBSD : asterisk -- Crash when negotiating for T.38 with a declined stream (d94c08d2-d079-11e9-8f1a-001999f8d30b)

The Asterisk project reports : When Asterisk sends a re-invite initiating T.38 faxing, and the endpoint responds with a declined media stream a crash will then occur in Asterisk. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBS...

FreeBSD : Exim -- RCE with root privileges in TLS SNI handler (61db9b88-d091-11e9-8d41-97657151f8c2)

Exim developers report : If your Exim server accepts TLS connections, it is vulnerable. This does not depend on the TLS libray, so both, GnuTLS and OpenSSL are affected. The vulnerability is exploitable by sending a SNI ending in a backslash-null sequence during the initial TLS handshake. The...

FreeBSD : wordpress -- multiple issues (8a9f86de-d080-11e9-9051-4c72b94353b5)

wordpress developersreports : Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting XSS vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments. Props to Tim Coen f...