CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Freebsd : Security Vulnerabilities (CVSS score between 4 and 4.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2012-2143 310 2012-07-05 2013-04-18
4.3
 None Remote Medium Not required None Partial None
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
2 CVE-2011-1739 20 Bypass 2011-05-03 2011-05-31
4.3
 None Remote Medium Not required None Partial None
The makemask function in mountd.c in mountd in FreeBSD 7.4 through 8.2 does not properly handle a -network field specifying a CIDR block with a prefix length that is not an integer multiple of 8, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances via an NFS mount request.
3 CVE-2011-0419 399 DoS 2011-05-16 2012-10-29
4.3
 None Remote Medium Not required None None Partial
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
4 CVE-2010-4755 399 DoS 2011-03-02 2011-09-21
4.0
 None Remote Low Single system None None Partial
The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632.
5 CVE-2010-4754 399 DoS 2011-03-02 2011-09-21
4.0
 None Remote Low Single system None None Partial
The glob implementation in libc in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, and OpenBSD 4.7, and Libsystem in Apple Mac OS X before 10.6.8, allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.
6 CVE-2010-2530 189 DoS 2010-09-29 2010-09-30
4.9
 None Local Low Not required None None Complete
Multiple integer signedness errors in smb_subr.c in the netsmb module in the kernel in NetBSD 5.0.2 and earlier, FreeBSD, and Apple Mac OS X allow local users to cause a denial of service (panic) via a negative size value in a /dev/nsmb ioctl operation, as demonstrated by a (1) SMBIOC_LOOKUP or (2) SMBIOC_OPENSESSION ioctl call.
7 CVE-2009-4358 264 2009-12-19 2009-12-21
4.7
 None Local Medium Not required Complete None None
freebsd-update in FreeBSD 8.0, 7.2, 7.1, 6.4, and 6.3 uses insecure permissions in its working directory (/var/db/freebsd-update by default), which allows local users to read copies of sensitive files after a (1) freebsd-update fetch (fetch) or (2) freebsd-update upgrade (upgrade) operation.
8 CVE-2009-2649 264 DoS 2009-07-30 2009-08-12
4.7
 None Local Medium Not required None None Complete
The IATA (ata) driver in FreeBSD 6.0 and 8.0, when read access to /dev is available, allows local users to cause a denial of service (kernel panic) via a certain IOCTL request with a large count, which triggers a malloc call with a large value.
9 CVE-2009-1935 189 Overflow Bypass 2009-06-18 2009-07-01
4.9
 None Local Low Not required Complete None None
Integer overflow in the pipe_build_write_buffer function (sys/kern/sys_pipe.c) in the direct write optimization feature in the pipe implementation in FreeBSD 7.1 through 7.2 and 6.3 through 6.4 allows local users to bypass virtual-to-physical address lookups and read sensitive information in memory pages via unspecified vectors.
10 CVE-2009-1436 20 +Info 2009-04-27 2009-06-15
4.9
 None Local Low Not required Complete None None
The db interface in libc in FreeBSD 6.3, 6.4, 7.0, 7.1, and 7.2-PRERELEASE does not properly initialize memory for Berkeley DB 1.85 database structures, which allows local users to obtain sensitive information by reading a database file.
11 CVE-2008-1215 264 Overflow +Priv 2008-03-08 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "~" characters.
12 CVE-2008-0777 264 2008-02-14 2008-09-05
4.9
 None Local Low Not required Complete None None
The sendfile system call in FreeBSD 5.5 through 7.0 does not check the access flags of the file descriptor used for sending a file, which allows local users to read the contents of write-only files.
13 CVE-2007-3645 DoS 2007-07-15 2012-10-29
4.3
 None Remote Medium Not required None None Partial
archive_read_support_format_tar.c in libarchive before 2.2.4 allows user-assisted remote attackers to cause a denial of service (crash) via (1) an end-of-file condition within a tar header that follows a pax extension header or (2) a malformed pax extension header in an (a) PAX or a (b) TAR archive, which results in a NULL pointer dereference, a different issue than CVE-2007-3644.
14 CVE-2007-3644 DoS 2007-07-13 2012-10-29
4.3
 None Remote Medium Not required None None Partial
archive_read_support_format_tar.c in libarchive before 2.2.4 allows user-assisted remote attackers to cause a denial of service (infinite loop) via (1) an end-of-file condition within a pax extension header or (2) a malformed pax extension header in an (a) PAX or a (b) TAR archive.
15 CVE-2006-6397 Overflow 2006-12-07 2008-09-05
4.4
 User Local Medium Not required Partial Partial Partial
** DISPUTED ** Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal operations. This issue is not a vulnerability.
16 CVE-2006-5824 DoS Overflow 2006-11-09 2008-09-05
4.9
 None Local Low Not required None None Complete
Integer overflow in the ffs_rdextattr function in FreeBSD 6.1 allows local users to cause a denial of service (kernel panic) and trigger a heap-based buffer overflow via a crafted UFS filesystem, a different vulnerability than CVE-2006-5679. NOTE: a third party states that this issue does not cross privilege boundaries in FreeBSD because only root may mount a filesystem.
17 CVE-2006-5679 189 DoS Exec Code Overflow 2006-11-03 2011-10-11
4.6
 None Local Low Not required Partial Partial Partial
Integer overflow in the ffs_mountfs function in FreeBSD 6.1 allows local users to cause a denial of service (panic) and possibly execute arbitrary code via a crafted UFS filesystem that causes invalid or large size parameters to be provided to the kmem_alloc function. NOTE: a third party states that this issue does not cross privilege boundaries in FreeBSD because only root may mount a filesystem.
18 CVE-2006-5550 DoS 2006-10-26 2008-09-05
4.9
 None Local Low Not required None None Complete
The kernel in FreeBSD 6.1 and OpenBSD 4.0 allows local users to cause a denial of service via unspecified vectors involving certain ioctl requests to /dev/crypto.
19 CVE-2006-4516 DoS Mem. Corr. 2006-10-11 2008-09-05
4.9
 None Local Low Not required None None Complete
Integer signedness error in FreeBSD 6.0-RELEASE allows local users to cause a denial of service (memory corruption and kernel panic) via a PT_LWPINFO ptrace command with a large negative data value that satisfies a signed maximum value check but is used in an unsigned copyout function call.
20 CVE-2006-4178 DoS 2006-09-25 2008-09-05
4.9
 None Local Low Not required None None Complete
Integer signedness error in the i386_set_ldt call in FreeBSD 5.5, and possibly earlier versions down to 5.2, allows local users to cause a denial of service (crash) via unspecified arguments that use negative signed integers to cause the bzero function to be called with a large length parameter, a different vulnerability than CVE-2006-4172.
21 CVE-2005-4351 Bypass 2005-12-31 2008-09-05
4.3
 None Local Low Single system Partial Partial Partial
The securelevels implementation in FreeBSD 7.0 and earlier, OpenBSD up to 3.8, DragonFly up to 1.2, and Linux up to 2.6.15 allows root users to bypass immutable settings for files by mounting another filesystem that masks the immutable files while the system is running.
22 CVE-2005-1406 2005-05-06 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
The kernel in FreeBSD 4.x to 4.11 and 5.x to 5.4 does not properly clear certain fixed-length buffers when copying variable-length data for use by applications, which could allow those applications to read previously used sensitive memory.
23 CVE-2005-1400 2005-05-06 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
The i386_get_ldt system call in FreeBSD 4.7 to 4.11 and 5.x to 5.4 allows local users to access sensitive kernel memory via arguments with negative or very large values.
24 CVE-2005-1399 2005-05-06 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
FreeBSD 4.6 to 4.11 and 5.x to 5.4 uses insecure default permissions for the /dev/iir device, which allows local users to execute restricted ioctl calls to read or modify data on hardware that is controlled by the iir driver.
25 CVE-2004-0919 2004-12-31 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
The syscons CONS_SCRSHOT ioctl in FreeBSD 5.x allows local users to read arbitrary kernel memory via (1) negative coordinates or (2) large coordinates.
26 CVE-2004-0126 +Priv 2004-03-29 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
The jail_attach system call in FreeBSD 5.1 and 5.2 changes the directory of a calling process even if the process doesn't have permission to change directory, which allows local users to gain read/write privileges to files and directories within another jail.
27 CVE-2004-0114 +Priv 2004-03-03 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
The shmat system call in the System V Shared Memory interface for FreeBSD 5.2 and earlier, NetBSD 1.3 and earlier, and OpenBSD 2.6 and earlier, does not properly decrement a shared memory segment's reference count when the vm_map_find function fails, which could allow local users to gain read or write access to a portion of kernel memory and gain privileges.
28 CVE-2004-0099 Bypass 2004-03-03 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
mksnap_ffs in FreeBSD 5.1 and 5.2 only sets the snapshot flag when creating a snapshot for a file system, which causes default values for other flags to be used, possibly disabling security-critical settings and allowing a local user to bypass intended access restrictions.
29 CVE-2003-0914 2003-12-15 2008-09-10
4.3
 None Remote Medium Not required None Partial None
ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value.
30 CVE-2002-2199 Bypass 2002-12-31 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
The default aide.conf file in Advanced Intrusion Detection Environment (AIDE) before 0.7_1 on FreeBSD before 2002-08-28 does not properly check subdirectories, which could allow local users to bypass detection.
31 CVE-2002-0973 2002-09-24 2008-09-10
4.6
 User Local Low Not required Partial Partial Partial
Integer signedness error in several system calls for FreeBSD 4.6.1 RELEASE-p10 and earlier may allow attackers to access sensitive kernel memory via large negative values to the (1) accept, (2) getsockname, and (3) getpeername system calls, and the (4) vesa FBIO_GETPALETTE ioctl.
32 CVE-2002-0829 Overflow +Priv 2002-08-12 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
Integer overflow in the Berkeley Fast File System (FFS) in FreeBSD 4.6.1 RELEASE-p4 and earlier allows local users to access arbitrary file contents within FFS to gain privileges by creating a file that is larger than allowed by the virtual memory system.
33 CVE-2001-0230 Overflow +Priv 2001-06-02 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
Buffer overflow in dc20ctrl before 0.4_1 in FreeBSD, and possibly other operating systems, allows local users to gain privileges.
34 CVE-2000-0595 Exec Code 2000-07-05 2008-09-10
4.6
 User Local Low Not required Partial Partial Partial
libedit searches for the .editrc file in the current directory instead of the user's home directory, which may allow local users to execute arbitrary commands by installing a modified .editrc in another directory.
35 CVE-2000-0163 +Priv 2000-02-21 2008-09-10
4.6
 User Local Low Not required Partial Partial Partial
asmon and ascpu in FreeBSD allow local users to gain root privileges via a configuration file.
36 CVE-1999-1313 +Priv 1996-05-23 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
Manual page reader (man) in FreeBSD 2.2 and earlier allows local users to gain privileges via a sequence of commands.
37 CVE-1999-1187 +Priv 1996-08-26 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
Pine before version 3.94 allows local users to gain privileges via a symlink attack on a lockfile that is created when a user receives new mail.
38 CVE-1999-0863 Overflow 1999-11-08 2008-09-09
4.6
 User Local Low Not required Partial Partial Partial
Buffer overflow in FreeBSD seyon via HOME environmental variable, -emulator argument, -modems argument, or the GUI.
39 CVE-1999-0826 Overflow +Priv 1999-12-01 2008-09-09
4.6
 User Local Low Not required Partial Partial Partial
Buffer overflow in FreeBSD angband allows local users to gain privileges.
40 CVE-1999-0823 Overflow +Priv 1999-12-01 2008-09-09
4.6
 User Local Low Not required Partial Partial Partial
Buffer overflow in FreeBSD xmindpath allows local users to gain privileges via -f argument.
41 CVE-1999-0821 +Priv 1999-11-08 2008-09-09
4.6
 User Local Low Not required Partial Partial Partial
FreeBSD seyon allows local users to gain privileges by providing a malicious program in the -emulator argument.
42 CVE-1999-0820 +Priv 1999-12-01 2008-09-09
4.6
 None Local Low Not required Partial Partial Partial
FreeBSD seyon allows users to gain privileges via a modified PATH variable for finding the xterm and seyon-emu commands.
43 CVE-1999-0780 1998-11-18 2008-09-09
4.6
 User Local Low Not required Partial Partial Partial
KDE klock allows local users to kill arbitrary processes by specifying an arbitrary PID in the .kss.pid file.
44 CVE-1999-0129 1996-12-03 2008-09-09
4.6
 User Local Low Not required Partial Partial Partial
Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.
Total number of vulnerabilities : 44   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.