CVE-1999-0305

The system configuration control sysctl facility in BSD based operating systems OpenBSD 2.2 and earlier, and FreeBSD 2.2.5 and earlier, does not properly restrict source routed packets even when the 1 dosourceroute or 2 forwarding variables are set, which allows remote attackers to spoof TCP...

📄 FreeBSD rtsold 15.x Remote Code Execution

rtsold8 on FreeBSD processes IPv6 Router Advertisement DNSSL options without validating domain names for shell metacharacters. The decoded domains are passed to resolvconf8, a shell script that uses unquoted variable expansion, enabling command injection via substitution. Exploit Title: FreeBSD...

FreeBSD : net-mgmt/net-snmp -- Remote Code Execution (snmptrapd) (e2cd20fd-eb10-11f0-a1c0-0050569f0b83)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e2cd20fd-eb10-11f0-a1c0-0050569f0b83 advisory. net-snmp development team reports: A specially crafted packet to an net-snmp snmptrapd daemon can cause...

FreeBSD : mail/mailpit -- Server-Side Request Forgery (df33c83b-eb4f-11f0-a46f-0897988a1c07)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the df33c83b-eb4f-11f0-a46f-0897988a1c07 advisory. Mailpit author reports: A Server-Side Request Forgery SSRF vulnerability exists in Mailpit's /proxy...

FreeBSD : gstreamer1-plugins-bad -- Out-of-bounds reads in MIDI parser (500cc49c-e93b-11f0-b8d8-4ccc6adda413)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 500cc49c-e93b-11f0-b8d8-4ccc6adda413 advisory. The GStreamer Security Center reports: Multiple out-of-bounds reads in the MIDI parser that ca...

FreeBSD : Forgejo -- Symbolic Link (Symlink) Following (963f4e9d-e4d5-11f0-984f-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 963f4e9d-e4d5-11f0-984f-b42e991fc52e advisory. https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/13.0.2.md reports:...

FreeBSD 安全漏洞

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A security vulnerability exists in FreeBSD that stems from a DNSSL domain name that rtsold8 does not validate shell metacharacters before passing them to resolvconf8, which could lead to remote code execution from a...

FreeBSD rtsold 15.x - Remote Code Execution via DNSSL

Exploit Title: FreeBSD rtsold 15.x - Remote Code Execution via DNSSL Date: 2025-12-16 Exploit Author: Lukas Johannes Möller Vendor Homepage: https://www.freebsd.org/ Version: FreeBSD 13.x, 14.x, 15.x before 2025-12-16 patches Tested on: FreeBSD 14.1-RELEASE CVE: CVE-2025-14558 Description: rtsold...

FreeBSD : fluidsynth -- Use after free when using DLS files (bf854a37-e180-11f0-ac0c-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bf854a37-e180-11f0-ac0c-5404a68ad561 advisory. The fluidsynth authors report: A race condition during unloading of a DLS file can trigger a heap-based...

FreeBSD : MongoDB -- Improper Handling of Length Parameter Inconsistency (c1613867-df16-11f0-8870-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c1613867-df16-11f0-8870-b42e991fc52e advisory. https://jira.mongodb.org/browse/SERVER-115508 reports: Mismatched length fields in Zlib compressed...

FreeBSD : traefik -- Inverted TLS Verification Logic in Kubernetes NGINX Provider (dc7e30db-de67-11f0-b893-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the dc7e30db-de67-11f0-b893-5404a68ad561 advisory. The traefik project reports: There is a potential vulnerability in Traefik NGINX provider managing the...

FreeBSD : traefik -- Bypassing security controls via special characters (91b9790e-de65-11f0-b893-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 91b9790e-de65-11f0-b893-5404a68ad561 advisory. The traefik project reports: There is a potential vulnerability in Traefik managing the requests using ...

Exploit for CVE-2025-14558

CVE-2025-14558 FreeBSD rtsold DNSSL Command Injection RCE...

FreeBSD : smb4k -- Critical vulnerabilities in Mount Helper (c32cb4b7-ddcb-11f0-902c-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the c32cb4b7-ddcb-11f0-902c-b42e991fc52e advisory. vulndb reports: A vulnerability, which was classified as critical, was found in smb4k up to...

FreeBSD : Firefox -- Memory safety bugs (23437e07-ddc0-11f0-902c-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 23437e07-ddc0-11f0-902c-b42e991fc52e advisory. https://bugzilla.mozilla.org/buglist.cgi?bugid=1996570%2C1999700 reports: Memory safety bugs present in...

FreeBSD : chromium -- multiple security fixes (f99e70c2-dcb8-11f0-a15a-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f99e70c2-dcb8-11f0-a15a-a8a1599412c6 advisory. Chrome Releases reports: This update includes 2 security fixes: Tenable has extracted the...

FreeBSD : FreeBSD -- ipfw denial of service (0b22e22a-dae9-11f0-80b8-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0b22e22a-dae9-11f0-80b8-bc241121aa0a advisory. In some cases, the tcp-setmss handler may free the packet data and throw an error without halting the...

FreeBSD : step-certificates -- Authorization Bypass in ACME and SCEP Provisioners (eca46635-db51-11f0-9b8d-40a6b7c3b3b8)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the eca46635-db51-11f0-9b8d-40a6b7c3b3b8 advisory. smallstep reports: An attacker can bypass authorization checks and force a Step CA ACME or SCEP...

FreeBSD : FreeBSD -- Remote code execution via ND6 Router Advertisements (6c9318c7-dae9-11f0-80b8-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6c9318c7-dae9-11f0-80b8-bc241121aa0a advisory. The rtsol8 and rtsold8 programs do not validate the domain search list options provided in router...

FreeBSD Security Advisory - FreeBSD-SA-25:11.ipfw

FreeBSD Security Advisory - In some cases, the 'tcp-setmss' handler may free the packet data and throw an error without halting the rule processing engine. A subsequent rule can then allow the traffic after the packet data is gone, resulting in a NULL pointer dereference...