CVSS: 7.8EPSS: 38%CPEs: 1EXPL: 5CVE-2017-1084 – FreeBSD - 'FGPE' Stack Clash (PoC)
https://notcve.org/view.php?id=CVE-2017-1084
29 Jun 2017 — In FreeBSD before 11.2-RELEASE, multiple issues with the implementation of the stack guard-page reduce the protections afforded by the guard-page. This results in the possibility a poorly written process could be cause a stack overflow. En FreeBSD en versiones anteriores a la 11.2-RELEASE, múltiples problemas con la implementación de la página guard de la pila reducen las protecciones de la página guard. Esto resulta en la posibilidad de que un proceso mal escrito provoque un desbordamiento de pila. • https://packetstorm.news/files/id/143199 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 3CVE-2017-1085 – FreeBSD - 'setrlimit' Stack Clash (PoC)
https://notcve.org/view.php?id=CVE-2017-1085
29 Jun 2017 — In FreeBSD before 11.2-RELEASE, an application which calls setrlimit() to increase RLIMIT_STACK may turn a read-only memory region below the stack into a read-write region. A specially crafted executable could be exploited to execute arbitrary code in the user context. En FreeBSD en versiones anteriores a la 11.2-RELEASE, una aplicación que llama a setrlimit() para incrementar RLIMIT_STACK podría hacer que una región de memoria de solo lectura bajo la pila pase a ser una región de lectura y escritura. Un ej... • https://packetstorm.news/files/id/143197 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2017-1082 – Qualys Security Advisory - the Stack Clash
https://notcve.org/view.php?id=CVE-2017-1082
20 Jun 2017 — In FreeBSD 11.x before 11.1-RELEASE and 10.x before 10.4-RELEASE, the qsort algorithm has a deterministic recursion pattern. Feeding a pathological input to the algorithm can lead to excessive stack usage and potential overflow. Applications that use qsort to handle large data set may crash if the input follows the pathological pattern. En FreeBSD en versiones 11.x anteriores a la 11.1-RELEASE y versiones 10.x anteriores a la 10.4-RELEASE, el algoritmo qsort tiene un patrón determinístico de recursión. Si s... • https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-1083 – Qualys Security Advisory - the Stack Clash
https://notcve.org/view.php?id=CVE-2017-1083
20 Jun 2017 — In FreeBSD before 11.2-RELEASE, a stack guard-page is available but is disabled by default. This results in the possibility a poorly written process could be cause a stack overflow. En FreeBSD en versiones anteriores a la 11.2-RELEASE, una página guard de pila está disponible, pero está deshabilitada por defecto. Esto resulta en la posibilidad de que un proceso mal escrito provoque un desbordamiento de pila Qualys has released a large amount of research surrounding the use of stack clash vulnerabilities and... • https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 3%CPEs: 4EXPL: 0CVE-2017-1081 – FreeBSD Security Advisory - FreeBSD-SA-17:04.ipfilter
https://notcve.org/view.php?id=CVE-2017-1081
27 Apr 2017 — In FreeBSD before 11.0-STABLE, 11.0-RELEASE-p10, 10.3-STABLE, and 10.3-RELEASE-p19, ipfilter using "keep state" or "keep frags" options can cause a kernel panic when fed specially crafted packet fragments due to incorrect memory handling. En FreeBSD, en versiones anteriores a la 11.0-STABLE, 11.0-RELEASE-p10, 10.3-STABLE y 10.3-RELEASE-p19, cuando ipfilter emplea las opciones "keep state" o "keep frags", puede provocar un pánico del kernel cuando se le alimentan fragmentos de paquetes manipulados debido a l... • http://www.securityfocus.com/bid/98089 • CWE-20: Improper Input Validation CWE-416: Use After Free •
CVSS: 5.9EPSS: 1%CPEs: 6EXPL: 1CVE-2016-9042 – Apple Security Advisory 2017-10-31-8
https://notcve.org/view.php?id=CVE-2016-9042
12 Apr 2017 — An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition. Existe una vulnerabilidad explotable de denegación de servicio (DoS) en la funcionalidad de comprobación de marca de ... • http://packetstormsecurity.com/files/142101/FreeBSD-Security-Advisory-FreeBSD-SA-17-03.ntp.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2016-1888
https://notcve.org/view.php?id=CVE-2016-1888
15 Feb 2017 — The telnetd service in FreeBSD 9.3, 10.1, 10.2, 10.3, and 11.0 allows remote attackers to inject arguments to login and bypass authentication via vectors involving a "sequence of memory allocation failures." El servicio telnetd en FreeBSD 9.3, 10.1, 10.2, 10.3 y 11.0 permite a atacantes remotos inyectar argumentos para iniciar sesión y eludir la autenticación a través de vectores que implican una "secuencia de fallos de asignación de memoria". • http://www.securitytracker.com/id/1037399 • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2016-1889
https://notcve.org/view.php?id=CVE-2016-1889
15 Feb 2017 — Integer overflow in the bhyve hypervisor in FreeBSD 10.1, 10.2, 10.3, and 11.0 when configured with a large amount of guest memory, allows local users to gain privilege via a crafted device descriptor. Desbordamiento de entero en el bhyve hypervisor en FreeBSD 10.1, 10.2, 10.3 y 11.0 cuando se configura con una gran cantidad de memoria huésped, permite a usuarios locales obtener privilegios a través del descriptor de un dispositivo manipulado. • http://www.securitytracker.com/id/1037400 • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 16%CPEs: 62EXPL: 2CVE-2016-5766 – gd: Integer overflow in _gd2GetHeader() resulting in heap overflow
https://notcve.org/view.php?id=CVE-2016-5766
26 Jun 2016 — Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image. Desbordamiento de entero en la función _gd2GetHeader en gd_gd2.c en la GD Graphics Library (también conocido como libgd) en versiones anter... • http://github.com/php/php-src/commit/7722455726bec8c53458a32851d2a87982cf0eac?w=1 • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 2CVE-2016-1886 – FreeBSD Kernel (FreeBSD 10.2 < 10.3 x64) - 'SETFKEY' (PoC)
https://notcve.org/view.php?id=CVE-2016-1886
18 May 2016 — Integer signedness error in the genkbd_commonioctl function in sys/dev/kbd/kbd.c in FreeBSD 9.3 before p42, 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory overwrite and kernel crash), or gain privileges via a negative value in the flen structure member in the arg argument in a SETFKEY ioctl call, which triggers a "two way heap and stack overflow." Error de entero sin signo en la función genkbd_comm... • https://www.exploit-db.com/exploits/44211 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •