FreeBSD : FreeBSD -- routed(8) remote denial of service vulnerability (734233f4-6007-11e6-a6c3-14dae9d210b8)

The input path in routed8 will accept queries from any source and attempt to answer them. However, the output path assumes that the destination address for the response is on a directly connected network. Impact : Upon receipt of a query from a source which is not on a directly connected network,...

FreeBSD : FreeBSD -- Denial of Service in TCP packet processing (729c4a9f-6007-11e6-a6c3-14dae9d210b8)

When a segment with the SYN flag for an already existing connection arrives, the TCP stack tears down the connection, bypassing a check that the sequence number in the segment is in the expected window. Impact : An attacker who has the ability to spoof IP traffic can tear down a TCP connection by...

FreeBSD : FreeBSD -- SCTP ICMPv6 error message vulnerability (78f06a6c-600a-11e6-a6c3-14dae9d210b8)

A lack of proper input checks in the ICMPv6 processing in the SCTP stack can lead to either a failed kernel assertion or to a NULL pointer dereference. In either case, a kernel panic will follow. Impact : A remote, unauthenticated attacker can reliably trigger a kernel panic in a vulnerable syste...

FreeBSD : FreeBSD -- Resource exhaustion in TCP reassembly (0cb9d5bb-600a-11e6-a6c3-14dae9d210b8)

There is a mistake with the introduction of VNET, which converted the global limit on the number of segments that could belong to reassembly queues into a per-VNET limit. Because mbufs are allocated from a global pool, in the presence of a sufficient number of VNETs, the total number of mbufs...

FreeBSD : PostgreSQL -- Denial-of-Service and Code Injection Vulnerabilities (ca16fd0b-5fd1-11e6-a6f2-6cc21735f730)

PostgreSQL project reports : Security Fixes nested CASE expressions + database and role names with embedded special characters - CVE-2016-5423: certain nested CASE expressions can cause the server to crash. - CVE-2016-5424: database and role names with embedded special characters can allow code...

FreeBSD : FreeBSD -- Kernel memory disclosure in control messages and SCTP (7240de58-6007-11e6-a6c3-14dae9d210b8)

Buffer between control message header and data may not be completely initialized before being copied to userland. CVE-2014-3952 Three SCTP cmsgs, SCTPSNDRCV, SCTPEXTRCV and SCTPRCVINFO, have implicit padding that may not be completely initialized before being copied to userland. In addition, thre...

FreeBSD : FreeBSD -- Integer overflow in IGMP protocol (0afe8b29-600a-11e6-a6c3-14dae9d210b8)

An integer overflow in computing the size of IGMPv3 data buffer can result in a buffer which is too small for the requested operation. Impact : An attacker who can send specifically crafted IGMP packets could cause a denial of service situation by causing the kernel to crash. %NASLMINLEVEL 70300 ...

FreeBSD : FreeBSD -- iconv(3) NULL pointer dereference and out-of-bounds array access (6f91a709-6007-11e6-a6c3-14dae9d210b8)

A NULL pointer dereference in the initialization code of the HZ module and an out of bounds array access in the initialization code of the VIQR module make iconvopen3 calls involving HZ or VIQR result in an application crash. Impact : Services where an attacker can control the arguments of an...

FreeBSD : FreeBSD -- Linux compatibility layer issetugid(2) system call (7ac28df1-600a-11e6-a6c3-14dae9d210b8)

A programming error in the Linux compatibility layer could cause the issetugid2 system call to return incorrect information. Impact : If an application relies on output of the issetugid2 system call and that information is incorrect, this could lead to a privilege escalation. %NASLMINLEVEL 70300 ...

FreeBSD : FreeBSD -- Heap vulnerability in bspatch (7d4f4955-600a-11e6-a6c3-14dae9d210b8)

The implementation of bspatch does not check for a negative value on numbers of bytes read from the diff and extra streams, allowing an attacker who can control the patch file to write at arbitrary locations in the heap. This issue was first discovered by The Chromium Project and reported...

FreeBSD : piwik -- XSS vulnerability (28bf62ef-5e2c-11e6-a15f-00248c0c745d)

Piwik reports : We have identified and fixed several XSS security issues in this release. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributo...

FreeBSD : BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers (7d08e608-5e95-11e6-b334-002590263bf5)

ISC reports : DNS protocols were designed with the assumption that a certain amount of trust could be presumed between the operators of primary and secondary servers for a given zone. However, in current practice some organizations have scenarios which require them to accept zone data from source...

FreeBSD : FreeBSD -- Incorrect privilege validation in the NFS server (e5d2442d-5e76-11e6-a6c3-14dae9d210b8)

Problem Description : The kernel incorrectly uses client supplied credentials instead of the one configured in exports5 when filling out the anonymous credential for a NFS export, when -network or -host restrictions are used at the same time. Impact : The remote client may supply privileged...

FreeBSD : FreeBSD -- Kernel memory disclosure in sctp(4) (dd48d9b9-5e7e-11e6-a6c3-14dae9d210b8)

Problem Description : When initializing the SCTP state cookie being sent in INIT-ACK chunks, a buffer allocated from the kernel stack is not completely initialized. Impact : Fragments of kernel memory may be included in SCTP packets and transmitted over the network. For each SCTP session, there a...

FreeBSD : FreeBSD -- integer overflow in IP_MSFILTER (0844632f-5e78-11e6-a6c3-14dae9d210b8)

Problem Description : An integer overflow in computing the size of a temporary buffer can result in a buffer which is too small for the requested operation. Impact : An unprivileged process can read or write pages of memory which belong to the kernel. These may lead to exposure of sensitive...

FreeBSD : collectd -- Network plugin heap overflow (6da45e38-5b55-11e6-8859-000c292ee6b8)

The collectd Project reports : Emilien Gaspar has identified a heap overflow in collectd's network plugin which can be triggered remotely and is potentially exploitable. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

FreeBSD : bind -- denial of service vulnerability (7a31e0de-5b6d-11e6-b334-002590263bf5)

ISC reports : A query name which is too long can cause a segmentation fault in lwresd. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors...

FreeBSD : moodle -- multiple vulnerabilities (3ddcb42b-5b78-11e6-b334-002590263bf5)

Marina Glancy reports : - MSA-16-0019: Glossary search displays entries without checking user permissions to view them - MSA-16-0020: Text injection in email headers - MSA-16-0021: Unenrolled user still receives event monitor notifications even though they can no longer access course %NASLMINLEVE...

FreeBSD : wireshark -- multiple vulnerabilities (610101ea-5b6a-11e6-b334-002590263bf5)

Wireshark development team reports : The following vulnerabilities have been fixed : - wnpa-sec-2016-41 PacketBB crash. Bug 12577 - wnpa-sec-2016-42 WSP infinite loop. Bug 12594 - wnpa-sec-2016-44 RLC long loop. Bug 12660 - wnpa-sec-2016-45 LDSS dissector crash. Bug 12662 - wnpa-sec-2016-46 RLC...

FreeBSD : perl -- local arbitrary code execution (72bfbb09-5a6a-11e6-a6c3-14dae9d210b8)

Sawyer X reports : Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . period characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory. %NASLMINLEVEL 70300 C...