CVSS: 10.0EPSS: 8%CPEs: 16EXPL: 0CVE-2014-3954 – FreeBSD Security Advisory - rtsold(8) Remote Buffer Overflow
https://notcve.org/view.php?id=CVE-2014-3954
22 Oct 2014 — Stack-based buffer overflow in rtsold in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted DNS parameters in a router advertisement message. Desbordamiento de buffer basado en pila en rtsold en FreeBSD 9.1 hasta 10.1-RC2 permite a atacantes remotos causar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de parámetros DNS manipulados en un mensaje de anuncio de router. Due to a missing ... • http://www.securitytracker.com/id/1031098 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 21EXPL: 0CVE-2014-3955 – FreeBSD Security Advisory - routed(8) Remote Denial of Service
https://notcve.org/view.php?id=CVE-2014-3955
22 Oct 2014 — routed in FreeBSD 8.4 through 10.1-RC2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RIP request from a source not on a directly connected network. routed en FreeBSD 8.4 hasta 10.1-RC2 permite a atacantes remotos causar una denegación de servicio (fallo de aserción y salida de demonio) a través de una solicitud RIP de una fuente que no está en una red conectada directamente. The input path in routed(8) will accept queries from any source and attempt to answe... • http://secunia.com/advisories/61865 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-5384
https://notcve.org/view.php?id=CVE-2014-5384
21 Aug 2014 — The VIQR module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (out-of-bounds array access) via a crafted argument to the iconv_open function. NOTE: this issue was SPLIT from CVE-2014-3951 per ADT2 due to different vulnerability types. El módulo VIQR en la implementación iconv en FreeBSD 10.0 anterior a p6 y NetBSD permite a atacantes dependientes de contexto causar una denegación de servicio (acceso a array fuera de rango) a ... • http://mail-index.netbsd.org/source-changes/2014/06/24/msg055822.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2014-3952 – Debian Security Advisory 3070-1
https://notcve.org/view.php?id=CVE-2014-3952
09 Jul 2014 — FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize the buffer between the header and data of a control message, which allows local users to obtain sensitive information from kernel memory via unspecified vectors. FreeBSD 8.4 anterior a p14, 9.1 anterior a p17, 9.2 anterior a p10 y 10.0 anterior a p7 no inicializa debidamente el buffer entre la cabecera y los datos de un mensaje de control, lo que permite a usuarios locales obtener información sensible de ... • http://secunia.com/advisories/62218 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2014-3953 – Debian Security Advisory 3070-1
https://notcve.org/view.php?id=CVE-2014-3953
09 Jul 2014 — FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via a (1) SCTP_SNDRCV, (2) SCTP_EXTRCV, or (3) SCTP_RCVINFO SCTP cmsg or a (4) SCTP_PEER_ADDR_CHANGE, (5) SCTP_REMOTE_ERROR, or (6) SCTP_AUTHENTICATION_EVENT notification. FreeBSD 8.4 anterior a p14, 9.1 anterior a p17, 9.2 anterior a p10 y 10.0 anterior a p7 no inicializa debidamente ciertas estructuras d... • http://secunia.com/advisories/62218 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-3951 – FreeBSD Security Advisory - iconv NULL Pointer Dereference
https://notcve.org/view.php?id=CVE-2014-3951
25 Jun 2014 — The HZ module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted argument to the iconv_open function. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2014-5384 is used for the NULL pointer dereference. El módulo HZ en la implementación iconv en FreeBSD 10.0 anterior a p6 y NetBSD permite a atacantes dependientes de contexto causar una denegación de servicio (re... • http://mail-index.netbsd.org/source-changes/2014/06/24/msg055822.html •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2014-3880 – Debian Security Advisory 2952-1
https://notcve.org/view.php?id=CVE-2014-3880
06 Jun 2014 — The (1) execve and (2) fexecve system calls in the FreeBSD kernel 8.4 before p11, 9.1 before p14, 9.2 before p7, and 10.0 before p4 destroys the virtual memory address space and mappings for a process before all threads have terminated, which allows local users to cause a denial of service (triple-fault and system reboot) via a crafted system call, which triggers an invalid page table pointer dereference. Las llamadas de sistema (1) execve y (2) fexecve en el kernel de FreeBSD 8.4 anterior a p11, 9.1 anteri... • http://secunia.com/advisories/59034 • CWE-20: Improper Input Validation •
CVSS: 1.9EPSS: 0%CPEs: 56EXPL: 0CVE-2014-3956 – Gentoo Linux Security Advisory 201412-32
https://notcve.org/view.php?id=CVE-2014-3956
04 Jun 2014 — The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program. La función sm_close_on_exec en conf.c en sendmail anterior a 8.14.9 tiene argumentos en el orden erróneo, y como consecuencia evade configurar etiquetas FD_CLOEXEC esperadas, lo que permite a usuarios locales acceder a descriptores de archiv... • ftp://ftp.sendmail.org/pub/sendmail/RELEASE_NOTES • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2014-3873 – FreeBSD Security Advisory - ktrace Kernel Memory Disclosure
https://notcve.org/view.php?id=CVE-2014-3873
04 Jun 2014 — The ktrace utility in the FreeBSD kernel 8.4 before p11, 9.1 before p14, 9.2 before p7, and 9.3-BETA1 before p1 uses an incorrect page fault kernel trace entry size, which allows local users to obtain sensitive information from kernel memory via a kernel process trace. La utilidad ktrace en el kernel de FreeBSD 8.4 anterior a p11, 9.1 anterior a p14, 9.2 anterior a p7 y 9.3-BETA1 anterior a p1 utiliza un tamaño incorrecto de la entrada de la traza del error de página del kernel, lo que permite a usuarios lo... • http://secunia.com/advisories/58627 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2014-3879 – FreeBSD Security Advisory - PAM Policy Parser
https://notcve.org/view.php?id=CVE-2014-3879
04 Jun 2014 — OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes the loaded policy chain to no be discarded and allows context-dependent attackers to bypass authentication via a login (1) without a password or (2) with an incorrect password. OpenPAM Nummularia versiones 9.2 hasta 10.0, maneja inapropiadamente un error reportado cuando una directiva de inclusión hace referencia a una política que no existe, lo que c... • http://www.freebsd.org/security/advisories/FreeBSD-SA-14:13.pam.asc • CWE-287: Improper Authentication •