CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2022-27881
https://notcve.org/view.php?id=CVE-2022-27881
engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement with more than seven nameservers. NOTE: privilege separation and pledge can prevent exploitation. El archivo engine.c en slaacd en OpenBSD versiones 6.9 y 7.0 anteriores a 21-02-2022, presenta un desbordamiento de búfer desencadenable por un anuncio de enrutador IPv6 con más de siete servidores de nombre. NOTA: la separación de privilegios y la protección pueden prevenir la explotación • https://blog.quarkslab.com/heap-overflow-in-openbsds-slaacd-via-router-advertisement.html https://ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/030_slaacd.patch.sig https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/014_slaacd.patch.sig https://security.netapp.com/advisory/ntap-20220506-0005 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 2CVE-2010-4816
https://notcve.org/view.php?id=CVE-2010-4816
It was found in FreeBSD 8.0, 6.3 and 4.9, and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of service of the ftpd service. Se encontró en FreeBSD versiones 8.0, 6.3 y 4.9, y en OpenBSD versiones 4.6 que una desreferencia de puntero null en el archivo ftpd/popen.c puede conllevar a una denegación de servicio remota del servicio ftpd • https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=144761 https://seclists.org/fulldisclosure/2010/Mar/117 https://seclists.org/oss-sec/2011/q3/284 • CWE-476: NULL Pointer Dereference •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26142
https://notcve.org/view.php?id=CVE-2020-26142
An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets, independent of the network configuration. Se detectó un problema en el kernel en OpenBSD versión 6.6. Las implementaciones WEP, WPA, WPA2 y WPA3 tratan las tramas fragmentadas como tramas completas. • http://www.openwall.com/lists/oss-security/2021/05/11/12 https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63 https://www.fragattacks.com • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-16088
https://notcve.org/view.php?id=CVE-2020-16088
iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches. iked en OpenIKED, como es usado en OpenBSD versiones hasta 6.7, permite omitir una autenticación porque el archivo ca.c presenta una lógica equivocada para comprobar si una clave pública coincide • https://ftp.openbsd.org/pub/OpenBSD/patches/6.7/common/014_iked.patch.sig https://github.com/openbsd/src/commit/7afb2d41c6d373cf965285840b85c45011357115 https://github.com/xcllnt/openiked/commits/master https://www.openiked.org/security.html • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 5CVE-2019-19726 – OpenBSD 6.x - Dynamic Loader Privilege Escalation
https://notcve.org/view.php?id=CVE-2019-19726
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), _dl_setup_env in ld.so tries to strip LD_LIBRARY_PATH from the environment, but fails when it cannot allocate memory. Thus, the attacker is able to execute their own library code as root. OpenBSD versiones hasta 6.6, permite a usuarios locales escalar a root porque una comprobación de LD_LIBRARY_PATH en los programas setuid puede ser vencida estableciendo un límite de recursos de RLIMIT_DATA muy pequeño. Al ejecutar chpass o passwd (que son root de setuid), en la función _dl_setup_env en el archivo ld.so intenta eliminar LD_LIBRARY_PATH del entorno, pero presenta un fallo cuando no puede asignar memoria. • https://www.exploit-db.com/exploits/47780 https://www.exploit-db.com/exploits/47803 http://packetstormsecurity.com/files/155658/Qualys-Security-Advisory-OpenBSD-Dynamic-Loader-Privilege-Escalation.html http://packetstormsecurity.com/files/155764/OpenBSD-Dynamic-Loader-chpass-Privilege-Escalation.html http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html http://seclists.org/fulldisclosure/2019/Dec/31 http://seclists.org/fulldisclosure/2023/Oct/11 http://www.openwall.com/lists/ • CWE-269: Improper Privilege Management •