CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Netbsd » Netbsd » 1.3 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:netbsd:netbsd:1.3:*:*:*:*:*:*:*
CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2010-2530 189 DoS 2010-09-29 2010-09-30
4.9
 None Local Low Not required None None Complete
Multiple integer signedness errors in smb_subr.c in the netsmb module in the kernel in NetBSD 5.0.2 and earlier, FreeBSD, and Apple Mac OS X allow local users to cause a denial of service (panic) via a negative size value in a /dev/nsmb ioctl operation, as demonstrated by a (1) SMBIOC_LOOKUP or (2) SMBIOC_OPENSESSION ioctl call.
2 CVE-2009-2793 264 +Priv 2009-09-18 2018-10-10
4.6
 None Local Low Not required Partial Partial Partial
The kernel in NetBSD, probably 5.0.1 and earlier, on x86 platforms does not properly handle a pre-commit failure of the iret instruction, which might allow local users to gain privileges via vectors related to a tempEIP pseudocode variable that is outside of the code-segment limits.
3 CVE-2008-4609 16 DoS 2008-10-20 2021-07-07
7.1
 None Remote Medium Not required None None Complete
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
4 CVE-2006-5215 2006-10-10 2018-10-30
2.6
 None Local High Not required Partial Partial None
The Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060317, and Solaris 8 through 10 before 20061006, allows local users to overwrite arbitrary files, or read another user's Xsession errors file, via a symlink attack on a /tmp/xses-$USER file.
5 CVE-2002-2092 +Priv 2002-12-31 2017-12-19
3.7
 None Local High Not required Partial Partial Partial
Race condition in exec in OpenBSD 4.0 and earlier, NetBSD 1.5.2 and earlier, and FreeBSD 4.4 and earlier allows local users to gain privileges by attaching a debugger to a process before the kernel has determined that the process is setuid or setgid.
6 CVE-2002-1915 DoS 2002-12-31 2008-09-05
2.1
 None Local Low Not required None None Partial
tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.
7 CVE-2001-0993 DoS 2001-07-24 2017-10-10
2.1
 None Local Low Not required None None Partial
sendmsg function in NetBSD 1.3 through 1.5 allows local users to cause a denial of service (kernel trap or panic) via a msghdr structure with a large msg_controllen length.
8 CVE-2001-0554 120 Exec Code Overflow 2001-08-14 2022-01-21
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.
9 CVE-2001-0247 Exec Code Overflow 2001-06-18 2020-01-21
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3.
10 CVE-1999-1409 1998-07-03 2016-10-18
2.1
 None Local Low Not required Partial None None
The at program in IRIX 6.2 and NetBSD 1.3.2 and earlier allows local users to read portions of arbitrary files by submitting the file to at with the -f argument, which generates error messages that at sends to the user via e-mail.
11 CVE-1999-0764 1999-05-01 2008-09-09
6.4
 None Remote Low Not required None Partial Partial
NetBSD allows ARP packets to overwrite static ARP entries.
12 CVE-1999-0763 1999-05-01 2008-09-09
6.4
 None Remote Low Not required None Partial Partial
NetBSD on a multi-homed host allows ARP packets on one network to modify ARP entries on another connected network.
13 CVE-1999-0674 1999-08-09 2018-10-30
7.2
 None Local Low Not required Complete Complete Complete
The BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve.
14 CVE-1999-0466 1999-04-21 2008-09-09
7.2
 None Local Low Not required Complete Complete Complete
The SVR4 /dev/wabi special device file in NetBSD 1.3.3 and earlier allows a local user to read or write arbitrary files on the disk associated with that device.
15 CVE-1999-0303 Overflow 1998-05-21 2018-10-30
4.6
 None Local Low Not required Partial Partial Partial
Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames.
16 CVE-1999-0011 DoS 1998-04-08 2018-10-30
10.0
 None Remote Low Not required Complete Complete Complete
Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer.
17 CVE-1999-0010 DoS 1998-04-08 2018-10-30
5.0
 None Remote Low Not required None None Partial
Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages.
18 CVE-1999-0009 Overflow 1998-04-08 2018-10-30
10.0
 None Remote Low Not required Complete Complete Complete
Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases.
Total number of vulnerabilities : 18   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.