FreeBSD : FreeRADIUS -- TLS resumption authentication bypass (673dce46-46d0-11e7-a539-0050569f7e80)

Stefan Winter reports : The TLS session cache in FreeRADIUS before 3.0.14 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers such as malicious 802.1X supplicants to bypass authentication via PEAP or TTLS. %NASLMINLEVEL 70300 C Tenable Network Securit...

FreeBSD : duo -- Two-factor authentication bypass (738e8ae1-46dd-11e7-a539-0050569f7e80)

The duo security team reports : An untrusted user may be able to set the httpproxy variable to an invalid address. If this happens, this will trigger the configured 'failmode' behavior, which defaults to safe. Safe mode causes the authentication to report a success. %NASLMINLEVEL 70300 C Tenable...

FreeBSD : heimdal -- bypass of capath policy (40a8d798-4615-11e7-8080-a4badb2f4699)

Viktor Dukhovni reports : Commit f469fc6 2010-10-02 inadvertently caused the previous hop realm to not be added to the transit path of issued tickets. This may, in some cases, enable bypass of capath policy in Heimdal versions 1.5 through 7.2. Note, this may break sites that rely on the bug. With...

FreeBSD : vlc -- remote code execution via crafted subtitles (ec6aeb8e-41e4-11e7-aa00-5404a68ad561)

Check Point research team reports : Remote code execution via crafted subtitles %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors...

FreeBSD : FreeBSD -- ipfilter(4) fragment handling panic (51d1282d-420e-11e7-82c5-14dae9d210b8)

ipfilter4, capable of stateful packet inspection, using the 'keep state' or 'keep frags' rule options, will not only maintain the state of connections, such as TCP streams or UDP communication, it also maintains the state of fragmented packets. When a packet fragments are received they are cached...

FreeBSD : FreeBSD -- Multiple vulnerabilities of ntp (3c0237f5-420e-11e7-82c5-14dae9d210b8)

A vulnerability was discovered in the NTP server's parsing of configuration directives. CVE-2017-6464 A vulnerability was found in NTP, in the parsing of packets from the DPTS Clock. CVE-2017-6462 A vulnerability was discovered in the NTP server's parsing of configuration directives. CVE-2017-646...

FreeBSD : OpenEXR -- multiple remote code execution and denial of service vulnerabilities (803879e9-4195-11e7-9b08-080027ef73ec)

Brandon Perry reports : There is a zip file of EXR images that cause segmentation faults in the OpenEXR library tested against 2.2.0. - CVE-2017-9110 In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash. - CVE-2017-9111 In OpenEX...

FreeBSD : ImageMagick -- multiple vulnerabilities (50776801-4183-11e7-b291-b499baebfeaf)

Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution and use in source VuXML and...

FreeBSD : samba -- remote code execution vulnerability (6f4d96c0-4062-11e7-b291-b499baebfeaf) (SambaCry)

The samba project reports : Remote code execution from a writable share. All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it...

FreeBSD : NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler (f52e3a8d-3f7e-11e7-97a9-a0d3c19bfa21)

NVIDIA Unix security team reports : NVIDIA GPU Display Driver contains vulnerabilities in the kernel mode layer handler where not correctly validated user input, NULL pointer dereference, and incorrect access control may lead to denial of service or potential escalation of privileges. %NASLMINLEV...

FreeBSD : miniupnpc -- integer signedness error (da1d5d2e-3eca-11e7-8861-0018fe623f2b)

Tintinweb reports : An integer signedness error was found in miniupnp's miniwget allowing an unauthenticated remote entity typically located on the local network segment to trigger a heap corruption or an access violation in miniupnp's http response parser when processing a specially crafted...

FreeBSD : Wordpress -- multiple vulnerabilities (a5bb7ea0-3e58-11e7-94a2-00e04c1ea73d)

WordPress versions 4.7.4 and earlier are affected by six security issues - Insufficient redirect validation in the HTTP class. - Improper handling of post meta data values in the XML-RPC API. - Lack of capability checks for post meta data in the XML-RPC API. - A Cross Site Request Forgery CRSF...

FreeBSD : asterisk -- Buffer Overrun in PJSIP transaction layer (0537afa3-3ce0-11e7-bf9d-001999f8d30b)

The Asterisk project reports : A remote crash can be triggered by sending a SIP packet to Asterisk with a specially crafted CSeq header and a Via header with no branch parameter. The issue is that the PJSIP RFC 2543 transaction key generation algorithm does not allocate a large enough buffer. By...

FreeBSD : asterisk -- Memory exhaustion on short SCCP packets (fab87bff-3ce5-11e7-bf9d-001999f8d30b)

The Asterisk project reports : A remote memory exhaustion can be triggered by sending an SCCP packet to Asterisk system with 'chanskinny' enabled that is larger than the length of the SCCP header but smaller than the packet length specified in the header. The loop that reads the rest of the packe...

FreeBSD : gitlab -- Various security issues (9704930c-3bb7-11e7-93f7-d43d7e971a1b)

GitLab reports : Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and use in...

FreeBSD : Joomla3 -- SQL Injection (3c2549b3-3bed-11e7-a9f0-a4badb296695)

JSST reports : Inadequate filtering of request data leads to a SQL Injection vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and...

FreeBSD : freetype2 -- buffer overflows (4a088d67-3af2-11e7-9d75-c86000169601)

Werner Lemberg reports : CVE-2017-8105, CVE-2017-8287: Older FreeType versions have out-of-bounds writes caused by heap-based buffer overflows related to Type 1 fonts. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from t...

The vulnerability of the FreeBSD operating system’s kernel allows a hacker to gain privileged access and read a portion of the kernel’s memory.

The vulnerability of the FreeBSD operating system’s kernel is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor, operating locally, to gain privileged access and read part of the kernel’s memory using undefined vectors...

The vulnerability of the system call service in the FreeBSD operating system allows a hacker to gain privileged access.

The vulnerability of the system call handling function “issetugid” in the FreeBSD operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, who operates locally, to gain privileged access using undefined vectors...

The vulnerability of the FreeBSD operating system’s kernel, which allows a hacker to trigger a service failure

The vulnerability of the FreeBSD operating system’s kernel is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted setgroups call...