FreeBSD : traefik -- Denial of service in HTTP/2 (41f4baac-bf77-11e9-8d2f-5404a68ad561) (Ping Flood) (Reset Flood)

The traefik project reports : Update of dependency to go go1.12.8 resolves potential HTTP/2 denial of service in traefik. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2022 Jacques Vidrine an...

FreeBSD : Apache -- Multiple vulnerabilities (caf545f2-c0d9-11e9-9051-4c72b94353b5) (Internal Data Buffering)

SO-AND-SO reports : SECURITY: CVE-2019-10081 modhttp2: HTTP/2 very early pushes, for example configured with 'H2PushResource', could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data...

FreeBSD-SA-19:22.mbuf

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:22.mbuf Security Advisory The FreeBSD Project Topic: IPv6 remote Denial-of-Service Category: kernel Module: net Announced: 2019-08-20 Credits: Clement Lecign...

FreeBSD-SA-19:24.mqueuefs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:24.mqueuefs Security Advisory The FreeBSD Project Topic: Reference count overflow in mqueue filesystem 32-bit compat Category: core Module: kernel Announced:...

PT-2019-17780 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 12.0-STABLE before r350828 FreeBSD versions 12.0-RELEASE before 12.0-RELEASE-p10 FreeBSD versions 11.3-STABLE before r350829 FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p3 FreeBSD versions 11.2-RELEASE before...

FreeBSD -- kernel memory disclosure from /dev/midistat

Problem Description: The kernel driver for /dev/midistat implements a handler for read2. This handler is not thread-safe, and a multi-threaded program can exploit races in the handler to cause it to copy out kernel memory outside the boundaries of midistat's data buffer. Impact: The races allow a...

FreeBSD -- IPv6 remote Denial-of-Service

Problem Description: Due do a missing check in the code of mpulldown9 data returned may not be contiguous as requested by the caller. Impact: Extra checks in the IPv6 code catch the error condition and trigger a kernel panic leading to a remote DoS denial-of-service attack with certain Ethernet...

FreeBSD-SA-19:23.midi

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:23.midi Security Advisory The FreeBSD Project Topic: kernel memory disclosure from /dev/midistat Category: core Module: sound Announced: 2019-08-20 Credits:...

FreeBSD : gitea -- multiple vulnerabilities (3b2ee737-c12d-11e9-aabc-0800274e5f20)

The Gitea Team reports : This release contains two security fixes, so we highly recommend updating. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors...

FreeBSD : webmin -- unauthenticated remote code execution (ece65d3b-c20c-11e9-8af4-bcaec55be5e5)

Joe Cooper reports : I've rolled out Webmin version 1.930 and Usermin version 1.780 for all repositories. This release includes several security fixes, including one potentially serious one caused by malicious code inserted into Webmin and Usermin at some point on our build infrastructure. We're...

FreeBSD : Nokogiri -- injection vulnerability (0569146e-bdef-11e9-bd31-8de4a4470bbb)

Nokogiri GitHub release : A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizerloadfile is being passed untrusted user input...

FreeBSD : Gitlab -- Multiple Vulnerabilities (ddd48087-bd86-11e9-b13f-001b217b3468)

Gitlab reports : Insecure Authentication Methods Disabled for Grafana By Default Multiple Command-Line Flag Injection Vulnerabilities Insecure Cookie Handling on GitLab Pages C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD...

FreeBSD : gitea -- multiple vulnerabilities (e7b69694-b3b5-11e9-9bb6-0800274e5f20)

The Gitea Team reports : This version of Gitea contains security fixes that could not be backported to 1.8. For this reason, we strongly recommend updating. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

FreeBSD : FreeBSD -- Kernel memory disclosure in freebsd32_ioctl (6b856e00-b30a-11e9-a87f-a4badb2f4699)

Due to insufficient initialization of memory copied to userland in the components listed above small amounts of kernel memory may be disclosed to userland processes. Impact : A user who can invoke 32-bit FreeBSD ioctls may be able to read the contents of small portions of kernel memory. Such memo...

FreeBSD : PostgresSQL -- TYPE in pg_temp execute arbitrary SQL during `SECURITY DEFINER` execution (9de4c1c1-b9ee-11e9-82aa-6cc21735f730)

The PostgreSQL project reports : Versions Affected: 9.4 - 11 Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function, which must itself contain a function call having inexact...

FreeBSD : doas -- Prevent passing of environment variables (7f7d6412-bae5-11e9-be92-3085a9a95629)

Jesse Smith upstream author of the doas program reported : Previous versions of 'doas' transferred most environment variables, such as USER, HOME, and PATH from the original user to the target user. Passing these variables could cause files in the wrong path or home directory to be read or writte...

FreeBSD : Django -- multiple vulnerabilities (6e65dfea-b614-11e9-a3a2-1506e15611cc)

Django release notes : CVE-2019-14232: Denial-of-service possibility in django.utils.text.Truncator If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in ...

FreeBSD : FreeBSD -- Microarchitectural Data Sampling (MDS) (a633651b-b309-11e9-a87f-a4badb2f4699)

On some Intel processors utilizing speculative execution a local process may be able to infer stale information from microarchitectural buffers to obtain a memory disclosure. Impact : An attacker may be able to read secret data from the kernel or from a process when executing untrusted code for...

FreeBSD : FreeBSD -- File description reference count leak (0d3f99f7-b30c-11e9-a87f-a4badb2f4699)

If a process attempts to transmit rights over a UNIX-domain socket and an error causes the attempt to fail, references acquired on the rights are not released and are leaked. This bug can be used to cause the reference counter to wrap around and free the corresponding file structure. Impact : A...

FreeBSD : FreeBSD -- Reference count overflow in mqueue filesystem (deb6e164-b30b-11e9-a87f-a4badb2f4699)

System calls operating on file descriptors obtain a reference to relevant struct file which due to a programming error was not always put back, which in turn could be used to overflow the counter of affected struct file. Impact : A local user can use this flaw to obtain access to files,...