FreeBSD : ntp -- Crafted null dereference attack from a trusted source with an authenticated mode 6 packet (c2576e14-36e2-11e9-9eda-206a8a720317)

Network Time Foundation reports : A crafted malicious authenticated mode 6 ntpq packet from a permitted network address can trigger a NULL pointer dereference, crashing ntpd. Note that for this attack to work, the sending system must be on an address that the target's ntpd accepts mode 6 packets...

FreeBSD : OpenSSL -- ChaCha20-Poly1305 nonce vulnerability (e56f2f7c-410e-11e9-b95c-b499baebfeaf)

The OpenSSL project reports : Low: ChaCha20-Poly1305 with long nonces CVE-2019-1543 ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value IV should be 96 bits 12 bytes. OpenSSL allows a variable nonce length...

FreeBSD : rt -- XSS via jQuery (416ca0f4-3fe0-11e9-bbdd-6805ca0b3d42)

BestPractical reports : The version of jQuery used in RT 4.2 and 4.4 has a Cross-site Scripting XSS vulnerability when using cross-domain Ajax requests. This vulnerability is assigned CVE-2015-9251. RT does not use this jQuery feature so it is not directly vulnerable. jQuery version 1.12 no longe...

FreeBSD : rssh - multiple vulnerabilities (d193aa9f-3f8c-11e9-9a24-6805ca0b38e8)

NVD reports : rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp...

FreeBSD Intel SYSRET Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FreeBSD Intel SYSRET Privilege Escalation', 'Description' = %q This module exploits a vulnerability in the FreeBSD kernel, when running on 64-bit...

FreeBSD - Intel SYSRET Privilege Escalation Exploit

Exploit for freebsd platform in category local exploits This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FreeBSD Intel SYSRET Privilege Escalation', 'Description' = %q This module exploits a...

FreeBSD - Intel SYSRET Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FreeBSD Intel SYSRET Privilege Escalation', 'Description' = %q This module exploits a vulnerability in the FreeBSD kernel, when running on 64-bit...

FreeBSD : slixmpp -- improper access control (526d9642-3ae7-11e9-a669-8c164582fbac)

NVD reports : slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin Persistent Storage of Private Data via PubSub options profile, used for the configuration of default access model that can result in all of th...

FreeBSD : py-gunicorn -- CWE-113 vulnerability (a3e24de7-3f0c-11e9-87d1-00012e582166)

Everardo reports : gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in processheaders function in gunicorn/http/wsgi.py that can result in an attacker causing the server to return arbitrary HTTP headers. C Tenable Network Security...

FreeBSD : Node.js -- multiple vulnerabilities (b71d7193-3c54-11e9-a3f9-00155d006b02)

Node.js reports : Updates are now available for all active Node.js release lines. In addition to fixes for security flaws in Node.js, they also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2r which contains a fix for a moderate severity security vulnerability. For these releases, we have...

FreeBSD : asterisk -- Remote crash vulnerability with SDP protocol violation (be0e3817-3bfe-11e9-9cd6-001999f8d30b)

The Asterisk project reports : When Asterisk makes an outgoing call, a very specific SDP protocol violation by the remote party can cause Asterisk to crash. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

FreeBSD : mybb -- vulnerabilities (395ed9d5-3cca-11e9-9ba0-4c72b94353b5)

mybb Team reports : Medium risk: Reset Password reflected XSS Medium risk: ModCP Profile Editor username reflected XSS Low risk: Predictable CSRF token for guest users Low risk: ACP Stylesheet Properties XSS Low risk: Reset Password username enumeration via email C Tenable Network Security, Inc...

The vulnerability of the kernel of Linux and FreeBSD systems lies in errors in the algorithms used for reassembling packages in TCP stacks, which allows a hacker to cause a service failure.

The vulnerability of the kernel of Linux and FreeBSD systems is related to errors in the algorithms used for repackaging packages in TCP stacks. Exploiting this vulnerability allows a remote attacker to cause service interruptions through specially crafted traffic...

FreeBSD : rdesktop - critical - Remote Code Execution (3e2c9b63-223c-4575-af5c-816acb14e445)

Fix memory corruption in processbitmapdata - CVE-2018-8794 - Fix remote code execution in processbitmapdata - CVE-2018-8795 - Fix remote code execution in processplane - CVE-2018-8797 - Fix Denial of Service in mcsrecvconnectresponse - CVE-2018-20175 - Fix Denial of Service in...

FreeBSD : webkit-gtk -- Multiple vulnerabilities (e3aacd6d-3d01-434c-9330-bc9efd40350f)

The Webkitgtk project reports : CVE-2019-6212 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. CVE-2019-6215 - Processing maliciously crafted web content may lead to arbitrary code...

FreeBSD : drupal -- Drupal core - Highly critical - Remote Code Execution (002b4b05-35dd-11e9-94a8-000ffec0b3e1)

Drupal Security Team Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXM...

FreeBSD : OpenSSL -- Padding oracle vulnerability (7700061f-34f7-11e9-b95c-b499baebfeaf)

The OpenSSL project reports : 0-byte record padding oracle CVE-2019-1559 Moderate If an application encounters a fatal protocol error and then calls SSLshutdown twice once to send a closenotify, and once to receive one then OpenSSL can respond differently to the calling application if a 0 byte...

FreeBSD : msmtp -- certificate-verification issue (f0416fb5-3130-11e9-a5ba-e0d55e883e26)

msmtp developers report : In msmtp 1.8.2, when tlstrustfile has its default configuration, certificate-verification results are not properly checked. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

FreeBSD : mozilla -- multiple vulnerabilities (18211552-f650-4d86-ba4f-e6d5cbfcdbeb)

Mozilla Foundation reports : CVE-2018-18356: Use-after-free in Skia CVE-2019-5785: Integer overflow in Skia CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

FreeBSD : Flash Player -- information disclosure (de11a8fb-2eda-11e9-8fb5-6451062f0f7a)

Adobe reports : - This update resolves an out-of-bounds vulnerability that could lead to information disclosure CVE-2019-7090. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidri...