FreeBSD : dovecot -- json encoder crash (a64aa22f-61ec-11e9-85b9-a4badb296695)

Aki Tuomi reports : CVE-2019-10691: Trying to login with 8bit username containing invalid UTF8 input causes auth process to crash if auth policy is enabled. This could be used rather easily to cause a DoS. Similar crash also happens during mail delivery when using invalid UTF8 in From or Subject...

FreeBSD SNMP OS Detection

Binary data 700590.prm...

FreeBSD : libssh2 -- multiple issues (6e58e1e9-2636-413e-9f84-4c0e21143628)

libssh2 developers report : - Defend against possible integer overflows in compmethodzlibdecomp. - Defend against writing beyond the end of the payload in libssh2transportread. - Sanitize paddinglength - libssh2transportread. - This prevents an underflow resulting in a potential out-of-bounds rea...

FreeBSD : gitea -- remote code execution (b747783f-5fb6-11e9-b2ac-08002705f877)

The Gitea team reports : Prevent remote code execution vulnerability with mirror repo URL settings. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors...

FreeBSD -- EAP-pwd message reassembly issue with unexpected fragment

Problem Description: EAP-pwd implementation in hostapd EAP server and wpasupplicant EAP peer does not to validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to NULL pointer dereference. See...

FreeBSD : wget -- security flaw in caching credentials passed as a part of the URL (a737eb11-5cfc-11e9-ab87-8cec4bf8fcfb)

Gynvael Coldwind reports : setfilemetadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information e.g., credentials contained in the U...

FreeBSD : MySQL -- multiple vulnerabilities (4e1997e8-5de0-11e9-b95c-b499baebfeaf)

Oracle reports : Critical Patch Update Oracle MySQL Executive Summary This Critical Patch Update contains 44 new security fixes for Oracle MySQL. 3 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials...

FreeBSD : Flash Player -- multiple vulnerabilities (45d89773-5b64-11e9-80ed-d43d7ef03aa6)

Adobe reports : - This update resolves a use-after-free vulnerability that could lead to arbitrary code execution CVE-2019-7096. - This update resolves an out-of-bounds read vulnerability that could lead to information disclosure CVE-2019-7108. C Tenable Network Security, Inc. The descriptive tex...

FreeBSD : jenkins -- multiple vulnerabilities (8e9c3f5a-715b-4336-8d05-19babef55e9e)

Jenkins Security Advisory : DescriptionMedium SECURITY-1289 Jenkins accepted cached legacy CLI authentication Medium SECURITY-1327 XSS vulnerability in form validation button C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD...

FreeBSD : Gitlab -- Group Runner Registration Token Exposure (a0602fa0-5c1c-11e9-abd6-001b217b3468)

Gitlab reports : Group Runner Registration Token Exposure C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrine and contributors Redistribution and use in source VuXML and...

CVE-2019-0040

On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance IRI. External packets destined to port 111 should be dropped. Due to an information leak vulnerability, responses were being generated from the source address of the management interface e.g. fxp0 thus...

Information disclosure

On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance IRI. External packets destined to port 111 should be dropped. Due to an information leak vulnerability, responses were being generated from the source address of the management interface e.g. fxp0 thus...

FreeBSD -- EAP-pwd missing commit validation

Problem Description: EAP-pwd implementation in hostapd EAP server and wpasupplicant EAP peer does not to validate the received scalar and element values in EAP-pwd-Commit messages properly. This could result in attacks that would be able to complete EAP-pwd authentication exchange without the...

FreeBSD -- SAE side-channel attacks

Problem Description: Side channel attacks in the SAE implementations used by both hostapd AP and wpasupplicant infrastructure BSS station/mesh station. SAE Simultaneous Authentication of Equals is also known as WPA3-Personal. The discovered side channel attacks may be able to leak information abo...

FreeBSD -- EAP-pwd side-channel attack

Problem Description: Potential side channel attacks in the SAE implementations used by both hostapd and wpasupplicant see CVE-2019-9494 and VU871675. EAP-pwd uses a similar design for deriving PWE from the password and while a specific attack against EAP-pwd is not yet known to be tested, there i...

FreeBSD : clamav -- multiple vulnerabilities (84ce26c3-5769-11e9-abd6-001b217b3468)

Clamav reports : An out-of-bounds heap read condition may occur when scanning PDF documents An out-of-bounds heap read condition may occur when scanning PE files An out-of-bounds heap write condition may occur when scanning OLE2 files An out-of-bounds heap read condition may occur when scanning...

FreeBSD : Gitlab -- Multiple vulnerabilities (da459dbc-5586-11e9-abd6-001b217b3468)

Gitlab reports : DoS potential for regex in CI/CD refs Related branches visible in issues for guests Persistent XSS at merge request resolve conflicts Improper authorization control 'move issue' Guest users of private projects have access to releases DoS potential on project languages page Recuri...

FreeBSD : Apache -- Multiple vulnerabilities (cf2105c6-551b-11e9-b95c-b499baebfeaf)

The Apache httpd Project reports : Apache HTTP Server privilege escalation from modules' scripts CVE-2019-0211 important modauthdigest access control bypass CVE-2019-0217 important modssl access control bypass CVE-2019-0215 important modhttp2, possible crash on late upgrade CVE-2019-0197 low...

FreeBSD : Kubectl -- Potential directory traversal (6a0129bf-54ad-11e9-987c-1c39475b9f84)

Kubernetes.io reports : A security issue was discovered with the Kubernetes kubectl cp command that could enable a directory traversal replacing or deleting files on a user's workstation. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from t...

FreeBSD : znc -- Denial of Service (b22d6d4c-53b9-11e9-9310-28d244aee256)

Mitre reports : ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service crash via invalid encoding. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrine...