Multiple TCP Selective Acknowledgement (SACK) and Maximum Segment Size (MSS) networking vulnerabilities may cause denial-of-service conditions in Linux and FreeBSD kernels

Overview Multiple TCP Selective Acknowledgement SACK and Maximum Segment Size MSS networking vulnerabilities may cause denial-of-service conditions in Linux and FreeBSD kernels. Description CVE-2019-11477: SACK Panic Linux = 2.6.29. A sequence of specifically crafted selective acknowledgements SA...

Multiple Vulnerabilities Affecting Linux, FreeBSD Kernels

The CERT Coordination Center CERT/CC has released information on TCP networking vulnerabilities affecting Linux and FreeBSD kernels. A remote attacker could exploit these vulnerabilities to cause a denial-of-service condition. The Cybersecurity and Infrastructure Security Agency CISA encourages...

FreeBSD -- Resource exhaustion in non-default RACK TCP stack

Problem Description: While processing acknowledgements, the RACK code uses several linked lists to maintain state entries. A malicious attacker can cause the lists to grow unbounded. This can cause an expensive list traversal on every packet being processed, leading to resource exhaustion and a...

FreeBSD : mozilla -- multiple vulnerabilities (0cea6e0a-7a39-4dac-b3ec-dbc13d404f76)

Mozilla Foundation reports : CVE-2019-11707: Type confusion in Array.pop A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. C Tenable...

Deciso OPNsense Access Control Error Vulnerability

Deciso OPNsense is a FreeBSD-based open source firewall and routing software from Dutch company Deciso. An Access Control Error vulnerability in Deciso OPNsense version 18.7.x prior to 18.7.7, which arises from a network system or product that does not properly restrict access to resources from...

FreeBSD-SA-19:08.rack

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:08.rack Security Advisory The FreeBSD Project Topic: Resource exhaustion in non-default RACK TCP stack Category: core Module: inet Announced: 2019-06-19...

Linux / FreeBSD TCP-Based Denial Of Service Vulnerability

Netflix has identified several TCP networking vulnerabilities in FreeBSD and Linux kernels. The vulnerabilities specifically relate to the minimum segment size MSS and TCP Selective Acknowledgement SACK capabilities. The most serious, dubbed "SACK Panic," allows a remotely-triggered kernel panic ...

FreeBSD : netatalk3 -- remote code execution vulnerability (9c9023ff-9057-11e9-b764-00505632d232)

NIST reports : Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsiopensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution. C Tenable Network Security, In...

FreeBSD : GraphicsMagick -- multiple vulnerabilities (82c07dfa-9016-11e9-af2f-712c38aa3e4c)

GraphicsMagick News : Read 'Security Fixes:' section for details. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution and use in source VuXML an...

PT-2019-2419 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 12.0-STABLE before r349197 FreeBSD versions 12.0-RELEASE before 12.0-RELEASE-p6 Description: The issue is caused by a bug in the non-default RACK TCP stack, allowing an attacker to cause linked lists to grow unbounded, leadin...

FreeBSD : chromium -- use after free (d4fc4599-8f75-11e9-8d9f-3065ec8fd3ec)

Google Chrome Releases reports : 961413 High CVE-2019-5842: Use-after-free in Blink. Reported by BUGFENSE Anonymous Bug Bounties https://bugfense.io on 2019-05-09 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database...

FreeBSD : phpMyAdmin -- CSRF vulnerability in login form (a5681027-8e03-11e9-85f4-6805ca0b3d42)

The phpMyAdmin development team reports : Summary CSRF vulnerability in login form Description A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdm...

FreeBSD : Vim/NeoVim -- Security vulnerability (bbdb9713-8e09-11e9-87bc-002590acae31)

Security releases for Vim/NeoVim : Sandbox escape allows for arbitrary code execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution and u...

FreeBSD : mybb -- vulnerabilities (13960f55-8d35-11e9-9ba0-4c72b94353b5)

mybb Team reports : High risk: Theme import stylesheet name RCE High risk: Nested video MyCode persistent XSS Medium risk: Find Orphaned Attachments reflected XSS Medium risk: Post edit reflected XSS Medium risk: Private Messaging folders SQL injection Low risk: Potential phar deserialization...

FreeBSD : Flash Player -- arbitrary code execution (ab099d2c-8c8c-11e9-8ba7-6451062f0f7a)

Adobe reports : - This update resolves a use-after-free vulnerability that could lead to arbitrary code execution CVE-2019-7845. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques...

FreeBSD : drupal -- Drupal core - Moderately critical (9b8a52fc-89c1-11e9-9ba0-4c72b94353b5)

Drupal Security Team reports : CVE-2019-11831: By-passing protection of Phar Stream Wrapper Interceptor. In order to intercept file invocations like fileexists or stat on compromised Phar archives the base name has to be determined and checked before allowing to be handled by PHP Phar stream...

FreeBSD : Exim -- RCE in deliver_message() function (45bea6b5-8855-11e9-8d41-97657151f8c2)

Exim team and Qualys report : We received a report of a possible remote exploit. Currently there is no evidence of an active use of this exploit. A patch exists already, is being tested, and backported to all versions we released since and including 4.87. The severity depends on your configuratio...

FreeBSD : Django -- AdminURLFieldWidget XSS (ffc73e87-87f0-11e9-ad56-fcaa147e860e)

Django security releases issued : The clickable 'Current URL' link generated by AdminURLFieldWidget displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickab...

FreeBSD : buildbot -- OAuth Authentication Vulnerability (ada8db8a-8471-11e9-8170-0050562a4d7b)

Buildbot accepted user-submitted authorization token from OAuth and used it to authenticate user. The vulnerability can lead to malicious attackers to authenticate as legitimate users of a Buildbot instance without knowledge of the victim's login credentials on certain scenarios. If an attacker h...

FreeBSD : bro -- Unsafe integer conversions can cause unintentional code paths to be executed (177fa455-48fc-4ded-ba1b-9975caa7f62a)

Jon Siwek of Corelight reports : The following Denial of Service vulnerabilities are addressed : - Integer type mismatches in BinPAC-generated parser code and Bro analyzer code may allow for crafted packet data to cause unintentional code paths in the analysis logic to be taken due to unsafe...