📄 FreeBSD Routing Socket Input Validation

This proof of concept exploit attempts to test the robustness of the FreeBSD routing socket subsystem by crafting a RTMADD message containing an intentionally oversized sockaddr structure salen greater than the traditional sockaddrstorage limit of 128 bytes...

FreeBSD Security Advisory - FreeBSD-SA-26:05.route

FreeBSD Security Advisory - The rtsockmsgbuffer function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddrstorage structure on the stack. It assumes that the source sockaddr length field had already been validated, but this is not...

PT-2026-21819

By default, jailed processes cannot mount filesystems, including nullfs4. However, the allow.mount.nullfs option enables mounting nullfs filesystems, subject to privilege checks. If a privileged user within a jail is able to nullfs-mount directories, a limitation of the kernel's path lookup logic...

FreeBSD-SA-26:04.jail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:04.jail Security Advisory The FreeBSD Project Topic: Jail chroot escape via fd exchange with a different jail Category: core Module: jail Announced:...

FreeBSD Security Advisory - FreeBSD-SA-26:04.jail

FreeBSD Security Advisory - If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may nonetheless be able to access a shared directory via a nullfs mount, if the administrator h...

PT-2026-21820

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description A critical flaw exists in FreeBSD that allows a jailed process to escape its confinement. Successful exploitation of this issue can lead to full filesystem access, effectively breaking the...

FreeBSD -- Local DoS and possible privilege escalation via routing sockets

Problem Description: The rtsockmsgbuffer function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddrstorage structure on the stack. It assumes that the source sockaddr length field had already been validated, but this is not necessarily...

PT-2026-21884

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description The rtsock msg buffer function copies sockaddr structures into a sockaddr storage structure on the stack without proper validation of the source sockaddr length. This can lead to a 127-byte...

FreeBSD : Vaultwarden -- Multiple vulnerabilities (4594110e-1151-11f1-b3f8-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4594110e-1151-11f1-b3f8-8447094a420f advisory. The Vaultwarden project reports: Tenable has extracted the preceding description block directly from th...

FreeBSD -- Jail chroot escape via fd exchange with a different jail

Problem Description: If two sibling jails are restricted to separate filesystem trees, which is to say that neither of the two jail root directories is an ancestor of the other, jailed processes may nonetheless be able to access a shared directory via a nullfs mount, if the administrator has...

FreeBSD : openexr -- buffer overflow in istream_nonparallel_read on invalid input data (716d25a6-0fdc-11f1-bfdf-ff9355aecb00)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 716d25a6-0fdc-11f1-bfdf-ff9355aecb00 advisory. Cary Phillips reports: openexr v3.4.5 ... fixes an incorrect size check in istreamnonparallelread that...

FreeBSD : jenkins -- multiple vulnerabilities (428e782a-0e92-11f1-a9b1-0cc47ada5f32)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 428e782a-0e92-11f1-a9b1-0cc47ada5f32 advisory. Jenkins Security Advisory: Stored XSS vulnerability in node offline cause description Build...

FreeBSD : Mozilla -- Heap buffer overflow (6a81dc74-0e8b-11f1-b7d1-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6a81dc74-0e8b-11f1-b7d1-b42e991fc52e advisory. https://bugzilla.mozilla.org/showbug.cgi?id=2014390 reports: Heap buffer overflow in libvpx. Tenable ha...

FreeBSD : chromium -- security fixes (a977cb1c-0d7d-11f1-85c5-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a977cb1c-0d7d-11f1-85c5-a8a1599412c6 advisory. Chrome Releases reports: This update includes 3 security fixes: Tenable has extracted the...

FreeBSD : powerdns-recursor -- Denial of Service (67793feb-0b5b-11f1-a1c0-0050569f0b83)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 67793feb-0b5b-11f1-a1c0-0050569f0b83 advisory. PowerDNS Team reports: 2025-07: Internal logic flaw in cache management can lead to a denial o...

pfSense 代码问题漏洞

pfSense is a network firewall based on FreeBSD Linux. pfSense has code-related vulnerabilities, which stem from defects in the code, potentially leading to execution of unauthorized code...

FreeBSD : png -- CWE-122: Heap-based Buffer Overflow (f9cb72e4-0b52-11f1-8e75-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f9cb72e4-0b52-11f1-8e75-b42e991fc52e advisory. https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3 reports: LIBPNG is a referen...

FreeBSD : chromium -- security fix (424d598b-09c4-11f1-85c5-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 424d598b-09c4-11f1-85c5-a8a1599412c6 advisory. Chrome Releases reports: This update includes 1 security fix: Tenable has extracted the preceding...

FreeBSD : traefik -- TCP readTimeout bypass via STARTTLS on Postgres (590979aa-09f7-11f1-a730-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 590979aa-09f7-11f1-a730-5404a68ad561 advisory. The traefik project reports: There is a potential vulnerability in Traefik managing STARTTLS requests. ...

FreeBSD : munge -- CWE-787: Out-of-bounds Write (17186409-09d2-11f1-a39c-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 17186409-09d2-11f1-a39c-b42e991fc52e advisory. https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh reports: MUNGE is an authenticatio...