FreeBSD : graphite2 -- out-of-bounds write with malicious font (cf133acc-82e7-4755-a66a-5ddf90dacbe6)

Mozilla Foundation reports : An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. %NASLMINLEVEL 70300 C Tenable Network...

FreeBSD : libevent -- multiple vulnerabilities (b8ee7a81-a879-4358-9b30-7dd1bd4c14b1)

Debian Security reports : CVE-2016-10195: The nameparse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the labellen variable, which triggers an out-of-bounds stack read. CVE-2016-10196: Stack-based buffer overflow in the...

FreeBSD : mozilla -- multiple vulnerabilities (5e0a038a-ca30-416d-a2f5-38cbf5e7df33)

Mozilla Foundation reports : Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution a...

FreeBSD : MySQL -- multiple vulnerabilities (d9e01c35-2531-11e7-b291-b499baebfeaf) (Riddle)

Oracle reports : This Critical Patch Update contains 39 new security fixes for Oracle MySQL. 11 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Juniper Networks Junos OS Multiple NTP Vulnerabilities

Junos OS is prone to multiple vulnerabilities in NTP. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if...

FreeBSD : BIND -- multiple vulnerabilities (c6861494-1ffb-11e7-934d-d05099c0ae8c)

ISC reports : A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other...

FreeBSD-SA-17:03.ntp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-17:03.ntp Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities of ntp Category: contrib Module: ntp Announced: 2017-04-12 Credits: Network Time...

FreeBSD -- Multiple vulnerabilities of ntp

Problem Description: A vulnerability was discovered in the NTP server's parsing of configuration directives. CVE-2017-6464 A vulnerability was found in NTP, in the parsing of packets from the DPTS Clock. CVE-2017-6462 A vulnerability was discovered in the NTP server's parsing of configuration...

FreeBSD : id Tech 3 -- remote code execution vulnerability (e48355d7-1548-11e7-8611-0090f5f2f347)

The content auto-download of id Tech 3 can be used to deliver maliciously crafted content, that triggers downloading of further content and loading and executing it as native code with user credentials. This affects ioquake3, ioUrbanTerror, OpenArena, the original Quake 3 Arena and other forks...

FreeBSD : xen-kernel -- broken check in memory_exchange() permits PV guest breakout (90becf7c-1acf-11e7-970f-002590263bf5)

The Xen Project reports : The XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays. A malicious or buggy 64-bit PV guest may be able to access all of system memory, allowing f...

FreeBSD : cURL -- potential memory disclosure (04f29189-1a05-11e7-bc6e-b499baebfeaf)

The cURL project reports : There were two bugs in curl's parser for the command line option --write-out or -w for short that would skip the end of string zero byte if the string ended in a % percent or \ backslash, and it would read beyond that buffer in the heap memory and it could then...

FreeBSD : asterisk -- Buffer overflow in CDR's set user (356b02e9-1954-11e7-9608-001999f8d30b)

The Asterisk project reports : No size checking is done when setting the user field on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. This allows the possibility of remote code injection. %NASLMINLEVEL 70300 C...

FreeBSD : django -- multiple vulnerabilities (dc880d6c-195d-11e7-8c63-0800277dcc69)

Django team reports : These release addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible. - Open redirect and possible XSS attack via user-supplied numeric redirect URLs - Open redirect vulnerability in django.views.static.serve %NASLMINLEV...

FreeBSD : NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler (057e6616-1885-11e7-bb4d-a0d3c19bfa21)

NVIDIA Unix security team reports : NVIDIA GPU Display Driver contains vulnerabilities in the kernel mode layer handler where multiple integer overflows, improper access control, and improper validation of a user input may cause a denial of service or potential escalation of privileges...

libXdmcp -- insufficient entropy generating session keys

The freedesktop and x.org project reports: It was discovered that libXdmcp before 1.1.3 used weak entropy to generate session keys on platforms without arc4randombuf but with getentropy. On a multi-user system using xdmcp, a local attacker could potentially use information available from the...

FreeBSD : chromium -- multiple vulnerabilities (7cf058d8-158d-11e7-ba2c-e8e0b747a45a)

Google Chrome Releases reports : 5 security fixes in this release, including : - 698622 Critical CVE-2017-5055: Use after free in printing. Credit to Wadih Matar - 699166 High CVE-2017-5054: Heap buffer overflow in V8. Credit to Nicolas Trippar of Zimperium zLabs - 662767 High CVE-2017-5052: Bad...

FreeBSD : xen-tools -- xenstore denial of service via repeated update (47873d72-14eb-11e7-970f-002590263bf5)

The Xen Project reports : Unprivileged guests may be able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service DoS of the entire host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD : hostapd -- multiple vulnerabilities (04bc4e23-9a70-42cb-9fec-3613632d34bc)

Jouni Malinen reports : EAP-pwd missing last fragment length validation. 2015-7 - CVE-2015-5315 psk configuration parameter update allowing arbitrary data to be written. 2016-1 - CVE-2016-4476 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

FreeBSD : phpMyAdmin -- bypass 'no password' restriction (68611303-149e-11e7-b9bb-6805ca0b3d42)

The phpMyAdmin team reports : Summary Bypass $cfg'Servers'$i'AllowNoPassword' Description A vulnerability was discovered where the restrictions caused by $cfg'Servers'$i'AllowNoPassword' = false are bypassed under certain PHP versions. This can allow the login of users who have no password set ev...

FreeBSD : samba -- symlink race allows access outside share definition (2826317b-10ec-11e7-944e-000c292e4fd8)

Samba team reports : A time-of-check, time-of-use race condition can allow clients to access non-exported parts of the file system via symlinks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML databa...