FreeBSD : FreeBSD -- Reference count overflow in mqueue filesystem (deb6e164-b30b-11e9-a87f-a4badb2f4699)

System calls operating on file descriptors obtain a reference to relevant struct file which due to a programming error was not always put back, which in turn could be used to overflow the counter of affected struct file. Impact : A local user can use this flaw to obtain access to files,...

FreeBSD : FreeBSD -- ICMP/ICMP6 packet filter bypass in pf (59c5f255-b309-11e9-a87f-a4badb2f4699)

States in pf4 let ICMP and ICMP6 packets pass if they have a packet in their payload matching an existing condition. pf4 does not check if the outer ICMP or ICMP6 packet has the same destination IP as the source IP of the inner protocol packet. Impact : A maliciously crafted ICMP/ICMP6 packet cou...

FreeBSD : FreeBSD -- Bhyve out-of-bounds read in XHCI device (edf064fb-b30b-11e9-a87f-a4badb2f4699)

The pcixhcidevicedoorbell function does not validate the 'epid' and 'streamid' provided by the guest, leading to an out-of-bounds read. Impact : A misbehaving bhyve guest could crash the system or access memory that it should not be able to. C Tenable Network Security, Inc. The descriptive text a...

FreeBSD : FreeBSD -- Kernel stack disclosure in UFS/FFS (ff82610f-b309-11e9-a87f-a4badb2f4699)

A bug causes up to three bytes of kernel stack memory to be written to disk as uninitialized directory entry padding. This data can be viewed by any user with read access to the directory. Additionally, a malicious user with write access to a directory can cause up to 254 bytes of kernel stack...

FreeBSD : bro -- NULL pointer dereference and Signed integer overflow (f56669f5-d799-4ff5-9174-64a6d571c451)

Jon Siwek of Corelight reports : This is a security patch release to address potential Denial of Service vulnerabilities : - NULL pointer dereference in the RPC analysis code. RPC analyzers e.g. MOUNT or NFS are not enabled in the default configuration. - Signed integer overflow in BinPAC-generat...

FreeBSD : FreeBSD -- IPv6 fragment reassembly panic in pf(4) (3d02520d-b309-11e9-a87f-a4badb2f4699)

A bug in the pf4 IPv6 fragment reassembly logic incorrectly uses the last extension header offset from the last received packet instead of from the first packet. Impact : Malicious IPv6 packets with different IPv6 extensions could cause a kernel panic or potentially a filtering rule bypass. C...

FreeBSD : FreeBSD -- iconv buffer overflow (f62bba56-b309-11e9-a87f-a4badb2f4699)

With certain inputs, iconv may write beyond the end of the output buffer. Impact : Depending on the way in which iconv is used, an attacker may be able to create a denial of service, provoke incorrect program behavior, or induce a remote code execution. iconv is a libc library function and the...

FreeBSD : FreeBSD -- Resource exhaustion in non-default RACK TCP stack (c294c2e6-b309-11e9-a87f-a4badb2f4699) (ERC)

While processing acknowledgements, the RACK code uses several linked lists to maintain state entries. A malicious attacker can cause the lists to grow unbounded. This can cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a denial of service...

FreeBSD : FreeBSD -- Privilege escalation in cd(4) driver (14a3b376-b30a-11e9-a87f-a4badb2f4699)

To implement one particular ioctl, the Linux emulation code used a special interface present in the cd4 driver which allows it to copy subchannel information directly to a kernel address. This interface was erroneously made accessible to userland, allowing users with read access to a cd4 device t...

FreeBSD : Gitlab -- Multiple Vulnerabilities (1cd89254-b2db-11e9-8001-001b217b3468)

Gitlab reports : GitHub Integration SSRF Trigger Token Impersonation Build Status Disclosure SSRF Mitigation Bypass Information Disclosure New Issue ID IDOR Label Name Enumeration Persistent XSS Wiki Pages User Revokation Bypass with Mattermost Integration Arbitrary File Upload via Import Project...

FreeBSD : FreeBSD -- pts(4) write-after-free (5721ae65-b30a-11e9-a87f-a4badb2f4699)

The code which handles a close2 of a descriptor created by posixopenpt2 fails to undo the configuration which causes SIGIO to be raised. This bug can lead to a write-after-free of kernel memory. Impact : The bug permits malicious code to trigger a write-after-free, which may be used to gain root...

FreeBSD : KDE Frameworks -- malicious .desktop files execute code (f5f0a640-bae8-11e9-bb3a-001e2a3f778d)

The KDE Community has released a security announcement : The syntax Key$e=$shell command in .desktop files, .directory files, and configuration files typically found in /.config was an intentional feature of KConfig, to allow flexible configuration. This could however be abused by malicious peopl...

PT-2019-17779 · Freebsd · Freebsd +2

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 12.0-STABLE before r350637 FreeBSD versions 12.0-RELEASE before 12.0-RELEASE-p9 FreeBSD versions 11.3-STABLE before r350638 FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p2 FreeBSD versions 11.2-RELEASE before...

FreeBSD -- Insufficient validation of guest-supplied data (e1000 device)

Problem Description: The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP checksums, insertion of an Ethernet VLAN header, and TCP segmentation offload "TSO". The e1000 device model uses an...

FreeBSD -- Insufficient message length validation in bsnmp library

Problem Description: A function extracting the length from type-length-value encoding is not properly validating the submitted length. Impact: A remote user could cause, for example, an out-of-bounds read, decoding of unrelated data, or trigger a crash of the software such as bsnmpd resulting in ...

PT-2019-17777 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 11.2-RELEASE before 11.2-RELEASE-p13 FreeBSD versions 11.3-RELEASE before 11.3-RELEASE-p2 FreeBSD versions 12.0-RELEASE before 12.0-RELEASE-p9 Description: The issue arises from the incorrect handling of MLDv2 listener query...

FreeBSD-SA-19:18.bzip2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:18.bzip2 Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in bzip2 Category: contrib Module: bzip2 Announced: 2019-08-06 Affects: All...

FreeBSD-SA-19:20.bsnmp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:20.bsnmp Security Advisory The FreeBSD Project Topic: Insufficient message length validation in bsnmp library Category: contrib Module: bsnmp Announced:...

FreeBSD -- ICMPv6 / MLDv2 out-of-bounds memory access

Problem Description: The ICMPv6 input path incorrectly handles cases where an MLDv2 listener query packet is internally fragmented across multiple mbufs. Impact: A remote attacker may be able to cause an out-of-bounds read or write that may cause the kernel to attempt to access an unmapped page a...

PT-2019-17778 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 11.2-RELEASE through 11.2-RELEASE-p12 FreeBSD versions 11.3-RELEASE through 11.3-RELEASE-p1 FreeBSD versions 12.0-RELEASE through 12.0-RELEASE-p8 Description: The issue arises from the bhyve e1000 device emulation, which uses...