Vulnerabilities (CVE)

Filtered by vendor Freebsd Subscribe
Total 505 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-36159 1 Freebsd 1 Libfetch 2021-10-18 6.4 MEDIUM 9.1 CRITICAL
libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\0' terminator one byte too late.
CVE-2021-29630 1 Freebsd 1 Freebsd 2021-09-23 7.6 HIGH 8.1 HIGH
In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, the ggatec daemon does not validate the size of a response before writing it to a fixed-sized buffer allowing a malicious attacker in a privileged network position to overwrite the stack of ggatec and potentially execute arbitrary code.
CVE-2021-29631 1 Freebsd 1 Freebsd 2021-09-23 7.2 HIGH 7.8 HIGH
In FreeBSD 13.0-STABLE before n246941-20f96f215562, 12.2-STABLE before r370400, 11.4-STABLE before r370399, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, certain VirtIO-based device models in bhyve failed to handle errors when fetching I/O descriptors. A malicious guest may cause the device model to operate on uninitialized I/O vectors leading to memory corruption, crashing of the bhyve process, and possibly arbitrary code execution in the bhyve process.
CVE-2021-3449 11 Checkpoint, Debian, Fedoraproject and 8 more 159 Multi-domain Management, Multi-domain Management Firmware, Quantum Security Gateway and 156 more 2021-09-21 4.3 MEDIUM 5.9 MEDIUM
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
CVE-2020-7461 2 Freebsd, Siemens 5 Freebsd, Simatic Rf350m, Simatic Rf350m Firmware and 2 more 2021-09-16 7.5 HIGH 7.3 HIGH
In FreeBSD 12.1-STABLE before r365010, 11.4-STABLE before r365011, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, dhclient(8) fails to handle certain malformed input related to handling of DHCP option 119 resulting a heap overflow. The heap overflow could in principle be exploited to achieve remote code execution. The affected process runs with reduced privileges in a Capsicum sandbox, limiting the immediate impact of an exploit.
CVE-2019-12900 5 Bzip, Canonical, Debian and 2 more 5 Bzip2, Ubuntu Linux, Debian Linux and 2 more 2021-09-14 7.5 HIGH 9.8 CRITICAL
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
CVE-2002-2199 1 Freebsd 1 Advanced Intrusion Detection Environment 2021-08-27 4.6 MEDIUM N/A
The default aide.conf file in Advanced Intrusion Detection Environment (AIDE) before 0.7_1 on FreeBSD before 2002-08-28 does not properly check subdirectories, which could allow local users to bypass detection.
CVE-2020-7463 2 Apple, Freebsd 7 Icloud, Ipad Os, Iphone Os and 4 more 2021-07-22 4.9 MEDIUM 5.5 MEDIUM
In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, improper handling in the kernel causes a use-after-free bug by sending large user messages from multiple threads on the same SCTP socket. The use-after-free situation may result in unintended kernel behaviour including a kernel panic.
CVE-2020-10565 1 Freebsd 1 Freebsd 2021-07-21 7.2 HIGH 7.8 HIGH
grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, does not validate the address provided as part of a memrw command (read_* or write_*) by a guest through a grub2.cfg file. This allows an untrusted guest to perform arbitrary read or write operations in the context of the grub-bhyve process, resulting in code execution as root on the host OS.
CVE-2019-5595 1 Freebsd 1 Freebsd 2021-07-21 2.1 LOW 5.5 MEDIUM
In FreeBSD before 11.2-STABLE(r343782), 11.2-RELEASE-p9, 12.0-STABLE(r343781), and 12.0-RELEASE-p3, kernel callee-save registers are not properly sanitized before return from system calls, potentially allowing some kernel data used in the system call to be exposed.
CVE-2020-24718 3 Freebsd, Omniosce, Openindiana 3 Freebsd, Omnios, Openindiana 2021-07-21 7.2 HIGH 8.2 HIGH
bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying VMCS_HOST_RIP.
CVE-2020-7454 1 Freebsd 1 Freebsd 2021-07-21 7.5 HIGH 9.8 CRITICAL
In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, libalias does not properly validate packet length resulting in modules causing an out of bounds read/write condition if no checking was built into the module.
CVE-2020-24716 2 Freebsd, Openzfs 2 Freebsd, Openzfs 2021-07-21 4.6 MEDIUM 7.8 HIGH
OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories.
CVE-2019-15876 1 Freebsd 1 Freebsd 2021-07-21 2.1 LOW 5.5 MEDIUM
In FreeBSD 12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, and 11.3-RELEASE before 11.3-RELEASE-p7, driver specific ioctl command handlers in the oce network driver failed to check whether the caller has sufficient privileges allowing unprivileged users to send passthrough commands to the device firmware.
CVE-2020-7457 1 Freebsd 1 Freebsd 2021-07-21 6.8 MEDIUM 8.1 HIGH
In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory after being freed, possibly resulting in code execution.
CVE-2020-7451 1 Freebsd 1 Freebsd 2021-07-21 5.0 MEDIUM 5.3 MEDIUM
In FreeBSD 12.1-STABLE before r358739, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r358740, and 11.3-RELEASE before 11.3-RELEASE-p7, a TCP SYN-ACK or challenge TCP-ACK segment over IPv6 that is transmitted or retransmitted does not properly initialize the Traffic Class field disclosing one byte of kernel memory over the network.
CVE-2019-15880 1 Freebsd 1 Freebsd 2021-07-21 7.5 HIGH 9.8 CRITICAL
In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kernel buffer based on a user-supplied length allowing an unprivileged process to trigger a kernel panic.
CVE-2019-15877 1 Freebsd 1 Freebsd 2021-07-21 2.1 LOW 5.5 MEDIUM
In FreeBSD 12.1-STABLE before r356606 and 12.1-RELEASE before 12.1-RELEASE-p3, driver specific ioctl command handlers in the ixl network driver failed to check whether the caller has sufficient privileges allowing unprivileged users to trigger updates to the device's non-volatile memory.
CVE-2019-5614 1 Freebsd 1 Freebsd 2021-07-21 7.5 HIGH 9.8 CRITICAL
In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete packet data validation may result in accessing out-of-bounds memory leading to a kernel panic or other unpredictable results.
CVE-2019-15874 1 Freebsd 1 Freebsd 2021-07-21 7.5 HIGH 9.8 CRITICAL
In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete packet data validation may result in memory access after it has been freed leading to a kernel panic or other unpredictable results.