FreeBSD : FreeBSD -- WPA2 protocol vulnerability (1f8de723-dab3-11e7-b5af-a4badb2f4699)

A vulnerability was found in how a number of implementations can be triggered to reconfigure WPA/WPA2/RSN keys TK, GTK, or IGTK by replaying a specific frame that is used to manage the keys. Impact : Such reinstallation of the encryption key can result in two different types of vulnerabilities:...

FreeBSD : mozilla -- multiple vulnerabilities (b7e23050-2d5d-4e61-9b48-62e89db222ca)

Mozilla Foundation reports : CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data CVE-2017-7844: Visited history information leak through SVG image %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fro...

FreeBSD : wordpress -- multiple issues (a2589511-d6ba-11e7-88dd-00e04c1ea73d)

wordpress developers reports : Use a properly generated hash for the newbloguser key instead of a determinate substring. Add escaping to the language attributes used on html elements. Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds. Remove the ability to upload...

FreeBSD : varnish -- information disclosure vulnerability (17133e7e-d764-11e7-b5af-a4badb2f4699)

Varnish reports : A wrong if statement in the varnishd source code means that synthetic objects in stevedores which over-allocate, may leak up to page size of data from a malloc3 memory allocation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

FreeBSD : asterisk -- DOS Vulnerability in Asterisk chan_skinny (e91cf90c-d6dd-11e7-9d10-001999f8d30b)

The Asterisk project reports : If the chanskinny AKA SCCP protocol channel driver is flooded with certain requests it can cause the asterisk process to use excessive amounts of virtual memory eventually causing asterisk to stop processing requests of any kind. %NASLMINLEVEL 70300 C Tenable Networ...

FreeBSD : mybb -- multiple vulnerabilities (addad6de-d752-11e7-99bf-00e04c1ea73d)

mybb Team reports : High risk: Language file headers RCE Low risk: Language Pack Properties XSS %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and...

FreeBSD 10.3 / 10.4 : shm Insecure Memory Vulnerability (FreeBSD-SA-17:09.shm)

The version of the FreeBSD kernel running on the remote host is prior to 10.3-RELEASE-p24, or 10.4 prior to 10.4-RELEASE-p3. It is, therefore, affected by a potential information disclosure vulnerabilities in shm. An authenticated, remote attacker can exploit this issue by accessing the shared...

FreeBSD 10.3 / 10.4 / 11.0 / 11.1 : ptrace / kldstat Information Disclosure Vulnerabilities (FreeBSD-SA-17:08.ptrace) (FreeBSD-SA-17:10.kldstat)

The version of the FreeBSD kernel running on the remote host is prior to 10.3-RELEASE-p24, 10.4 prior to 10.4-RELEASE-p3, 11.0 prior to 11.0-RELEASE-p15, or 11.1 prior to 11.1-RELEASE-p4. It is, therefore, affected by a potential information disclosure vulnerabilities in ptrace and kldstat. An...

FreeBSD : exim -- remote DoS attack in BDAT processing (75dd622c-d5fd-11e7-b9fe-c13eb7bcbf4f)

Exim developers team reports : The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service infinite loop and stack exhaustion via vectors involving BDAT commands and an improper check for a '.' character signifying the end of...

FreeBSD : xrdp -- local user can cause a denial of service (a66f9be2-d519-11e7-9866-c85b763a2f96)

xrdp reports : The scpv0saccept function in the session manager uses an untrusted integer as a write length, which allows local users to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted input stream. %NASLMINLEVEL 70300 C...

FreeBSD : cURL -- Multiple vulnerabilities (301a01b7-d50e-11e7-ac58-b499baebfeaf)

The cURL project reports : - NTLM buffer overflow via integer overflow CVE-2017-8816libcurl contains a buffer overrun flaw in the NTLM authentication code. The internal function Curlntlmcoremkntlmv2hash sums up the lengths of the user name + password = SUM and multiplies the sum by two = SIZE to...

FreeBSD-SA-17:11.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-17:11.openssl Security Advisory The FreeBSD Project Topic: OpenSSL multiple vulnerabilities Category: contrib Module: openssl Announced: 2017-11-29 Affects: All...

pfSense 2.3.1_1 Remote Command Execution Exploit

pfSense versions 2.3.11 and below contain a remote command execution vulnerability post authentication in the systemgroupmanager.php page. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'pfSens...

FreeBSD : borgbackup -- remote users can override repository restrictions (0d369972-d4ba-11e7-bfca-005056925db4)

BorgBackup reports : Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers. A user able to access a remote Borg SSH server is able to circumvent access controls post-authentication. Affected releases: 1.1.0, 1.1.1, 1.1.2. Releases 1.0....

FreeBSD -- OpenSSL multiple vulnerabilities

Problem Description: If an X.509 certificate has a malformed IPAddressFamily extension, OpenSSL could do a one-byte buffer overread. CVE-2017-3735 There is a carry propagating bug in the x8664 Montgomery squaring procedure. This only affects processors that support the BMI1, BMI2 and ADX extensio...

FreeBSD : palemoon -- multiple vulnerabilities (6056bf68-f570-4e70-b740-b9f606971283)

Pale Moon reports : CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers CVE-2017-7835: Mixed content blocking incorrectly applies with redirects CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags %NASLMINLEVEL 70300 C...

FreeBSD : exim -- remote code execution, deny of service in BDAT (68b29058-d348-11e7-b9fe-c13eb7bcbf4f)

Exim team reports : The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service use-after-free via vectors involving BDAT commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

FreeBSD : salt -- multiple vulnerabilities (50127e44-7b88-4ade-8e12-5d57320823f1)

SaltStack reports : Directory traversal vulnerability in minion id validation in SaltStack. Allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. Credit for discovering the security flaw goes to: Julian Brost [email protected]. NOTE: this...

FreeBSD : codeigniter -- input validation bypass (ef3423e4-d056-11e7-a52c-002590263bf5)

The CodeIgniter changelog reports : Security: Fixed a potential object injection in Cache Library 'apc' driver when save is used with $raw = TRUE. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

FreeBSD : mybb -- multiple vulnerabilities (7761288c-d148-11e7-87e5-00e04c1ea73d)

myBB Team reports : High risk: Installer RCE on configuration file write High risk: Language file headers RCE Medium risk: Installer XSS Medium risk: Mod CP Edit Profile XSS Low risk: Insufficient moderator permission check in delayed moderation tools Low risk: Announcements HTML filter bypass Lo...