CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23087 – Bhyve e82545 device emulation out-of-bounds write
https://notcve.org/view.php?id=CVE-2022-23087
06 Apr 2022 — The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP checksums, insertion of an Ethernet VLAN header, and TCP segmentation offload ("TSO"). The e1000 device model uses an on-stack buffer to generate the modified packet header when simulating these modifications on transmitted packets. When checksum offload is requested for a transmitted packet, the e1000 device model used a guest-provided value to specify t... • https://security.freebsd.org/advisories/FreeBSD-SA-22:05.bhyve.asc • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 8%CPEs: 1EXPL: 0CVE-2022-23088 – 802.11 heap buffer overflow
https://notcve.org/view.php?id=CVE-2022-23088
06 Apr 2022 — The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. While a FreeBSD Wi-Fi client is in scanning mode (i.e., not associated with a SSID) a malicious beacon frame may overwrite kernel memory, leading to remote code execution. La rutina de manejo de balizas 802.11 no pudo validar la longitud de un ID de malla IEEE 802.11 antes de copiarlo en un búfer asignado en montón. Mientras un cliente Wi-Fi de FreeBSD está en modo de esc... • https://security.freebsd.org/advisories/FreeBSD-SA-22:07.wifi_meshid.asc • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 0CVE-2021-29632 – FreeBSD Security Advisory - FreeBSD-SA-22:01.vt
https://notcve.org/view.php?id=CVE-2021-29632
11 Jan 2022 — In FreeBSD 13.0-STABLE before n247428-9352de39c3dc, 12.2-STABLE before r370674, 13.0-RELEASE before p6, and 12.2-RELEASE before p12, certain conditions involving use of the highlight buffer while text is scrolling on the console, console data may overwrite data structures associated with the system console or other kernel memory. En FreeBSD versión 13.0-STABLE anteriores a n247428-9352de39c3dc, 12.2-STABLE anteriores a r370674, 13.0-RELEASE anteriores a p6 y 12.2-RELEASE anteriores a p12, en determinadas co... • https://security.freebsd.org/advisories/FreeBSD-SA-22:01.vt.asc •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2011-1075
https://notcve.org/view.php?id=CVE-2011-1075
19 Oct 2021 — FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In particular, it uses the MD5File() function, which takes a pathname as an argument, and is called with euid 0. A race condition in this process may lead to an arbitrary MD5 comparison regardless of the read permissions. El crontab de FreeBSD calcula la suma MD5 del cronjob anterior y del nuevo para determinar si se han realizado cambios antes de copiar la n... • https://marc.info/?l=full-disclosure&m=129891323028897&w=2 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.1EPSS: 1%CPEs: 29EXPL: 0CVE-2021-29630 – FreeBSD Security Advisory - FreeBSD-SA-21:14.ggatec
https://notcve.org/view.php?id=CVE-2021-29630
24 Aug 2021 — In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, the ggatec daemon does not validate the size of a response before writing it to a fixed-sized buffer allowing a malicious attacker in a privileged network position to overwrite the stack of ggatec and potentially execute arbitrary code. En FreeBSD versiones 13.0-STABLE anteriores a n246938-0729ba2f49c9, 12.2-STABLE anteriore... • https://security.FreeBSD.org/advisories/FreeBSD-SA-21:14.ggatec.asc • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 29EXPL: 0CVE-2021-29631 – FreeBSD Security Advisory - FreeBSD-SA-21:13.bhyve
https://notcve.org/view.php?id=CVE-2021-29631
24 Aug 2021 — In FreeBSD 13.0-STABLE before n246941-20f96f215562, 12.2-STABLE before r370400, 11.4-STABLE before r370399, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, certain VirtIO-based device models in bhyve failed to handle errors when fetching I/O descriptors. A malicious guest may cause the device model to operate on uninitialized I/O vectors leading to memory corruption, crashing of the bhyve process, and possibly arbitrary code execution in the bhyve process. En FreeBSD versiones ... • https://security.FreeBSD.org/advisories/FreeBSD-SA-21:13.bhyve.asc • CWE-908: Use of Uninitialized Resource •
CVSS: 9.1EPSS: 1%CPEs: 1EXPL: 1CVE-2021-36159 – FreeBSD Security Advisory - FreeBSD-SA-21:15.libfetch
https://notcve.org/view.php?id=CVE-2021-36159
03 Aug 2021 — libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\0' terminator one byte too late. libfetch versiones anteriores al 26-07-2021, como se usa en apk-tools, xbps, y otros productos, maneja ina... • https://github.com/freebsd/freebsd-src/commits/main/lib/libfetch • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 26EXPL: 0CVE-2021-29629 – FreeBSD Security Advisory - FreeBSD-SA-21:12.libradius
https://notcve.org/view.php?id=CVE-2021-29629
26 May 2021 — In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841, 12.2-STABLE before r369859, 11.4-STABLE before r369866, 13.0-RELEASE before p1, 12.2-RELEASE before p7, and 11.4-RELEASE before p10, missing message validation in libradius(3) could allow malicious clients or servers to trigger denial of service in vulnerable servers or clients respectively. En FreeBSD versiones 13.0-STABLE anteriores a n245765-bec0d2c9c841, versiones 12.2-STABLE anteriores a r369859, versiones 11.4-STABLE anteriores a r369866, versiones 1... • https://security.FreeBSD.org/advisories/FreeBSD-SA-21:12.libradius.asc • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 1CVE-2021-29628 – FreeBSD Security Advisory - FreeBSD-SA-21:11.smap
https://notcve.org/view.php?id=CVE-2021-29628
26 May 2021 — In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STABLE before r369857, 13.0-RELEASE before p1, and 12.2-RELEASE before p7, a system call triggering a fault could cause SMAP protections to be disabled for the duration of the system call. This weakness could be combined with other kernel bugs to craft an exploit. En FreeBSD versiones 13.0-STABLE anteriores a n245764-876ffe28796c, versiones 12.2-STABLE anteriores a r369857, versiones 13.0-RELEASE anteriores a p1 y versiones 12.2-RELEASE anteriores a p... • https://security.FreeBSD.org/advisories/FreeBSD-SA-21:11.smap.asc • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 23EXPL: 0CVE-2020-25584 – FreeBSD Security Advisory - FreeBSD-SA-21:10.jail_mount
https://notcve.org/view.php?id=CVE-2020-25584
06 Apr 2021 — In FreeBSD 13.0-STABLE before n245118, 12.2-STABLE before r369552, 11.4-STABLE before r369560, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, a superuser inside a FreeBSD jail configured with the non-default allow.mount permission could cause a race condition between the lookup of ".." and remounting a filesystem, allowing access to filesystem hierarchy outside of the jail. En FreeBSD versiones 13.0-STABLE anteriores a n245118, versiones 12.2-STABLE anteriores a r369552, versiones 1... • https://security.FreeBSD.org/advisories/FreeBSD-SA-21:10.jail_mount.asc • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •