FreeBSD : PHP -- Multiple vulnerabilities in EXIF module (c2d1693b-73cb-11e9-a1c7-b499baebfeaf)

The PHP project reports : Heap-buffer-overflow in phpifdget32s CVE-2019-11034 Heap-buffer-overflow in exifiifaddvalue CVE-2019-11035 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques...

FreeBSD : PostgreSQL -- Memory disclosure in partition routing (e66a5440-7258-11e9-b0e1-6cc21735f730)

The PostgreSQL project reports : Prior to this release, a user running PostgreSQL 11 can read arbitrary bytes of server memory by executing a purpose-crafted INSERT statement to a partitioned table. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD : PostgreSQL -- Selectivity estimators bypass row security policies (065890c3-725e-11e9-b0e1-6cc21735f730)

The PostgreSQL project reports : PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user able to execute SQL queries with permissions to read a given column could craft a leaky operat...

FreeBSD : comms/hylafax -- Malformed fax sender remote code execution in JPEG support (3df5a920-6edc-11e9-a44b-0050562a4d7b)

A malicious sender that sets both JPEG and MH,MR,MMR or JBIG in the same DCS signal or sends a large JPEG page could lead to remote code execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

FreeBSD : gitea -- multiple vulnerabilities (a1de4ae9-6fda-11e9-9ba0-4c72b94353b5)

Gitea Team reports : This release contains two new security fixes which cannot be backported to the 1.7.0 branch, so it is recommended to update to this version. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database ...

FreeBSD : Gitlab -- Information Disclosure (4faac805-6be0-11e9-a685-001b217b3468)

Gitlab reports : Information Disclosure with Limited Scope Token C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrine and contributors Redistribution and use in source VuXML and...

FreeBSD : Dovecot -- Multiple vulnerabilities (3f98ccb3-6b8a-11e9-9b5c-a4badb296695)

Aki Tuomi reports : Submission-login crashes with signal 11 due to NULL pointer access when authentication is aborted by disconnecting. This can lead to denial-of-service attack by persistent attackers. Aki Tuomi reports : Submission-login crashes when authentication is started over TLS secured...

The vulnerability of the FreeBSD operating system arises from insufficient validation of input data by the ELF header analyzer. This allows attackers to compromise the confidentiality of protected information or cause service failures.

The vulnerability of the FreeBSD operating system exists due to insufficient checking of input data by the ELF header analyzer. Exploiting this vulnerability can allow an attacker to compromise the confidentiality of protected information or cause service failures...

FreeBSD : buildbot -- CRLF injection in Buildbot login and logout redirect code (5536ea5f-6814-11e9-a8f7-0050562a4d7b)

A CRLF can be injected in Location header of /auth/login and /auth/logout This is due to lack of input validation in the buildbot redirection code. It was not found a way to impact Buildbot product own security through this vulnerability, but it could be used to compromise other sites hosted on t...

FreeBSD : py-yaml -- arbitrary code execution (f6ea18bb-65b9-11e9-8b31-002590045d9c)

pyyaml reports : the PyYAML.load function could be easily exploited to call any Python function. That means it could call any system command using os.system C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

The software for interacting between Linux and FreeBSD virtual machines with the Azure Windows Azure Linux Agent is vulnerable due to incorrect permission assignments for download files. This allows an intruder to gain unauthorized access to sensitive information.

The vulnerability of the software for interacting between Linux and FreeBSD virtual machines with the Azure Windows Azure Linux Agent is related to the improper assignment of permissions to download files. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...

FreeBSD : drupal -- Drupal core - Moderately critical (2bad8b5d-66fb-11e9-9815-78acc0a3b880)

Drupal Security Team reports : CVE-2019-10909: Escape validation messages in the PHP templating engine. CVE-2019-10910: Check service IDs are valid. CVE-2019-10911: Add a separator in the remember me cookie hash. jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extendtru...

FreeBSD : FreeBSD -- SAE side-channel attacks (7e53f9cc-656d-11e9-8e67-206a8a720317)

Side channel attacks in the SAE implementations used by both hostapd AP and wpasupplicant infrastructure BSS station/mesh station. SAE Simultaneous Authentication of Equals is also known as WPA3-Personal. The discovered side channel attacks may be able to leak information about the used password...

FreeBSD : FreeBSD -- SAE confirm missing state validation (98b71436-656d-11e9-8e67-206a8a720317)

When hostapd is used to operate an access point with SAE Simultaneous Authentication of Equals; also known as WPA3-Personal, an invalid authentication sequence could result in the hostapd process terminating due to a NULL pointer dereference when processing SAE confirm message. This was caused by...

FreeBSD : FreeBSD -- EAP-pwd missing commit validation (2da3cb25-6571-11e9-8e67-206a8a720317)

EAP-pwd implementation in hostapd EAP server and wpasupplicant EAP peer does not to validate the received scalar and element values in EAP-pwd-Commit messages properly. This could result in attacks that would be able to complete EAP-pwd authentication exchange without the attacker having to know...

FreeBSD : FreeBSD -- EAP-pwd message reassembly issue with unexpected fragment (a207bbd8-6572-11e9-8e67-206a8a720317)

EAP-pwd implementation in hostapd EAP server and wpasupplicant EAP peer does not to validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to NULL pointer dereference. See...

FreeBSD : FreeBSD -- EAP-pwd side-channel attack (60129efe-656d-11e9-8e67-206a8a720317)

Potential side channel attacks in the SAE implementations used by both hostapd and wpasupplicant see CVE-2019-9494 and VU871675. EAP-pwd uses a similar design for deriving PWE from the password and while a specific attack against EAP-pwd is not yet known to be tested, there is no reason to believ...

FreeBSD : Istio -- Security vulnerabilities (484d3f5e-653a-11e9-b0e3-1c39475b9f84)

Istio reports : Two security vulnerabilities have recently been identified in the Envoy proxy. The vulnerabilities are centered on the fact that Envoy did not normalize HTTP URI paths and did not fully validate HTTP/1.1 header values. These vulnerabilities impact Istio features that rely on Envoy...

FreeBSD : Ghostscript -- Security bypass vulnerability (5ed7102e-6454-11e9-9a3a-001cc0382b2f)

Cedric Buissart Red Hat reports : It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by...

FreeBSD : dovecot -- json encoder crash (a64aa22f-61ec-11e9-85b9-a4badb296695)

Aki Tuomi reports : CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject...