CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-5595
https://notcve.org/view.php?id=CVE-2019-5595
In FreeBSD before 11.2-STABLE(r343782), 11.2-RELEASE-p9, 12.0-STABLE(r343781), and 12.0-RELEASE-p3, kernel callee-save registers are not properly sanitized before return from system calls, potentially allowing some kernel data used in the system call to be exposed. En FreeBSD, en versiones anteriores a la 11.2-STABLE(r343782), 11.2-RELEASE-p9, 12.0-STABLE(r343781) y 12.0-RELEASE-p3, los registros callee-save del kernel no se sanean correctamente antes de volver de las llamadas del sistema, lo que podría permitir que se expongan algunos datos del kernel empleados en la llamada del sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/156624 https://security.FreeBSD.org/advisories/FreeBSD-SA-19:01.syscall.asc • CWE-459: Incomplete Cleanup •
CVSS: 5.9EPSS: 0%CPEs: 55EXPL: 3CVE-2019-6111 – OpenSSH SCP Client - Write Arbitrary Files
https://notcve.org/view.php?id=CVE-2019-6111
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). • https://www.exploit-db.com/exploits/46516 https://www.exploit-db.com/exploits/46193 http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html http://www.openwall.com/lists/oss-security/2019/04/18/1 http://www.openwall.com/lists/oss-security/2022/08/02/1 http://www.securityfocus.com/bid/106741 https://access.redhat.com/errata/RHSA-2019:3702 https://bugzilla.redhat.com/show_bug.cgi?id=1677794 https://cert-portal.siemens.com/productcert/pdf/ssa-412672&# • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 2%CPEs: 7EXPL: 0CVE-2018-17161
https://notcve.org/view.php?id=CVE-2018-17161
In FreeBSD before 11.2-STABLE(r348229), 11.2-RELEASE-p7, 12.0-STABLE(r342228), and 12.0-RELEASE-p1, insufficient validation of network-provided data in bootpd may make it possible for a malicious attacker to craft a bootp packet which could cause a stack buffer overflow. It is possible that the buffer overflow could lead to a Denial of Service or remote code execution. En FreeBSD en versiones anteriores a la 1.2-STABLE(r348229), 11.2-RELEASE-p7 y 12.0-STABLE(r342228) y en la 12.0-RELEASE-p1, una validación insuficiente de los datos proporcionados por la red en bootpd podría permitir que un atacante malicioso manipule un paquete bootp, lo que podría conducir a un desbordamiento de búfer basado en pila. Es posible que el desbordamiento de búfer provoque una denegación de servicio (DoS) o ejecución remota de código. • http://www.securityfocus.com/bid/106292 https://security.freebsd.org/advisories/FreeBSD-SA-18:15.bootpd.asc • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •