Code injection

In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is vulnerable to a denial of service due to excessive system resource consumption. This issue can allow a remote attacker who is able to send an arbitrary ip fragments to cause the machine to consume...

CVE-2018-6923

In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is vulnerable to a denial of service due to excessive system resource consumption. This issue can allow a remote attacker who is able to send an arbitrary ip fragments to cause the machine to consume...

CVE-2018-6923

Removed by vendor...

CVE-2018-6923

In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is vulnerable to a denial of service due to excessive system resource consumption. This issue can allow a remote attacker who is able to send an arbitrary ip fragments to cause the machine to consume...

CVE-2018-6923

CVE-2018-6923 affects FreeBSD versions prior to 11.1-STABLE, 11.2-RELEASE-p2, and 11.1-RELEASE-p13. The issue is in the IP fragment reassembly code and can allow a remote attacker that can send arbitrary IP fragments to cause denial of service through excessive resource consumption. The primary p...

FreeBSD : grafana -- LDAP and OAuth login vulnerability (1f8d5806-ac51-11e8-9cb6-10c37b4ac2ea)

Grafana Labs reports : On the 20th of August at 1800 CEST we were contacted about a potential security issue with the 'remember me' cookie Grafana sets upon login. The issue targeted users without a local Grafana password LDAP & OAuth users and enabled a potential attacker to generate a valid...

FreeBSD : Gitlab -- multiple vulnerabilities (ffeb25d0-ac94-11e8-ab15-d8cb8abf62dd)

Gitlab reports : Persistent XSS in Pipeline Tooltip GitLab.com GCP Endpoints Exposure Persistent XSS in Merge Request Changes View Sensitive Data Disclosure in Sidekiq Logs Missing CSRF in System Hooks Orphaned Upload Files Exposure Missing Authorization Control API Repository Storage C Tenable...

FreeBSD : bro -- array bounds and potential DOS issues (d0be41fe-2a20-4633-b057-4e8b25c41780)

Corelight reports : Bro 2.5.5 primarily addresses security issues : - Fix array bounds checking in BinPAC: for arrays that are fields within a record, the bounds check was based on a pointer to the start of the record rather than the start of the array field, potentially resulting in a buffer...

FreeBSD : node.js -- multiple vulnerabilities (0904e81f-a89d-11e8-afbb-bc5ff4f77b71)

Node.js reports : OpenSSL: Client DoS due to large DH parameter This fixes a potential denial of service DoS attack against client connections by a malicious server. During a TLS communication handshake, where both client and server agree to use a cipher-suite using DH or DHE Diffie-Hellman, in...

Linux and FreeBSD Kernels TCP Reassembly Denial of Service Vulnerabilities Affecting Cisco Products: August 2018

On August 6, 2018, the Vulnerability Coordination team of the National Cyber Security Centre of Finland NCSC-FI and the CERT Coordination Center CERT/CC disclosed vulnerabilities in the TCP stacks that are used by the Linux and FreeBSD kernels. These vulnerabilities are publicly known as...

FreeBSD : libX11 -- Multiple vulnerabilities (fe99d3ca-a63a-11e8-a7c6-54e1ad3d6335)

The freedesktop.org project reports : The functions XGetFontPath, XListExtensions, and XListFonts are vulnerable to an off-by-one override on malicious server responses. The server replies consist of chunks consisting of a length byte followed by actual string, which is not NUL-terminated. While...

FreeBSD : FreeBSD -- Resource exhaustion in IP fragment reassembly (359e1548-a652-11e8-805b-a4badb2f4699)

A researcher has notified us of a DoS attack applicable to another operating system. While FreeBSD may not be vulnerable to that exact attack, we have identified several places where inadequate DoS protection could allow an attacker to consume system resources. It is not necessary that the attack...

FreeBSD : FreeBSD -- L1 Terminal Fault (L1TF) Kernel Information Disclosure (2310b814-a652-11e8-805b-a4badb2f4699) (Foreshadow)

On certain Intel 64-bit x86 systems there is a period of time during terminal fault handling where the CPU may use speculative execution to try to load data. The CPU may speculatively access the level 1 data cache L1D. Data which would otherwise be protected may then be determined by using side...

FreeBSD : gogs -- open redirect vulnerability (e53a908d-a645-11e8-8acd-10c37b4ac2ea)

bluecatli Tencent's Xuanwu Lab reports : The function isValidRedirect in gogs/routes/user/auth.go is used in login action to validate if url is on the same site. If the Location header startswith /, it will be transformed to // by browsers. C Tenable Network Security, Inc. The descriptive text an...

FreeBSD : FreeBSD -- Unauthenticated EAPOL-Key Decryption Vulnerability (45671c0e-a652-11e8-805b-a4badb2f4699)

When using WPA2, EAPOL-Key frames with the Encrypted flag and without the MIC flag set, the data field was decrypted first without verifying the MIC. When the dta field was encrypted using RC4, for example, when negotiating TKIP as a pairwise cipher, the unauthenticated but decrypted data was...

FreeBSD : phpmyadmin -- XSS in the import dialog (9e205ef5-a649-11e8-b1f6-6805ca0b3d42)

The phpMyAdmin development team reports : Description A Cross-Site Scripting vulnerability was found in the file import feature, where an attacker can deliver a payload to a user through importing a specially crafted file. Severity We consider this attack to be of moderate severity. C Tenable...

FreeBSD : couchdb -- administrator privilege escalation (9b19b6df-a4be-11e8-9366-0028f8d09152)

Apache CouchDB PMC reports : Database Administrator could achieve privilege escalation to the account that CouchDB runs under, by abusing insufficient validation in the HTTP API, escaping security controls implemented in previous releases. C Tenable Network Security, Inc. The descriptive text and...

BSA-2018-696

Security Advisory ID : BSA-2018-696 Component : Kernel Revision : 1.0: Final A TCP data structure in supported versions of FreeBSD 11, 11.1, 11.2, 10, and 10.4 use an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the numbe...

FreeBSD : botan2 -- ECDSA side channel (7762d7ad-2e38-41d2-9785-c51f653ba8bd)

botan2 developers report : A side channel in the ECDSA signature operation could allow a local attacker to recover the secret key. Found by Keegan Ryan of NCC Group. Bug introduced in 2.5.0, fixed in 2.7.0. The 1.10 branch is not affected. C Tenable Network Security, Inc. The descriptive text and...

FreeBSD Denial of Service Vulnerability (CNVD-2020-38784)

FreeBSD is a set of Unix-like free operating systems in the FreeBSD project, headed by the Core Team team, and is an important branch of Unix-like systems that have evolved through BSD, 386BSD, and 4.4BSD. A denial of service vulnerability exists in the ip fragmentation reorganization code in...