CVSS: 7.5EPSS: 0%CPEs: 23EXPL: 0CVE-2023-6534 – TCP spoofing vulnerability in pf(4)
https://notcve.org/view.php?id=CVE-2023-6534
In versions of FreeBSD 14.0-RELEASE before 14-RELEASE-p2, FreeBSD 13.2-RELEASE before 13.2-RELEASE-p7 and FreeBSD 12.4-RELEASE before 12.4-RELEASE-p9, the pf(4) packet filter incorrectly validates TCP sequence numbers. This could allow a malicious actor to execute a denial-of-service attack against hosts behind the firewall. En las versiones de FreeBSD 14.0-RELEASE anteriores a 14-RELEASE-p2, FreeBSD 13.2-RELEASE anteriores a 13.2-RELEASE-p7 y FreeBSD 12.4-RELEASE anteriores a 12.4-RELEASE-p9, el filtro de paquetes pf(4) valida incorrectamente los números de secuencia TCP. Esto podría permitir que un actor malintencionado ejecute un ataque de denegación de servicio contra hosts detrás del firewall. • https://security.freebsd.org/advisories/FreeBSD-SA-23:17.pf.asc https://security.netapp.com/advisory/ntap-20240112-0007 •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-5978 – Incorrect libcap_net limitation list manipulation
https://notcve.org/view.php?id=CVE-2023-5978
In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates that updated constraints are strictly subsets of the active constraints. When only a list of resolvable domain names was specified without setting any other limitations, an application could submit a new list of domains including include entries not previously listed. This could permit the application to resolve domain names that were previously restricted. En las versiones 13-RELEASE anteriores a 13-RELEASE-p5 de FreeBSD, bajo ciertas circunstancias el servicio cap_net libcasper(3) valida incorrectamente que las restricciones actualizadas son estrictamente subconjuntos de las restricciones activas. Cuando solo se especificaba una lista de nombres de dominio resolubles sin establecer otras limitaciones, una aplicación podía enviar una nueva lista de dominios que incluyeran entradas que no figuraban anteriormente. • https://security.freebsd.org/advisories/FreeBSD-SA-23:16.cap_net.asc https://security.netapp.com/advisory/ntap-20231214-0003 • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 0%CPEs: 16EXPL: 0CVE-2023-5941 – libc stdio buffer overflow
https://notcve.org/view.php?id=CVE-2023-5941
In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function in libc does not correctly update FILE objects' write space members for write-buffered streams when the write(2) system call returns an error. Depending on the nature of an application that calls libc's stdio functions and the presence of errors returned from the write(2) system call (or an overridden stdio write routine) a heap buffer overflow may occur. Such overflows may lead to data corruption or the execution of arbitrary code at the privilege level of the calling program. En las versiones 12.4-RELEASE anteriores a 12.4-RELEASE-p7 y 13.2-RELEASE anteriores a 13.2-RELEASE-p5 de FreeBSD, la función stdio __sflush() en libc no actualiza correctamente los miembros del espacio de escritura de los objetos FILE para secuencias con búfer de escritura cuando la llamada al sistema write(2) devuelve un error. Dependiendo de la naturaleza de una aplicación que llama a las funciones stdio de libc y la presencia de errores devueltos por la llamada al sistema write(2) (o una rutina de escritura stdio anulada), puede ocurrir un desbordamiento del buffer del heap. • https://security.freebsd.org/advisories/FreeBSD-SA-23:15.stdio.asc https://security.netapp.com/advisory/ntap-20231214-0004 • CWE-131: Incorrect Calculation of Buffer Size CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 0CVE-2023-5368 – msdosfs data disclosure
https://notcve.org/view.php?id=CVE-2023-5368
On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated data from the underlying disk device, rather than zero bytes. This may permit a user with write access to files on a msdosfs filesystem to read unintended data (e.g. from a previously deleted file). En un sistema de archivos msdosfs, las llamadas al sistema 'truncate' o 'ftruncate' bajo ciertas circunstancias llenan el espacio adicional en el archivo con datos no asignados del dispositivo de disco subyacente, en lugar de cero bytes. Esto puede permitir que un usuario con acceso de escritura a archivos en un sistema de archivos msdosfs lea datos no deseados (por ejemplo, de un archivo previamente eliminado). • https://dfir.ru/2023/11/01/bringing-unallocated-data-back-the-fat12-16-32-case https://security.FreeBSD.org/advisories/FreeBSD-SA-23:12.msdosfs.asc https://security.netapp.com/advisory/ntap-20231124-0004 • CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2023-4809 – pf incorrectly handles multiple IPv6 fragment headers
https://notcve.org/view.php?id=CVE-2023-4809
In pf packet processing with a 'scrub fragment reassemble' rule, a packet containing multiple IPv6 fragment headers would be reassembled, and then immediately processed. That is, a packet with multiple fragment extension headers would not be recognized as the correct ultimate payload. Instead a packet with multiple IPv6 fragment headers would unexpectedly be interpreted as a fragmented packet, rather than as whatever the real payload is. As a result, IPv6 fragments may bypass pf firewall rules written on the assumption all fragments have been reassembled and, as a result, be forwarded or processed by the host. En el procesamiento de paquetes pf con una regla 'scrub fragment reassemble', un paquete que contenga múltiples encabezados de fragmentos IPv6 se reensamblaría y luego se procesaría inmediatamente. Es decir, un paquete con múltiples encabezados de extensión de fragmentos no sería reconocido como el payload final correcto. • http://www.openwall.com/lists/oss-security/2023/09/08/5 http://www.openwall.com/lists/oss-security/2023/09/08/6 http://www.openwall.com/lists/oss-security/2023/09/08/7 https://security.FreeBSD.org/advisories/FreeBSD-SA-23:10.pf.asc https://security.netapp.com/advisory/ntap-20231221-0009 • CWE-167: Improper Handling of Additional Special Element •