FreeBSD Kernel amd64_set_ldt Heap Overflow

1. Advisory Information Title: FreeBSD Kernel amd64setldt Heap Overflow Advisory ID: CORE-2016-0005 Advisory URL: Date published: 2016-03-16 Date of last update: 2016-03-14 Vendors contacted: FreeBSD Release mode: Coordinated release 2. Vulnerability Information Class: Unsigned to Signed...

FreeBSD 10.2 (x64) - 'amd64_set_ldt' Heap Overflow

/ 1. Advisory Information Title: FreeBSD Kernel amd64setldt Heap Overflow Advisory ID: CORE-2016-0005 Advisory URL: http://www.coresecurity.com/content/freebsd-kernel-amd64setldt-heap-overflow Date published: 2016-03-16 Date of last update: 2016-03-14 Vendors contacted: FreeBSD Release mode:...

FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow

Exploit for freebsd platform in category dos / poc / 1. Advisory Information Title: FreeBSD Kernel amd64setldt Heap Overflow Advisory ID: CORE-2016-0005 Advisory URL: http://www.coresecurity.com/content/freebsd-kernel-amd64setldt-heap-overflow Date published: 2016-03-16 Date of last update:...

FreeBSD 10.2 (x64) - amd64_set_ldt Heap Overflow

FreeBSD 10.2 x64 - amd64setldt Heap Overflow / 1. Advisory Information Title: FreeBSD Kernel amd64setldt Heap Overflow Advisory ID: CORE-2016-0005 Advisory URL: http://www.coresecurity.com/content/freebsd-kernel-amd64setldt-heap-overflow Date published: 2016-03-16 Date of last update: 2016-03-14...

AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection

AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Exploit Title: AKIPS Network Monitor 15.37-16.6 OS Command Injection Date: 03-14-2016 Exploit Author: BrianWGray Contact: https://twitter.com/BrianWGray WebPage: http://somethingbroken.com/ Vendor Homepage: https://www.akips.com/...

FreeBSD-SA-16:15.sysarch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-16:15.sysarch REVISED Security Advisory The FreeBSD Project Topic: Incorrect argument validation in sysarch2 Category: core Module: kernel Announced: 2016-10-25...

FreeBSD-SA-16:14.openssh

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-16:14.openssh Security Advisory The FreeBSD Project Topic: OpenSSH xauth1 command injection Category: contrib Module: OpenSSH Announced: 2016-03-16 Credits:...

FreeBSD -- Incorrect argument validation in sysarch(2)

Problem Description: A special combination of sysarch2 arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to lack of sufficient bounds checking during argument validity verification, unbound...

AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection

Exploit Title: AKIPS Network Monitor 15.37-16.6 OS Command Injection Date: 03-14-2016 Exploit Author: BrianWGray Contact: https://twitter.com/BrianWGray WebPage: http://somethingbroken.com/ Vendor Homepage: https://www.akips.com/ Software Link: https://www.akips.com/showdoc/download Version: 15.3...

FreeBSD : dropbear -- authorized_keys command= bypass (8eb78cdc-e9ec-11e5-85be-14dae9d210b8)

Matt Johnson reports : Validate X11 forwarding input. Could allow bypass of authorizedkeys command= restrictions %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques...

FreeBSD : node -- multiple vulnerabilities (6d33b3e5-ea03-11e5-85be-14dae9d210b8)

Jeremiah Senkpiel reports : - Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks. - Fix a defect that can cause memory corruption in certain very rare cases - Fix a defect that makes the CacheBleed Attack possible %NASLMINLEVEL...

FreeBSD : openssh -- command injection when X11Forwarding is enabled (e4644df8-e7da-11e5-829d-c80aa9043978)

The OpenSSH project reports : Missing sanitisation of untrusted input allows an authenticated user who is able to request X11 forwarding to inject commands to xauth1. Injection of xauth commands grants the ability to read arbitrary files under the authenticated user's privilege, Other xauth...

FreeBSD : jpgraph2 -- XSS vulnerability (77b7ffb7-e937-11e5-8bed-5404a68ad561)

Martin Barbella reports : JpGraph is an object oriented library for PHP that can be used to create various types of graphs which also contains support for client side image maps. The GetURLArguments function for the JpGraph's Graph class does not properly sanitize the names of get and post...

FreeBSD : php5 -- multiple vulnerabilities (e991ef79-e920-11e5-92ce-002590263bf5)

The PHP Group reports : - Phar : - Fixed bug 71498 Out-of-Bound Read in pharparsezipfile. - WDDX : - Fixed bug 71587 Use-After-Free / Double-Free in WDDX Deserialize. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from th...

FreeBSD : php7 -- multiple vulnerabilities (5af511e5-e928-11e5-92ce-002590263bf5)

The PHP Group reports : - Core : - Fixed bug 71637 Multiple Heap Overflow due to integer overflows in xml/filterurl/addcslashes. - SOAP : - Fixed bug 71610 Type Confusion Vulnerability - SOAP / makehttpsoaprequest. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

openSUSE Security Update : MozillaFirefox / mozilla-nspr / mozilla-nss (openSUSE-2016-332)

This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues : MozillaFirefox was updated to Firefox 45.0 boo969894 - requires NSPR 4.12 / NSS 3.21.1 - Instant browser tab sharing through Hello - Synced Tabs button in button bar - Tabs synced via Firefox Accounts from othe...

Security update for Firefox (important)

This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues: MozillaFirefox was updated to Firefox 45.0 boo969894 requires NSPR 4.12 / NSS 3.21.1 Instant browser tab sharing through Hello Synced Tabs button in button bar Tabs synced via Firefox Accounts from other devices...

FreeBSD : quagga -- stack based buffer overflow vulnerability (70c44cd0-e717-11e5-85be-14dae9d210b8)

Donald Sharp reports : A malicious BGP peer may execute arbitrary code in particularly configured remote bgpd hosts. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018...

FreeBSD : pidgin-otr -- use after free (77e0b631-e6cf-11e5-85be-14dae9d210b8)

Hanno Bock reports : The pidgin-otr plugin version 4.0.2 fixes a heap use after free error. The bug is triggered when a user tries to authenticate a buddy and happens in the function createsmpdialog. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

FreeBSD : ricochet -- information disclosure (d71831ef-e6f8-11e5-85be-14dae9d210b8)

special reports : By sending a nickname with some HTML tags in a contact request, an attacker could cause Ricochet to make network requests without Tor after the request is accepted, which would reveal the user's IP address. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive tex...