CVE-2018-6922

One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-p10 uses an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the number of segments in...

CVE-2018-6922

CVE-2018-6922 describes a denial-of-service vulnerability in FreeBSD where an inefficient TCP reassembly algorithm causes CPU usage to scale with the reassembly queue length. A remote attacker able to send TCP traffic to a vulnerable system can degrade network performance or exhaust CPU. Affected...

FreeBSD : MySQL -- multiple vulnerabilities (909be51b-9b3b-11e8-add2-b499baebfeaf)

Oracle reports : Multiple vulnerabilities have been disclosed by Oracle without further detail. CVSS scores 7.1 - 2.7 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and...

FreeBSD : xml-security-c -- crashes on malformed KeyInfo content (5786185a-9a43-11e8-b34b-6cc21735f730)

The shibboleth project reports : SAML messages, assertions, and metadata all commonly make use of the XML Signature KeyInfo construct, which expresses information about keys and certificates used in signing or encrypting XML. The Apache Santuario XML Security for C++ library contained code paths ...

FreeBSD CPU Resource Consumption Vulnerability

FreeBSD is a set of Unix-like free operating systems in the FreeBSD project, headed by the Core Team team, and is an important branch of Unix-like systems that have evolved through BSD, 386BSD, and 4.4BSD. A security vulnerability exists in FreeBSD versions prior to 11.2-RELEASE-p1,...

FreeBSD : FreeBSD -- Resource exhaustion in TCP reassembly (3c2eea8c-99bf-11e8-8bee-a4badb2f4699)

One of the data structures that holds TCP segments uses an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the number of segments in the reassembly queue. Impact : An attacker who has the ability to send TCP traffic to a...

FreeBSD : cgit -- directory traversal vulnerability (06c4a79b-981d-11e8-b460-9c5c8e75236a)

Jann Horn reports : cgitcloneobjects in CGit before 1.2.1 has a directory traversal vulnerability when enable-http-clone=1 is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

TCP implementations vulnerable to Denial of Service

Overview The Linux kernel versions 4.9+ and supported versions of FreeBSD are vulnerable to denial of service conditions with low rates of specially modified packets. Description CWE-400: Uncontrolled Resource Consumption 'Resource Exhaustion' - CVE-2018-5390Linux kernel versions 4.9+ can be...

FreeBSD-SA-18:08.tcp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-18:08.tcp Security Advisory The FreeBSD Project Topic: Resource exhaustion in TCP reassembly Category: core Module: inet Announced: 2018-08-06 Credits:...

FreeBSD -- Resource exhaustion in TCP reassembly

Problem Description: One of the data structures that holds TCP segments uses an inefficient algorithm to reassemble the data. This causes the CPU time spent on segment processing to grow linearly with the number of segments in the reassembly queue. Impact: An attacker who has the ability to send...

FreeBSD : py-cryptography -- tag forgery vulnerability (9e2d0dcf-9926-11e8-a92d-0050562a4d7b)

The Python Cryptographic Authority PyCA project reports : finalizewithtag allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the mintaglength provided to the GCM constructor C Tenable Network Security, Inc. The descriptive text and package checks ...

CVE-2018-14939

The getapppath function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impac...

CVE-2018-14939

The getapppath function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impac...

Buffer overflow

The getapppath function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impac...

CVE-2018-14939

The getapppath function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impac...

FreeBSD : sinatra -- XSS vulnerability (ca05d9da-ac1d-4113-8a05-ffe9cd0d6160)

Sinatra blog : Sinatra had a critical vulnerability since v2.0.0. The purpose of this release is to fix CVE-2018-11627. The vulnerability is that XSS can be executed by using illegal parameters. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

FreeBSD : rubygem-doorkeeper -- token revocation vulnerability (e309a2c7-598b-4fa6-a398-bc72fbd1d167)

NVD reports : Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry. C Tenable Network Security, Inc. The descriptive text...

FreeBSD : mailman -- content spoofing with invalid list names in web UI (b4f0ad36-94a5-11e8-9007-080027ac955c)

Mark Sapiro reports : A URL with a very long text listname such as http://www.example.com/mailman/listinfo/Thisisalongstringwithsom ephishingtext will echo the text in the 'No such list' error response. This can be used to make a potential victim think the phishing text comes from a trusted site...

FreeBSD : chromium -- multiple vulnerabilities (b9c525d9-9198-11e8-beba-080027ef1a23)

Google Chrome Releases reports : 42 security fixes in this release, including : - 850350 High CVE-2018-6153: Stack buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS Security Team on 2018-06-07 - 848914 High CVE-2018-6154: Heap buffer overflow in WebGL. Reported by Omair on 2018-06-01 -...

FreeBSD : curl -- SMTP send heap buffer overflow (3849e28f-8693-11e8-9610-9c5c8e75236a)

Peter Wu reports : curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidri...