CVE-2022-23087 Bhyve e82545 device emulation out-of-bounds write

The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP checksums, insertion of an Ethernet VLAN header, and TCP segmentation offload "TSO". The e1000 device model uses an on-stack buffer to generat...

FreeBSD : phpmyfaq -- multiple vulnerabilities (cbfc1591-c8c0-11ee-b45a-589cfc0f81b0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cbfc1591-c8c0-11ee-b45a-589cfc0f81b0 advisory. - phpMyFAQ team reports: phpMyFAQ doesn't implement sufficient checks to avoid XSS when storing on...

FreeBSD : FreeBSD -- jail(2) information leak (46a29f83-cb47-11ee-b609-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 46a29f83-cb47-11ee-b609-002590c1f29c advisory. - The jail2 system call has not limited a visiblity of allocated TTYs the kern.ttys sysctl. This gives...

CVE-2022-23093: Buffer Copy without Checking Size of Input

ping reads raw IP packets from the network to process responses in the prpack function. As part of processing a response ping has to reconstruct the IP header, the ICMP header and if present a "quoted packet," which represents the packet that generated an ICMP error. The quoted packet again has a...

CVE-2022-23088: Improper Control of Generation of Code

The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. While a FreeBSD Wi-Fi client is in scanning mode i.e., not associated with a SSID a malicious beacon frame may overwrite kernel memory, leading to remote code...

FreeBSD Security Vulnerabilities

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A security vulnerability exists in FreeBSD that originates from not restricting an add-in's access to , allowing the add-in to read any file that the host user is authorized to access...

FreeBSD : DNSSEC validators -- denial-of-service/CPU exhaustion from KeyTrap and NSEC3 vulnerabilities (21a854cc-cac1-11ee-b7a7-353f1e043d9a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 21a854cc-cac1-11ee-b7a7-353f1e043d9a advisory. - Certain DNSSEC aspects of the DNS protocol in RFC 4035 and related RFCs allow remote attacke...

FreeBSD : chromium -- security fix (4edbea45-cb0c-11ee-86bb-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4edbea45-cb0c-11ee-86bb-a8a1599412c6 advisory. - Chrome Releases reports: This update includes 1 security fix. 4edbea45-cb0c-11ee-86bb-a8a1599412c6 No...

FreeBSD : FreeBSD -- bhyveload(8) host file access (c62285cb-cb46-11ee-b609-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c62285cb-cb46-11ee-b609-002590c1f29c advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...

FreeBSD : nginx-devel -- Multiple Vulnerabilities in HTTP/3 (c97a4ecf-cc25-11ee-b0ee-0050569f0b83)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the c97a4ecf-cc25-11ee-b0ee-0050569f0b83 advisory. - When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed...

FreeBSD-SA-24:02.tty

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-24:02.tty Security Advisory The FreeBSD Project Topic: jail2 information leak Category: core Module: jail Announced: 2024-02-14 Credits: Pawel Jakub Dawidek...

FreeBSD-SA-24:01.bhyveload

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-24:01.bhyveload Security Advisory The FreeBSD Project Topic: bhyveload8 host file access Category: core Module: bhyeload Announced: 2024-02-14 Credits: The wate...

FreeBSD -- jail(2) information leak

Problem Description: The jail2 system call has not limited a visiblity of allocated TTYs the kern.ttys sysctl. This gives rise to an information leak about processes outside the current jail. Impact: Attacker can get information about TTYs allocated on the host or in other jails. Effectively, the...

FreeBSD -- bhyveload(8) host file access

Problem Description: bhyveload -h may be used to grant loader access to the directory tree on the host. Affected versions of bhyveload8 do not make any attempt to restrict loader's access to , allowing the loader to read any file the host user has access to. Impact: In the bhyveload8 model, the...

PT-2024-1718 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD affected versions not specified Description: The issue is related to incorrect process locking in the jail2 system call, which can lead to an information leak about processes outside the current jail. An attacker can exploit this to...

PT-2024-1817 · Freebsd · Bhyveload +1

Name of the Vulnerable Software and Affected Versions: bhyveload versions prior to the fixed version Description: The issue is related to the bhyveload module in FreeBSD, which is associated with incorrect restriction of the host-path directory name with limited access. This could allow a remote...

FreeBSD : readstat -- Heap buffer overflow in readstat_convert (388eefc0-c93f-11ee-92ce-4ccc6adda413)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 388eefc0-c93f-11ee-92ce-4ccc6adda413 advisory. - Google reports: A heap buffer overflow exists in readstatconvert. 388eefc0-c93f-11ee-92ce-4ccc6adda41...

FreeBSD : p5-Spreadsheet-ParseExcel -- Remote Code Execution Vulnerability (cb22a9a6-c907-11ee-8d1c-40b034429ecf)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cb22a9a6-c907-11ee-8d1c-40b034429ecf advisory. - Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files...

FreeBSD : openexr -- Heap Overflow in Scanline Deep Data Parsing (f161a5ad-c9bd-11ee-b7a7-353f1e043d9a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f161a5ad-c9bd-11ee-b7a7-353f1e043d9a advisory. - Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep...

FreeBSD : Gitlab -- vulnerabilities (6b2cba6a-c6a5-11ee-97d0-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6b2cba6a-c6a5-11ee-97d0-001b217b3468 advisory. - An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7,...