FreeBSD - FGPU Stack Clash (PoC)

FreeBSD - FGPU Stack Clash PoC / FreeBSDCVE-2017-FGPU.c for CVE-2017-1084 please compile with -O0 Copyright C 2017 Qualys, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation,...

FreeBSD - FGPE Stack Clash (PoC)

FreeBSD - FGPE Stack Clash PoC / FreeBSDCVE-2017-FGPE.c for CVE-2017-1084 please compile with -O0 Copyright C 2017 Qualys, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation,...

Linux in the Stack Clash vulnerabilities that may be exploited by hackers to obtain local root privileges-bug warning-the black bar safety net

Last month, Qualys security researchers in a variety of Unix-based Systems found on called the“Stack Clash”the vulnerability could allow an attacker on a UNIX system to gain root privileges and take over the attack computer. Currently security researchers discovered this flaw and are working with...

FreeBSD : exim -- Privilege escalation via multiple memory leaks (8c1a271d-56cf-11e7-b9fe-c13eb7bcbf4f) (Stack Clash)

Qualsys reports : Exim supports the use of multiple '-p' command line arguments which are malloc'ed and never free'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has...

FreeBSD : pear-Horde_Image -- DoS vulnerability (00e4050b-56c1-11e7-8e66-08606e46faad)

Michael J Rubinsky reports : The second vulnerability CVE-2017-9773 is a DOS vulnerability. This only affects Horde installations that do not have a configured image handling backend, and thus use the 'Null' image driver. It is exploitable by a logged in user clicking on a maliciously crafted URL...

FreeBSD : pear-Horde_Image -- remote code execution vulnerability (a7003121-56bf-11e7-8e66-08606e46faad)

Michael J Rubinsky reports : The fist vulnerability CVE-2017-9774 is a Remote Code Execution vulnerability and is exploitable by a logged in user sending a maliciously crafted GET request to the Horde server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

blkif responses leak backend stack data

ISSUE DESCRIPTION The block interface response structure has some discontiguous fields. Certain backends populate the structure fields of an otherwise uninitialized instance of this structure on their stacks, leaking data through the internal or trailing padding field. IMPACT A malicious...

FreeBSD : Apache httpd -- several vulnerabilities (0c2db2aa-5584-11e7-9a7d-b499baebfeaf)

The Apache httpd project reports : - apgetbasicauthpw Authentication Bypass CVE-2017-3167 : Use of the apgetbasicauthpw by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. - modssl NULL pointer Dereference CVE-2017-3169:modssl may...

Visualizing the Stack Clash Vulnerability with Dashboards

Security teams should apply vendor patches immediately to protect their Linux, OpenBSD, NetBSD, FreeBSD and Solaris infrastructure from The Stack Clash vulnerability also see the security advisory. To help in that effort, this blog post describes a new built-in Qualys AssetView dashboard to...

FreeBSD : chromium -- multiple vulnerabilities (f53dd5cc-527f-11e7-a772-e8e0b747a45a)

Google Chrome releases reports : 5 security fixes in this release, including : - 725032 High CVE-2017-5087: Sandbox Escape in IndexedDB. Reported by Ned Williamson on 2017-05-22 - 729991 High CVE-2017-5088: Out of bounds read in V8. Reported by Xiling Gong of Tencent Security Platform Department ...

FreeBSD : Flash Player -- multiple vulnerabilities (cd944b3f-51f6-11e7-b7b2-001c25e46b1d)

Adobe reports : - These updates resolve use-after-free vulnerabilities that could lead to code execution CVE-2017-3075, CVE-2017-3081, CVE-2017-3083, CVE-2017-3084. - These updates resolve memory corruption vulnerabilities that could lead to code execution CVE-2017-3076, CVE-2017-3077,...

FreeBSD : cURL -- URL file scheme drive letter buffer overflow (9314058e-5204-11e7-b712-b1a44a034d72)

cURL security advisory : When libcurl is given either 1. a file: URL that doesn't use two slashes following the colon, or 2. is told that file is the default scheme to use for URLs without scheme ... and the given path starts with a drive letter and libcurl is built for Windows or DOS, then libcu...

FreeBSD : rt and dependent modules -- multiple security vulnerabilities (7a92e958-5207-11e7-8d7c-6805ca0b3d42)

BestPractical reports : Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and us...

FreeBSD : mozilla -- multiple vulnerabilities (6cec1b0a-da15-467d-8691-1dea392d4c8d)

Mozilla Foundation reports : Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution a...

FreeBSD : roundcube -- arbitrary password resets (bce47c89-4d3f-11e7-8080-a4badb2f4699)

Roundcube reports : Roundcube Webmail allows arbitrary password resets by authenticated users. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

FreeBSD : GnuTLS -- Denial of service vulnerability (b33fb1e0-4c37-11e7-afeb-0011d823eebd)

The GnuTLS project reports : It was found using the TLS fuzzer tools that decoding a status response TLS extension with valid contents could lead to a crash due to a NULL pointer dereference. The issue affects GnuTLS server applications. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

FreeBSD : irssi -- remote DoS (165e8951-4be0-11e7-a539-0050569f7e80)

Joseph Bisch reports : When receiving a DCC message without source nick/host, Irssi would attempt to dereference a NULL pointer. When receiving certain incorrectly quoted DCC files, Irssi would try to find the terminating quote one byte before the allocated memory. %NASLMINLEVEL 70300 C Tenable...

FreeBSD : chromium -- multiple vulnerabilities (52f4b48b-4ac3-11e7-99aa-e8e0b747a45a)

Google Chrome releases reports : 30 security fixes in this release Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques...

Command Injection

pidusage is vulnerable to command injections. Unsanitized input given to childprocess.exec resulting in command injection in the ps method. This is caused because the pid is never cast to an integer as it expects. Windows and Linux are not vulnerable but Darwin, SunOS, FreeBSD, and AIX are...

FreeBSD : ansible -- Input validation flaw in jinja2 templating system (15a04b9f-47cb-11e7-a853-001fbc0f280f)

RedHat security team reports : An input validation flaw was found in Ansible, where it fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup calls, they could inject Unicode strings to be parsed by the jinja2 templating system, result in code...