Openbsd » Openbsd : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2011-2895	119		Exec Code Overflow	2011-08-19	2012-12-18	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.
2	CVE-2011-2168	189		Overflow	2011-05-24	2011-06-10	5.0	None	Remote	Low	Not required	None	None	Partial
Multiple integer overflows in the glob implementation in libc in OpenBSD before 4.9 might allow context-dependent attackers to have an unspecified impact via a crafted string, related to the GLOB_APPEND and GLOB_DOOFFS flags, a different issue than CVE-2011-0418.
3	CVE-2011-1013	189		DoS	2011-05-09	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Integer signedness error in the drm_modeset_ctl function in (1) drivers/gpu/drm/drm_irq.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.38 and (2) sys/dev/pci/drm/drm_irq.c in the kernel in OpenBSD before 4.9 allows local users to trigger out-of-bounds write operations, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via a crafted num_crtcs (aka vb_num) structure member in an ioctl argument.
4	CVE-2011-0419	399		DoS	2011-05-16	2012-10-29	4.3	None	Remote	Medium	Not required	None	None	Partial
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
5	CVE-2010-4755	399		DoS	2011-03-02	2011-09-21	4.0	None	Remote	Low	Single system	None	None	Partial
The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632.
6	CVE-2010-4754	399		DoS	2011-03-02	2011-09-21	4.0	None	Remote	Low	Single system	None	None	Partial
The glob implementation in libc in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, and OpenBSD 4.7, and Libsystem in Apple Mac OS X before 10.6.8, allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.
7	CVE-2009-3572			DoS	2009-10-06	2009-10-08	4.9	None	Local	Low	Not required	None	None	Complete
OpenBSD 4.4, 4.5, and 4.6, when running on an i386 kernel, does not properly handle XMM exceptions, which allows local users to cause a denial of service (kernel panic) via unspecified vectors.
8	CVE-2009-0780			DoS	2009-03-04	2010-04-27	5.0	None	Remote	Low	Not required	None	None	Partial
The aspath_prepend function in rde_attr.c in bgpd in OpenBSD 4.3 and 4.4 allows remote attackers to cause a denial of service (application crash) via an Autonomous System (AS) advertisement containing a long AS path.
9	CVE-2009-0689	119		DoS Exec Code Overflow	2009-07-01	2010-11-15	6.8	User	Remote	Medium	Not required	Partial	Partial	Partial
Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.
10	CVE-2009-0687	399	2	DoS	2009-08-11	2009-08-11	7.8	None	Remote	Low	Not required	None	None	Complete
The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.
11	CVE-2009-0537	189	1	DoS Overflow	2009-03-09	2009-03-21	4.9	None	Local	Low	Not required	None	None	Complete
Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree, related to the fts_level structure member, as demonstrated by (a) du, (b) rm, (c) chmod, and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise.
12	CVE-2008-4609	16		DoS	2008-10-20	2012-07-21	7.1	None	Remote	Medium	Not required	None	None	Complete
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
13	CVE-2008-4247	352		Exec Code CSRF	2008-09-25	2012-10-22	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
14	CVE-2008-2476	20		DoS	2008-10-03	2012-10-29	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).
15	CVE-2008-1215	264		Overflow +Priv	2008-03-08	2008-09-05	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "~" characters.
16	CVE-2007-5365	119	1	DoS Exec Code Overflow	2007-10-11	2011-08-02	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.
17	CVE-2007-1365			DoS Exec Code Overflow	2007-03-10	2008-09-05	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in kern/uipc_mbuf2.c in OpenBSD 3.9 and 4.0 allows remote attackers to execute arbitrary code via fragmented IPv6 packets due to "incorrect mbuf handling for ICMP6 packets." NOTE: this was originally reported as a denial of service.
18	CVE-2007-1352			Exec Code Overflow	2007-04-05	2010-11-30	3.8	None	Local Network	Medium	Single system	None	Partial	Partial
Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.
19	CVE-2007-1351	189		Exec Code Overflow	2007-04-05	2010-11-30	8.5	Admin	Remote	Medium	Single system	Complete	Complete	Complete
Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.
20	CVE-2007-0343			DoS	2007-01-17	2008-09-05	5.0	None	Remote	Low	Not required	None	None	Partial
OpenBSD before 20070116 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via certain IPv6 ICMP (aka ICMP6) echo request packets.
21	CVE-2007-0085			+Priv	2007-01-05	2008-09-05	6.0	Admin	Local	High	Single system	Complete	Complete	Complete
Unspecified vulnerability in sys/dev/pci/vga_pci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agp_ioctl NULL pointer reference.
22	CVE-2006-6730				2006-12-26	2008-09-05	6.6	None	Local	Medium	Single system	Complete	Complete	Complete
OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by replacing the System Management Mode (SMM) handler via a write to an SMRAM address within /dev/xf86 (aka the video card memory-mapped I/O range), and then launching the new handler via a System Management Interrupt (SMI), as demonstrated by a write to Programmed I/O port 0xB2.
23	CVE-2006-6397			Overflow	2006-12-07	2008-09-05	4.4	User	Local	Medium	Not required	Partial	Partial	Partial
DISPUTED Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal operations. This issue is not a vulnerability.
24	CVE-2006-6164			+Priv	2006-11-28	2008-09-05	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
The _dl_unsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LD_PRELOAD to loading processes, which might be leveraged to gain privileges.
25	CVE-2006-5550			DoS	2006-10-26	2008-09-05	4.9	None	Local	Low	Not required	None	None	Complete
The kernel in FreeBSD 6.1 and OpenBSD 4.0 allows local users to cause a denial of service via unspecified vectors involving certain ioctl requests to /dev/crypto.
26	CVE-2006-5218			DoS Overflow +Priv	2006-10-10	2008-09-05	4.6	User	Local	Low	Not required	Partial	Partial	Partial
Integer overflow in the systrace_preprepl function (STRIOCREPLACE) in systrace in OpenBSD 3.9 and NetBSD 3 allows local users to cause a denial of service (crash), gain privileges, or read arbitrary kernel memory via large numeric arguments to the systrace ioctl.
27	CVE-2006-4436			Bypass	2006-08-28	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations (SA) with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection.
28	CVE-2006-4435			DoS	2006-08-28	2008-09-05	4.9	None	Local	Low	Not required	None	None	Complete
OpenBSD 3.8, 3.9, and possibly earlier versions allows context-dependent attackers to cause a denial of service (kernel panic) by allocating more semaphores than the default.
29	CVE-2006-4304			DoS Exec Code Overflow +Info	2006-08-23	2008-09-05	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in the sppp driver in FreeBSD 4.11 through 6.1, NetBSD 2.0 through 4.0 beta before 20060823, and OpenBSD 3.8 and 3.9 before 20060902 allows remote attackers to cause a denial of service (panic), obtain sensitive information, and possibly execute arbitrary code via crafted Link Control Protocol (LCP) packets with an option length that exceeds the overall length, which triggers the overflow in (1) pppoe and (2) ippp. NOTE: this issue was originally incorrectly reported for the ppp driver.
30	CVE-2006-0098				2006-01-06	2008-09-05	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The dupfdopen function in sys/kern/kern_descrip.c in OpenBSD 3.7 and 3.8 allows local users to re-open arbitrary files by using setuid programs to access file descriptors using /dev/fd/.
31	CVE-2005-4351			Bypass	2005-12-31	2008-09-05	4.3	None	Local	Low	Single system	Partial	Partial	Partial
The securelevels implementation in FreeBSD 7.0 and earlier, OpenBSD up to 3.8, DragonFly up to 1.2, and Linux up to 2.6.15 allows root users to bypass immutable settings for files by mounting another filesystem that masks the immutable files while the system is running.
32	CVE-2005-0960			DoS	2005-05-02	2008-09-05	5.0	None	Remote	Low	Not required	None	None	Partial
Multiple vulnerabilities in the SACK functionality in (1) tcp_input.c and (2) tcp_usrreq.c OpenBSD 3.5 and 3.6 allow remote attackers to cause a denial of service (memory exhaustion or system crash).
33	CVE-2005-0740			DoS	2005-01-13	2008-09-05	5.0	None	Remote	Low	Not required	None	None	Partial
The TCP stack (tcp_input.c) in OpenBSD 3.5 and 3.6 allows remote attackers to cause a denial of service (system panic) via crafted values in the TCP timestamp option, which causes invalid arguments to be used when calculating the retransmit timeout.
34	CVE-2005-0637				2005-05-02	2008-09-05	5.0	None	Remote	Low	Not required	None	Partial	None
The copy functions in locore.s such as copyout in OpenBSD 3.5 and 3.6, and possibly other BSD based operating systems, may allow attackers to exceed certain address boundaries and modify kernel memory.
35	CVE-2005-0356			DoS	2005-05-31	2008-09-05	5.0	None	Remote	Low	Not required	None	None	Partial
Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old.
36	CVE-2004-2338			Bypass	2004-12-31	2008-09-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
OpenBSD 3.3 and 3.4 does not properly parse Accept and Deny rules without netmasks on big-endian 64-bit platforms such as SPARC64, which may allow remote attackers to bypass access restrictions.
37	CVE-2004-2230			DoS Overflow	2004-12-31	2008-09-05	2.1	None	Local	Low	Not required	None	None	Partial
Heap-based buffer overflow in isakmpd on OpenBSD 3.4 through 3.6 allows local users to cause a denial of service (panic) and corrupt memory via IPSEC credentials on a socket.
38	CVE-2004-2163			Bypass	2004-12-31	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
login_radius on OpenBSD 3.2, 3.5, and possibly other versions does not verify the shared secret in a response packet from a RADIUS server, which allows remote attackers to bypass authentication by spoofing server replies.
39	CVE-2004-1799			Bypass	2004-12-31	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PF in certain OpenBSD versions, when stateful filtering is enabled, does not limit packets for a session to the original interface, which allows remote attackers to bypass intended packet filters via spoofed packets to other interfaces.
40	CVE-2004-1471			DoS Exec Code	2004-12-31	2008-09-05	7.1	Admin	Remote	High	Single system	Complete	Complete	Complete
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
41	CVE-2004-1082				2004-02-03	2008-09-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.
42	CVE-2004-0819			DoS	2004-08-25	2008-09-05	5.0	None	Remote	Low	Not required	None	None	Partial
The bridge functionality in OpenBSD 3.4 and 3.5, when running a gateway configured as a bridging firewall with the link2 option for IPSec enabled, allows remote attackers to cause a denial of service (crash) via an ICMP echo (ping) packet.
43	CVE-2004-0688			Exec Code Overflow	2004-10-20	2010-08-21	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file.
44	CVE-2004-0687			Exec Code Overflow	2004-10-20	2010-08-21	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) ParsePixels in parse.c for libXpm before 6.8.1 allow remote attackers to execute arbitrary code via a malformed XPM image file.
45	CVE-2004-0492			DoS Exec Code Overflow	2004-08-06	2011-09-06	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
46	CVE-2004-0488			Exec Code Overflow	2004-07-07	2010-08-21	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.
47	CVE-2004-0482			Overflow	2004-07-07	2008-09-05	4.6	User	Local	Low	Not required	Partial	Partial	Partial
Multiple integer overflows in (1) procfs_cmdline.c, (2) procfs_fpregs.c, (3) procfs_linux.c, (4) procfs_regs.c, (5) procfs_status.c, and (6) procfs_subr.c in procfs for OpenBSD 3.5 and earlier allow local users to read sensitive kernel memory and possibly perform other unauthorized activities.
48	CVE-2004-0418			Exec Code	2004-08-06	2010-08-21	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.
49	CVE-2004-0417			Overflow	2004-08-06	2010-08-21	5.0	None	Remote	Low	Not required	None	None	Partial
Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.
50	CVE-2004-0416	119		Exec Code Overflow	2004-08-06	2010-08-21	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.

Total number of vulnerabilities : 146 Page : 1 (This Page)2 3