FreeBSD : Keycloak -- multiple vulnerabilities (a28dd61b-be3e-11f1-bd34-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a28dd61b-be3e-11f1-bd34-3c7c3fba4204 advisory. The Keycloak Team reports: Tenable has extracted the preceding description block directly from...

FreeBSD : FreeBSD -- IPv6 UDP sendto(2) bypasses jail loopback restriction (6d92b2a3-bcce-11f1-906f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6d92b2a3-bcce-11f1-906f-bc241121aa0a advisory. The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback...

FreeBSD : Apache httpd -- Multiple vulnerabilities (ed670f20-bdc3-11f1-a6ea-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ed670f20-bdc3-11f1-a6ea-8447094a420f advisory. The Apache httpd project reports: Tenable has extracted the preceding description block direct...

FreeBSD : FreeBSD -- Multiple jail filesystem root escapes (1fe3495b-bccd-11f1-906f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1fe3495b-bccd-11f1-906f-bc241121aa0a advisory. Three flaws allow a jailed process to bypass FDRESOLVEBENEATH: A process in a jail that has...

FreeBSD : OpenSSL -- Multiple vulnerabilities (0d183075-bcb5-11f1-b09d-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0d183075-bcb5-11f1-b09d-8447094a420f advisory. The OpenSSL project reports: Tenable has extracted the preceding description block directly fr...

FreeBSD : FreeBSD -- Memory safety bugs in kqueue copy-on-fork implementation (d725b228-bccc-11f1-906f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d725b228-bccc-11f1-906f-bc241121aa0a advisory. When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude...

FreeBSD : FreeBSD -- Heap out-of-bounds access in semop(2) (6ef25129-bccc-11f1-906f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6ef25129-bccc-11f1-906f-bc241121aa0a advisory. When semop2 blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon...

FreeBSD : FreeBSD -- Remote DoS via receive-side kernel TLS (36c2abd8-bcce-11f1-906f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 36c2abd8-bcce-11f1-906f-bc241121aa0a advisory. TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally...

FreeBSD Security Advisory - FreeBSD-SA-26:67.ktls

FreeBSD Security Advisory - Remote DoS via receive-side kernel TLS. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service DoS...

FreeBSD-SA-26:64.sysvsem

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:64.sysvsem Security Advisory The FreeBSD Project Topic: Heap out-of-bounds access in semop2 Category: core Module: sysvsem Announced: 2026-09-29 Credits: Reo...

FreeBSD-SA-26:66.jail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:66.jail Security Advisory The FreeBSD Project Topic: Multiple jail filesystem root escapes Category: core Module: jail Announced: 2026-09-29 Credits: Jan...

FreeBSD-SA-26:68.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:68.openssl Security Advisory The FreeBSD Project Topic: Out-of-bounds read in OpenSSL DTLS retransmission Category: contrib Module: openssl Announced:...

FreeBSD-SA-26:67.ktls

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:67.ktls Security Advisory The FreeBSD Project Topic: Remote DoS via receive-side kernel TLS Category: core Module: ktls Announced: 2026-09-29 Credits: Mark...

FreeBSD -- IPv6 UDP sendto(2) bypasses jail loopback restriction

Problem Description: The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. Impact: A process in a classic non-VNET jail can send UDP datagrams to services listening on the host's IPv6 loopback...

FreeBSD -- Remote DoS via receive-side kernel TLS

Problem Description: TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followe...

FreeBSD -- Multiple jail filesystem root escapes

Problem Description: Three flaws allow a jailed process to bypass FDRESOLVEBENEATH: When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. CVE-2026-101304 renamea...

FreeBSD -- Memory safety bugs in kqueue copy-on-fork implementation

Problem Description: When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes used internally to track list traversal position before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was droppe...

FreeBSD -- Heap out-of-bounds access in semop(2)

Problem Description: When semop2 blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is...

FreeBSD Security Advisory - FreeBSD-SA-26:69.udp

FreeBSD Security Advisory - IPv6 UDP sendto2 bypasses jail loopback restriction. A process in a classic non-VNET jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation...

FreeBSD Security Advisory - FreeBSD-SA-26:64.sysvsem

FreeBSD Security Advisory - Heap out-of-bounds access in semop2. An unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation...