FreeBSD : phpmyadmin -- remote code inclusion and XSS scripting (17cb6ff3-7670-11e8-8854-6805ca0b3d42)

The phpMyAdmin development team reports : Summary XSS in Designer feature Description A Cross-Site Scripting vulnerability was found in the Designer feature, where an attacker can deliver a payload to a user through a specially crafted database name. Severity We consider this attack to be of...

FreeBSD : FreeBSD -- Lazy FPU State Restore Information Disclosure (4e07d94f-75a5-11e8-85d1-a4badb2f4699)

A subset of Intel processors can allow a local thread to infer data from another thread through a speculative execution side channel when Lazy FPU state restore is used. Impact : Any local thread can potentially read FPU state information from other threads running on the host. This could include...

FreeBSD : GraphicsMagick -- multiple vulnerabilities (25f73c47-68a8-4a30-9cbc-1ca5eea4d6ba)

GraphicsMagick reports : Multiple vulnerabilities have been found in GraphicsMagick 1.3.26 or earlier. Please refer to the CVE list for details. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

FreeBSD-SA-18:07.lazyfpu

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-18:07.lazyfpu Security Advisory The FreeBSD Project Topic: Lazy FPU State Restore Information Disclosure Category: core Module: kernel Announced: 2018-06-21...

FreeBSD -- Lazy FPU State Restore Information Disclosure

Problem Description: A subset of Intel processors can allow a local thread to infer data from another thread through a speculative execution side channel when Lazy FPU state restore is used. Impact: Any local thread can potentially read FPU state information from other threads running on the host...

FreeBSD : Libgit2 -- Fixing insufficient validation of submodule names (5a1589ad-68f9-11e8-83f5-d8cb8abf62dd)

The Git community reports : Insufficient validation of submodule names C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and use in source VuX...

FreeBSD : slurm -- insecure handling of user_name and gid fields (3a66cb69-716f-11e8-be54-3085a9a47796)

SchedMD reports : Insecure handling of username and gid fields CVE-2018-10995 While fixes are only available for the supported 17.02 and 17.11 releases, it is believed that similar vulnerabilities do affect past versions as well. The only resolution is to upgrade Slurm to a fixed release. C Tenab...

FreeBSD 7.3 to 9.0-RC1 privilege escalation/denial of service

Buffer overflow in the 'Linux emulation' support in FreeBSD kernel allows local users to cause a denial of service panic and possibly execute arbitrary code by calling the bind system call with a long path for a UNIX-domain socket, which is not properly handled when the address is used by other...

FreeBSD < 10 qls_eioctl function Unauthorized Disclosure of Information

The qlseioctl function in sys/dev/qlxge/qlsioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call. C Tenable Network Security, Inc. include'compat.inc'; if...

FreeBSD : password-store -- GPG parsing vulnerabilities (53eb9e1e-7014-11e8-8b1f-3065ec8fd3ec)

Jason A. Donenfeld reports : Markus Brinkmann discovered that the parsing of gpg command line output with regexes isn't anchored to the beginning of the line, which means an attacker can generate a malicious key that simply has the verification string as part of its username. This has a number of...

FreeBSD : node.js -- multiple vulnerabilities (45b8e2eb-7056-11e8-8fab-63ca6e0e13a2)

Node.js reports : Denial of Service Vulnerability in HTTP/2 CVE-2018-7161 All versions of 8.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service DoS by causing a node server providing an http2 server to crash. This can be accomplished by interacting with...

FreeBSD : libgcrypt -- side-channel attack vulnerability (9b5162de-6f39-11e8-818e-e8e0b747a45a)

GnuPG reports : Mitigate a local side-channel attack on ECDSA signature as described in the white paper 'Return on the Hidden Number Problem'. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-20...

FreeBSD : OpenSSL -- Client DoS due to large DH parameter (c82ecac5-6e3f-11e8-8777-b499baebfeaf)

The OpenSSL project reports : During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until...

FreeBSD : asterisk -- PJSIP endpoint presence disclosure when using ACL (0137167b-6dca-11e8-a671-001999f8d30b)

The Asterisk project reports : When endpoint specific ACL rules block a SIP request they respond with a 403 forbidden. However, if an endpoint is not identified then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot ...

FreeBSD : asterisk -- Infinite loop when reading iostreams (f14ce57f-6dc8-11e8-a671-001999f8d30b)

The Asterisk project reports : When connected to Asterisk via TCP/TLS if the client abruptly disconnects, or sends a specially crafted message then Asterisk gets caught in an infinite loop while trying to read the data stream. Thus rendering the system as unusable. C Tenable Network Security, Inc...

FreeBSD : firefox -- Heap buffer overflow rasterizing paths in SVG with Skia (e3e68fe8-d9cb-4ba8-b09c-9e3a28588eb7)

The Mozilla Foundation reports : A heap buffer overflow can occur in the Skia library when rasterizing paths using a maliciously crafted SVG file with anti-aliasing turned off. This results in a potentially exploitable crash. C Tenable Network Security, Inc. The descriptive text and package check...

FreeBSD : gnupg -- unsanitized output (CVE-2018-12020) (7da0417f-6b24-11e8-84cc-002590acae31)

GnuPG reports : GnuPG did not sanitize input file names, which may then be output to the terminal. This could allow terminal control sequences or fake status messages to be injected into the output. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD : chromium -- Incorrect handling of CSP header (4cb49a23-6c89-11e8-8b33-e8e0b747a45a)

Google Chrome Releases reports : 1 security fix contributed by external researchers : - 845961 High CVE-2018-6148: Incorrect handling of CSP header. Reported by Michal Bentkowski on 2018-05-23 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

FreeBSD : bro -- multiple memory allocation issues (2f4fd3aa-32f8-4116-92f2-68f05398348e)

Corelight reports : Bro 2.5.4 primarily fixes security issues Multiple fixes and improvements to BinPAC generated code related to array parsing, with potential impact to all Bro's BinPAC-generated analyzers in the form of buffer over-reads or other invalid memory accesses depending on whether a...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1516-1)

This update for the Linux Kernel 4.4.90-9250 fixes several issues. The following security issues were fixed : - CVE-2017-13166: An elevation of privilege vulnerability in the kernel v4l2 video driver was fixed. bsc1085447. - CVE-2018-8897: A statement in the System Programming Guide of the Intel ...