FreeBSD-SA-19:12.telnet

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:12.telnet Security Advisory The FreeBSD Project Topic: telnet1 client multiple vulnerabilities Category: contrib Module: contrib/telnet Announced: 2019-07-24...

FreeBSD -- telnet(1) client multiple vulnerabilities

Problem Description: Insufficient validation of environment variables in the telnet client supplied in FreeBSD can lead to stack-based buffer overflows. A stack- based overflow is present in the handling of environment variables when connecting via the telnet client to remote telnet servers. This...

FreeBSD -- Bhyve out-of-bounds read in XHCI device

Problem Description: The pcixhcidevicedoorbell function does not validate the 'epid' and 'streamid' provided by the guest, leading to an out-of-bounds read. Impact: A misbehaving bhyve guest could crash the system or access memory that it should not be able to...

PT-2019-17773 · Freebsd · Bhyve +1

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 11.2-RELEASE through 11.2-RELEASE-p11 FreeBSD versions 11.3-RELEASE through 11.3-RELEASE-p0 FreeBSD versions 12.0-RELEASE through 12.0-RELEASE-p7 FreeBSD versions 11.3-STABLE before r350247 FreeBSD versions 12.0-STABLE before...

FreeBSD-SA-19:17.fd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:17.fd Security Advisory The FreeBSD Project Topic: File description reference count leak Category: core Module: unix Announced: 2019-07-24 Credits: Mark...

FreeBSD -- Reference count overflow in mqueue filesystem

Problem Description: System calls operating on file descriptors obtain a reference to relevant struct file which due to a programming error was not always put back, which in turn could be used to overflow the counter of affected struct file. Impact: A local user can use this flaw to obtain access...

PT-2019-17775 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 11.2-RELEASE through 11.2-RELEASE-p11 FreeBSD versions 11.3-RELEASE through 11.3-RELEASE-p0 FreeBSD versions 12.0-RELEASE through 12.0-RELEASE-p7 Description: The issue arises from the handling of the close of a descriptor...

FreeBSD-SA-19:13.pts

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:13.pts Security Advisory The FreeBSD Project Topic: pts4 write-after-free Category: core Module: kernel Announced: 2019-07-24 Credits: syzkaller Affects: All...

FreeBSD-SA-19:14.freebsd32

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:14.freebsd32 Security Advisory The FreeBSD Project Topic: Kernel memory disclosure in freebsd32ioctl Category: core Module: kernel Announced: 2019-07-24...

FreeBSD -- File description reference count leak

Problem Description: If a process attempts to transmit rights over a UNIX-domain socket and an error causes the attempt to fail, references acquired on the rights are not released and are leaked. This bug can be used to cause the reference counter to wrap around and free the corresponding file...

FreeBSD -- Kernel memory disclosure in freebsd32_ioctl

Problem Description: Due to insufficient initialization of memory copied to userland in the components listed above small amounts of kernel memory may be disclosed to userland processes. Impact: A user who can invoke 32-bit FreeBSD ioctls may be able to read the contents of small portions of kern...

FreeBSD -- pts(4) write-after-free

Problem Description: The code which handles a close2 of a descriptor created by posixopenpt2 fails to undo the configuration which causes SIGIO to be raised. This bug can lead to a write-after-free of kernel memory. Impact: The bug permits malicious code to trigger a write-after-free, which may b...

PT-2019-4135 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD versions prior to 12.0-RELEASE-p8 FreeBSD versions prior to 11.3-RELEASE-p1 FreeBSD versions prior to 11.2-RELEASE-p12 Description: The issue is related to the mqueuefs module in FreeBSD, which has inadequate access control. This allo...

FreeBSD : MySQL -- Multiple vulerabilities (198e6220-ac8b-11e9-a1c7-b499baebfeaf)

Oracle reports : This Critical Patch Update contains 45 new security fixes for Oracle MySQL. 4 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. C Tenable Network Security, Inc. The descriptive te...

FreeBSD : drupal -- Drupal core - Access bypass (19d648e0-ab69-11e9-bfef-000ffec0b3e1)

Drupal Security Team reports : In Drupal 8.7.4, when the experimental Workspaces module is enabled, an access bypass condition is created. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4. C Tenable Network Security, Inc. The...

FreeBSD : PuTTY 0.72 -- buffer overflow in SSH-1 and integer overflow in SSH client (5914705c-ab03-11e9-a4f9-080027ac955c)

Simon Tatham reports : Vulnerabilities fixed in this release include : - A malicious SSH-1 server could trigger a buffer overrun by sending extremely short RSA keys, or certain bad packet length fields. Either of these could happen before host key verification, so even if you trust the server you...

FreeBSD : jenkins -- multiple vulnerabilities (df3db21d-1a4d-4c78-acf7-4639e5a795e0)

Jenkins Security Advisory : DescriptionMedium SECURITY-1424 / CVE-2019-10352 Arbitrary file write vulnerability using file parameter definitions High SECURITY-626 / CVE-2019-10353 CSRF protection tokens did not expire Medium SECURITY-534 / CVE-2019-10354 Unauthorized view fragment access C Tenabl...

FreeBSD 11.x < 11.2-RELEASE-p7 / 12.x < 12.0-RELEASE-p1 bootpd stack buffer overflow

The version of the FreeBSD kernel running on the remote host is 11.x prior to 11.2-RELEASE-p7 or 12.x prior to 12.0-RELEASE-p1. It is, therefore, affected by a stack buffer overflow vulnerability in bootpd. Insufficient validation of network-provided data in bootpd may make it possible for a...

honggfuzz vulnerability mining technology principle analysis-vulnerability warning-the black bar safety net

Google AFLWinAFL, the libfuzzer and honggfuzz is the most famous of the three based on code coverage fuzzer is. Online on the AFLWinAFLanalysis of the articles more, and on the latter two Analysis Articles less. Before the spring brother has written about honggfuzz article: honggfuzz vulnerabilit...

FreeBSD : libxslt -- security framework bypass (93167bef-9752-11e9-b61c-b885849ded8e)

Mitre report : libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded. C Tenable...