FreeBSD : gdk-pixbuf -- multiple vulnerabilities (5a1f1a86-8f4c-11e7-b5af-a4badb2f4699)

TALOS reports : - An exploitable integer overflow vulnerability exists in the tiffimageparse functionality. - An exploitable heap-overflow vulnerability exists in the gdkpixbufjpegimageloadincrement functionality. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

FreeBSD : asterisk -- Remote Crash Vulerability in res_pjsip (ec1df2a1-8ee6-11e7-8be8-001999f8d30b)

The Asterisk project reports : A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020...

FreeBSD < 10.3-RELEASE-p21 / 11.0 < 11.0-RELEASE-p12 / 11.1 < 11.1-RELEASE-p1 OpenSSH Password Length DoS (FreeBSD-SA-17:06.openssh)

The version of the FreeBSD kernel running on the remote host is prior to 10.3-RELEASE-p21, 11.0 prior to 11.0-RELEASE-p12, or 11.1 prior to 11.1-RELEASE-p1. It, therefore, affected by a flaw in built-in password authentication in OpenSSH. An unauthenticated, remote attacker can exploit this issue...

FreeBSD : libgcrypt -- side-channel attack vulnerability (22f28bb3-8d98-11e7-8c37-e8e0b747a45a)

GnuPG reports : Mitigate a local side-channel attack on Curve25519 dubbed 'May the Fourth Be With You'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine...

FreeBSD : rubygems -- multiple vulnerabilities (3f6de636-8cdb-11e7-9c71-f0def1fd7ea2)

Official blog of RubyGems reports : The following vulnerabilities have been reported: a DNS request hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS vulnerability in the query command, and a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrar...

FreeBSD : kanboard -- multiple privilege escalation vulnerabilities (7d7e05fb-64da-435a-84fb-4061493b89b9)

chbi reports : an authenticated standard user could reset the password of another user including admin by altering form data. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

FreeBSD : poppler -- multiple denial of service issues (eca2d861-76f4-42ed-89d2-23a2cb396c87)

Poppler developers report : Poppler is prone to a stack-based buffer-overflow vulnerability. Successful exploits may allow attackers to crash the affected application, resulting in denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible but this has...

FreeBSD : phpmailer -- XSS in code example and default exeception handler (c5d79773-8801-11e7-93f7-d43d7e971a1b)

PHPMailer reports : Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The codegenerator.phps example did not filter user input prior to output. This file is distributed with a .phps extension, so it it not normally executable unless it is explicitly renamed, so it is safe by...

FreeBSD : SquirrelMail -- post-authentication remote code execution (e1de77e8-c45e-48d7-8866-5a6f943046de)

SquirrelMail developers report : SquirrelMail 1.4.22 and other versions before 201704270200-SVN allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote...

FreeBSD : dnsdist -- multiple vulnerabilities (198d82f3-8777-11e7-950a-e8e0b747a45a)

PowerDNS Security Advisory reports : The first issue can lead to a denial of service on 32-bit if a backend sends crafted answers, and the second to an alteration of dnsdist's ACL if the API is enabled, writable and an authenticated user is tricked into visiting a crafted website. %NASLMINLEVEL...

FreeBSD : salt -- Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master (3531141d-a708-477c-954a-2a0549e49ca9)

SaltStack reports : Correct a flaw in minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing characters that will cause a directory...

FreeBSD : pspp -- multiple vulnerabilities (6876b163-8708-11e7-8568-e8e0b747a45a)

CVE Details reports : - There is an Integer overflow in the hashint function of the libpspp library in GNU PSPP 0.10.5-pre2 CVE-2017-10791. - There is a NULL pointer Dereference in the function llinsert of the libpspp library in GNU PSPP 0.10.5-pre2 CVE-2017-10792. - There is an illegal address...

FreeBSD : evince and atril -- command injection vulnerability in CBT handler (01a197ca-67f1-11e7-a266-28924a333806)

GNOME reports : The comic book backend in evince 3.24.0 and earlier is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened. The same vulnerability affects atril, the Evince fork. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (473b6a9e-8493-11e7-b24b-6cf0497db129)

Drupal Security Team : CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...

FreeBSD : libsoup -- stack based buffer overflow (8e7bbddd-8338-11e7-867f-b499baebfeaf)

Tobias Mueller reports : libsoup is susceptible to a stack based buffer overflow attack when using chunked encoding. Regardless of libsoup being used as a server or client. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

FreeBSD Jails Shared Memory Handling Local Security Bypass Vulnerability

FreeBSD is a type of UNIX operating system, an important branch of Unix that evolved from BSD, 386BSD and 4.4BSD. FreeBSD suffers from a local security bypass vulnerability that can be exploited by an attacker to bypass certain security restrictions and perform unauthorized operations. This may...

FreeBSD : Zabbix -- Remote code execution (5df8bd95-8290-11e7-93af-005056925db4)

mitre reports : An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger...

FreeBSD : Supervisord -- An authenticated client can run arbitrary shell commands via malicious XML-RPC requests (c9460380-81e3-11e7-93af-005056925db4)

mnaberez reports : supervisord can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket. The HTTP server is how supervisorctl communicates with supervisord. If an HTTP server has been enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerabilit...

FreeBSD : FreeRadius -- Multiple vulnerabilities (79bbec7e-8141-11e7-b5af-a4badb2f4699)

Guido Vranken reports : Multiple vulnerabilities found via fuzzing : FR-GV-201 v2,v3 Read / write overflow in makesecret FR-GV-202 v2 Write overflow in radcoalesce FR-GV-203 v2 DHCP - Memory leak in decodetlv FR-GV-204 v2 DHCP - Memory leak in frdhcpdecode FR-GV-205 v2 DHCP - Buffer over-read in...

FreeBSD : Mercurial -- multiple vulnerabilities (1d33cdee-7f6b-11e7-a9b5-3debb10a6871)

Mercurial Release Notes : CVE-2017-1000115 Mercurial's symlink auditing was incomplete prior to 4.3, and could be abused to write to files outside the repository. CVE-2017-1000116 Mercurial was not sanitizing hostnames passed to ssh, allowing shell injection attacks on clients by specifying a...