CVE-2016-1888

The telnetd service in FreeBSD 9.3, 10.1, 10.2, 10.3, and 11.0 allows remote attackers to inject arguments to login and bypass authentication via vectors involving a "sequence of memory allocation failures."...

CVE-2016-1883

Removed by vendor...

CVE-2016-1880

Removed by vendor...

FreeBSD : xen-tools -- oob access in cirrus bitblt copy (a73aba9a-effe-11e6-ae1b-002590263bf5)

The Xen Project reports : When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before the start of video memory. A malicious guest administrator can cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation...

FreeBSD : gtk-vnc -- bounds checking vulnerabilities (79bbb8f8-f049-11e6-8a6a-bcaec565249c)

Daniel P. Berrange reports : CVE-2017-5884 - fix bounds checking for RRE, hextile and copyrect encodings CVE-2017-5885 - fix color map index bounds checking. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD...

FreeBSD : ffmpeg -- heap overflow in lavf/mov.c (7f9b696f-f11b-11e6-b50e-5404a68ad561)

FFmpeg security reports : FFmpeg 3.2.4 fixes the following vulnerabilities : CVE-2017-5024, CVE-2017-5025 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrin...

Authentication flaw

bsnmpd, as used in FreeBSD 9.3, 10.1, and 10.2, uses world-readable permissions on the snmpd.config file, which allows local users to obtain the secret key for USM authentication by reading the file...

CVE-2015-5677

bsnmpd, as used in FreeBSD 9.3, 10.1, and 10.2, uses world-readable permissions on the snmpd.config file, which allows local users to obtain the secret key for USM authentication by reading the file...

CVE-2015-5677

bsnmpd, as used in FreeBSD 9.3, 10.1, and 10.2, uses world-readable permissions on the snmpd.config file, which allows local users to obtain the secret key for USM authentication by reading the file...

CVE-2015-5677

The CVE-2015-5677 issue affects FreeBSD’s bsnmpd in 9.3, 10.1 and 10.2, where the snmpd.config file has world-readable permissions (0644) allowing a local user to read the USM shared secret. This is due to insecure default permissions on the configuration file, enabling potential disclosure of th...

FreeBSD : tiff -- multiple vulnerabilities (fb74eacc-ec8a-11e6-bc8a-0011d823eebd)

libtiff project reports : Multiple flaws have been discovered in libtiff library and utilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and...

FreeBSD : chicken -- multiple vulnerabilities (c6932dd4-eaff-11e6-9ac1-a4badb2f4699)

Peter Bex reports : A buffer overflow error was found in the POSIX unit's procedures process-execute and process-spawn. Additionally, a memory leak existed in this code, which would be triggered when an error is raised during argument and environment processing. Irregex versions before 0.9.6...

FreeBSD : guile2 -- multiple vulnerabilities (b4ecf774-eb01-11e6-9ac1-a4badb2f4699)

Ludovic Courtes reports : The REPL server is vulnerable to the HTTP inter-protocol attack The 'mkdir' procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other thread...

FreeBSD : mantis -- XSS vulnerability (2b63e964-eb04-11e6-9ac1-a4badb2f4699)

wdollman reports : The value of the viewtype parameter on the viewallbugpage.php page is not encoded before being displayed on the page. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

FreeBSD : libebml -- multiple vulnerabilities (a130bd8c-eafe-11e6-9ac1-a4badb2f4699)

Mortiz Bunkus reports : Multiple invalid memory accesses vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistributio...

Open Source Firewall: OPNsense

Open Source Firewall: OPNsense OPNsense is an open source, easy-to-use and easy-to-build FreeBSD based firewall and routing platform. OPNsense includes most of the features available in expensive commercial firewalls, and more in many cases. It brings the rich feature set of commercial offerings...

FreeBSD : jenkins -- multiple vulnerabilities (5cfa9d0c-73d7-4642-af4f-28fbed9e9404)

Jenkins Security Advisory : Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution an...

FreeBSD : shotwell -- failure to encrypt authentication (5a9b3d70-48e2-4267-b196-83064cb14fe0)

Jens Georg reports : I have just released Shotwell 0.24.5 and 0.25.4 which turn on HTTPS encryption all over the publishing plugins. Users using Tumblr and Yandex.Fotki publishing are strongly advised to change their passwords and reauthenticate Shotwell to those services after upgrade. Users of...

FreeBSD : wordpress -- multiple vulnerabilities (14ea4458-e5cd-11e6-b56d-38d547003487)

Aaron D. Campbell reports : WordPress versions 4.7.1 and earlier are affected by three security issues : - The user interface for assigning taxonomy terms in Press This is shown to users who do not have permissions to use it. - WPQuery is vulnerable to a SQL injection SQLi when passing unsafe dat...

FreeBSD : nfsen -- remote command execution (6e83b2f3-e4e3-11e6-9ac1-a4badb2f4699)

Peter Haag reports : A remote attacker with access to the web interface to execute arbitrary commands on the host operating system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyrigh...