CVE-2018-6916

In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p7, 10.4-STABLE, 10.4-RELEASE-p7, and 10.3-RELEASE-p28, the kernel does not properly validate IPsec packets coming from a trusted host. Additionally, a use-after-free vulnerability exists in the IPsec AH handling code. This issue could cause a system...

CVE-2018-6916

CVE-2018-6916 affects FreeBSD kernels prior to 11.1-STABLE/11.1-RELEASE-p7, 10.4-STABLE/10.4-RELEASE-p7, and 10.3-RELEASE-p28. The issue comprises two related IPsec flaws: (1) the kernel does not properly validate IPsec packets from a trusted host, and (2) a use-after-free in the IPsec AH handlin...

CVE-2018-6916

Removed by vendor...

FreeBSD Denial of Service Vulnerability (CNVD-2018-06517)

FreeBSD is a set of Unix-like free operating systems in the FreeBSD project, headed by the Core Team team, and is an important branch of Unix-like systems that have evolved through BSD, 386BSD, and 4.4BSD. A security vulnerability exists in FreeBSD. An attacker could exploit this vulnerability to...

FreeBSD-SA-18:01.ipsec

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-18:01.ipsec REVISED Security Advisory The FreeBSD Project Topic: ipsec validation and use-after-free Category: core Module: ipsec Announced: 2018-03-07 Credits:...

FreeBSD -- ipsec validation and use-after-free

Problem Description: Due to a lack of strict checking, an attacker from a trusted host can send a specially constructed IP packet that may lead to a system crash. Additionally, a use-after-free vulnerability in the AH handling code could cause unpredictable results. Impact: Access to out of bound...

FreeBSD-SA-18:02.ntp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-18:02.ntp Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities of ntp Category: contrib Module: ntp Announced: 2018-03-07 Credits: Network Time...

FreeBSD : wireshark -- multiple security issues (c5ab620f-4576-4ad5-b51f-93e4fec9cd0e)

wireshark developers reports : wnpa-sec-2018-05. IEEE 802.11 dissector crash. CVE-2018-7335 wnpa-sec-2018-06. Large or infinite loops in multiple dissectors. CVE-2018-7321 through CVE-2018-7333 wnpa-sec-2018-07. UMTS MAC dissector crash. CVE-2018-7334 wnpa-sec-2018-08. DOCSIS dissector crash...

FreeBSD : isc-dhcp -- Multiple vulnerabilities (2040c7f5-1e3a-11e8-8ae9-0050569f0b83)

ISC reports : Failure to properly bounds check a buffer used for processing DHCP options allows a malicious server or an entity masquerading as a server to cause a buffer overflow and resulting crash in dhclient by sending a response containing a specially constructed options section. A malicious...

FreeBSD : libsndfile -- multiple vulnerabilities (2b386075-1d9c-11e8-b6aa-4ccc6adda413)

Agostino Sarubbo, Gentoo reports : CVE-2017-8361 Medium: The flacbuffercopy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted audio file. CVE-2017-8362 Medium:...

FreeBSD : PostgreSQL vulnerabilities (e3eeda2e-1d67-11e8-a2ec-6cc21735f730)

The PostgreSQL project reports : - CVE-2018-1058: Uncontrolled search path element in pgdump and other client applications C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine a...

FreeBSD : libsndfile -- out-of-bounds reads (30704aba-1da4-11e8-b6aa-4ccc6adda413)

Xin-Jiang on Github reports : CVE-2017-14245 Medium: An out of bounds read in the function d2alawarray in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values. CVE-2017-14246 Medium: An out of...

FreeBSD : strongswan - Insufficient input validation in RSASSA-PSS signature parser (6a449a37-1570-11e8-8e00-000c294a5758)

Strongswan Release Notes reports : Fixed a DoS vulnerability in the parser for PKCS1 RSASSA-PSS signatures that was caused by insufficient input validation. One of the configurable parameters in algorithm identifier structures for RSASSA-PSS signatures is the mask generation function MGF. Only MG...

FreeBSD Kernel (FreeBSD 10.2 x64) - sendmsg Kernel Heap Overflow (PoC) Exploit

Exploit for freebsd platform in category dos / poc include include include include include include include include include include void atagetxportvoid; int kprintfconst char fmt, ...; char ostype; void resolvechar name struct kldsymlookup ksym; ksym.version = sizeofksym; ksym.symname = name;...

FreeBSD Kernel (FreeBSD 10.2 < 10.3 x64) - SETFKEY (PoC) Exploit

Exploit for freebsd platform in category dos / poc / Code written based on info available here http://cturt.github.io/dlclose-overflow.html See attached LICENCE file Thanks to CTurt and qwertyoruiop - @kr105rlz Download:...

FreeBSD : libsndfile -- out-of-bounds read memory access (004debf9-1d16-11e8-b6aa-4ccc6adda413)

Laurent Delosieres, Secunia Research at Flexera Software reports : Secunia Research has discovered a vulnerability in libsndfile, which can be exploited by malicious people to disclose potentially sensitive information. The vulnerability is caused due to an error in the 'aiffreadchanmap' function...

FreeBSD : tomcat -- Security constraints ignored or applied too late (55c4233e-1844-11e8-a712-0025908740c2)

The Apache Software Foundation reports : Security constraints defined by annotations of Servlets were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order...

FreeBSD : ntp -- multiple vulnerabilities (af485ef4-1c58-11e8-8477-d05099c0ae8c)

Network Time Foundation reports : The NTP Project at Network Time Foundation is releasing ntp-4.2.8p11. This release addresses five security issues in ntpd : - LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU961909: Sybil vulnerability: ephemeral association attack - INFO/MEDIUM: Sec 3412 / CVE-2018-718...

FreeBSD : chromium -- multiple vulnerabilities (8e986b2b-1baa-11e8-a944-54ee754af08e)

Google Chrome Releases reports : Several security fixes in this release, including : - 780450 High CVE-2018-6031: Use after free in PDFium. Reported by Anonymous on 2017-11-01 - 787103 High CVE-2018-6032: Same origin bypass in Shared Worker. Reported by Jun Kokatsu @shhnjk on 2017-11-20 - 793620...

FreeBSD : chromium -- vulnerability (abfc932e-1ba8-11e8-a944-54ee754af08e)

Google Chrome Releases reports : 1 security fix in this release : - 806388 High CVE-2018-6056: Incorrect derived class instantiation in V8. Reported by lokihardt of Google Project Zero on 2018-01-26 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...