* * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2021-29627	415		2021-04-07	2022-05-27	7.2	None	Local	Low	Not required	Complete	Complete	Complete
In FreeBSD 13.0-STABLE before n245050, 12.2-STABLE before r369525, 13.0-RC4 before p0, and 12.2-RELEASE before p6, listening socket accept filters implementing the accf_create callback incorrectly freed a process supplied argument string. Additional operations on the socket can lead to a double free or use after free.
2	CVE-2021-29626	416		2021-04-07	2022-05-27	2.1	None	Local	Low	Not required	Partial	None	None
In FreeBSD 13.0-STABLE before n245117, 12.2-STABLE before r369551, 11.4-STABLE before r369559, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, copy-on-write logic failed to invalidate shared memory page mappings between multiple processes allowing an unprivileged process to maintain a mapping after it is freed, allowing the process to read private data belonging to other processes or the kernel.
3	CVE-2020-25584	362		2021-04-07	2021-06-03	6.2	None	Local	High	Not required	Complete	Complete	Complete
In FreeBSD 13.0-STABLE before n245118, 12.2-STABLE before r369552, 11.4-STABLE before r369560, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, a superuser inside a FreeBSD jail configured with the non-default allow.mount permission could cause a race condition between the lookup of ".." and remounting a filesystem, allowing access to filesystem hierarchy outside of the jail.
4	CVE-2020-24863	787	Mem. Corr.	2020-09-03	2020-09-11	4.9	None	Local	Low	Not required	None	None	Complete
A memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode.
5	CVE-2020-24718	862	+Priv	2020-09-25	2022-01-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying VMCS_HOST_RIP.
6	CVE-2020-24385	476		2020-09-03	2020-09-11	4.9	None	Local	Low	Not required	None	None	Complete
In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation layer that allows attackers to crash the running kernel. During binary interaction, td->td_emuldata in sys/compat/linux/linux_emul.h is not getting initialized and returns NULL from em_find().
7	CVE-2020-13434	190	Overflow	2020-05-24	2022-05-12	2.1	None	Local	Low	Not required	None	None	Partial
SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
8	CVE-2020-10566	120	Overflow	2020-03-14	2020-03-19	4.6	None	Local	Low	Not required	Partial	Partial	Partial
grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, mishandles font loading by a guest through a grub2.cfg file, leading to a buffer overflow.
9	CVE-2020-10565	269	Exec Code	2020-03-14	2021-07-21	7.2	None	Local	Low	Not required	Complete	Complete	Complete
grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, does not validate the address provided as part of a memrw command (read_* or write_*) by a guest through a grub2.cfg file. This allows an untrusted guest to perform arbitrary read or write operations in the context of the grub-bhyve process, resulting in code execution as root on the host OS.
10	CVE-2019-9499	287		2019-04-17	2020-10-22	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
11	CVE-2019-9498	287		2019-04-17	2020-10-22	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
12	CVE-2018-17160	787	Exec Code	2018-12-04	2020-08-24	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
In FreeBSD before 11.2-STABLE(r341486) and 11.2-RELEASE-p6, insufficient bounds checking in one of the device models provided by bhyve can permit a guest operating system to overwrite memory in the bhyve host possibly permitting arbitrary code execution. A guest OS using a firmware image can cause the bhyve process to crash, or possibly execute arbitrary code on the host as root.
13	CVE-2018-17159	400		2018-12-04	2018-12-31	7.8	None	Remote	Low	Not required	None	None	Complete
In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, the NFS server lacks a bounds check in the READDIRPLUS NFS request. Unprivileged remote users with access to the NFS server can cause a resource exhaustion by forcing the server to allocate an arbitrarily large memory allocation.
14	CVE-2018-17158	190	Overflow	2018-12-04	2018-12-31	7.8	None	Remote	Low	Not required	None	None	Complete
In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length field in an NFSv4 request. Unprivileged remote users with access to the NFS server can crash the system by sending a specially crafted NFSv4 request.
15	CVE-2018-17157	190	Exec Code Overflow Mem. Corr.	2018-12-04	2019-01-24	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error when handling opcodes can cause memory corruption by sending a specially crafted NFSv4 request. Unprivileged remote users with access to the NFS server may be able to execute arbitrary code.
16	CVE-2018-17156	787		2018-11-28	2019-10-03	4.3	None	Remote	Medium	Not required	None	None	Partial
In FreeBSD before 11.2-STABLE(r340268) and 11.2-RELEASE-p5, due to incorrectly accounting for padding on 64-bit platforms, a buffer underwrite could occur when constructing an ICMP reply packet when using a non-standard value for the net.inet.icmp.quotelen sysctl.
17	CVE-2018-17155	200	+Info	2018-09-28	2018-11-23	2.1	None	Local	Low	Not required	Partial	None	None
In FreeBSD before 11.2-STABLE(r338983), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338984), and 10.4-RELEASE-p13, due to insufficient initialization of memory copied to userland in the getcontext and swapcontext system calls, small amounts of kernel memory may be disclosed to userland processes. Unprivileged authenticated local users may be able to access small amounts privileged kernel data.
18	CVE-2018-17154	476	DoS	2018-09-28	2018-11-23	4.9	None	Local	Low	Not required	None	None	Complete
In FreeBSD before 11.2-STABLE(r338987), 11.2-RELEASE-p4, and 11.1-RELEASE-p15, due to insufficient memory checking in the freebsd4_getfsstat system call, a NULL pointer dereference can occur. Unprivileged authenticated local users may be able to cause a denial of service.
19	CVE-2018-8897	362		2018-05-08	2019-10-03	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.
20	CVE-2018-6925	476		2018-09-28	2018-11-30	4.9	None	Local	Low	Not required	None	None	Complete
In FreeBSD before 11.2-STABLE(r338986), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338985), and 10.4-RELEASE-p13, due to improper maintenance of IPv6 protocol control block flags through various failure paths, an unprivileged authenticated local user may be able to cause a NULL pointer dereference causing the kernel to crash.
21	CVE-2018-6924	20		2018-09-12	2018-11-26	5.6	None	Local	Low	Not required	Partial	None	Complete
In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p3, 11.1-RELEASE-p14, 10.4-STABLE, and 10.4-RELEASE-p12, insufficient validation in the ELF header parser could allow a malicious ELF binary to cause a kernel crash or disclose kernel memory.
22	CVE-2018-6921	200	+Info	2018-05-08	2018-06-13	2.1	None	Local	Low	Not required	Partial	None	None
In FreeBSD before 11.1-STABLE(r332066) and 11.1-RELEASE-p10, due to insufficient initialization of memory copied to userland in the network subsystem, small amounts of kernel memory may be disclosed to userland processes. Unprivileged authenticated local users may be able to access small amounts of privileged kernel data.
23	CVE-2018-6920	200	+Info	2018-05-08	2018-06-13	2.1	None	Local	Low	Not required	Partial	None	None
In FreeBSD before 11.1-STABLE(r332303), 11.1-RELEASE-p10, 10.4-STABLE(r332321), and 10.4-RELEASE-p9, due to insufficient initialization of memory copied to userland in the Linux subsystem and Atheros wireless driver, small amounts of kernel memory may be disclosed to userland processes. Unprivileged authenticated local users may be able to access small amounts of privileged kernel data.
24	CVE-2018-6919	200	+Info	2018-04-04	2018-05-24	5.0	None	Remote	Low	Not required	Partial	None	None
In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, due to insufficient initialization of memory copied to userland, small amounts of kernel memory may be disclosed to userland processes. Unprivileged users may be able to access small amounts privileged kernel data.
25	CVE-2018-6918	835		2018-04-04	2019-10-03	7.8	None	Remote	Low	Not required	None	None	Complete
In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash.
26	CVE-2018-6917	190	Overflow	2018-04-04	2018-05-24	5.0	None	Remote	Low	Not required	Partial	None	None
In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, insufficient validation of user-provided font parameters can result in an integer overflow, leading to the use of arbitrary kernel memory as glyph data. Unprivileged users may be able to access privileged kernel data.
27	CVE-2018-6916	416		2018-03-09	2018-03-29	9.0	None	Remote	Low	Not required	Partial	Partial	Complete
In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p7, 10.4-STABLE, 10.4-RELEASE-p7, and 10.3-RELEASE-p28, the kernel does not properly validate IPsec packets coming from a trusted host. Additionally, a use-after-free vulnerability exists in the IPsec AH handling code. This issue could cause a system crash or other unpredictable results.
28	CVE-2017-15037	362		2017-10-05	2017-10-13	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
In FreeBSD through 11.1, the smb_strdupin function in sys/netsmb/smb_subr.c has a race condition with a resultant out-of-bounds read, because it can cause t2p->t_name strings to lack a final '\0' character.
29	CVE-2017-13088	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
30	CVE-2017-13087	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
31	CVE-2017-13086	330		2017-10-17	2019-10-03	5.4	None	Local Network	Medium	Not required	Partial	Partial	Partial
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
32	CVE-2017-13084	330		2017-10-17	2019-10-03	5.4	None	Local Network	Medium	Not required	Partial	Partial	Partial
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
33	CVE-2017-13082	330		2017-10-17	2019-10-03	5.8	None	Local Network	Low	Not required	Partial	Partial	Partial
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
34	CVE-2017-13081	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.
35	CVE-2017-13080	330		2017-10-17	2020-11-10	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.
36	CVE-2017-13079	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.
37	CVE-2017-13078	330		2017-10-17	2019-10-03	2.9	None	Local Network	Medium	Not required	None	Partial	None
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.
38	CVE-2017-13077	330		2017-10-17	2019-10-03	5.4	None	Local Network	Medium	Not required	Partial	Partial	Partial
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
39	CVE-2017-1085	119	Exec Code Overflow	2018-09-12	2018-11-23	7.2	None	Local	Low	Not required	Complete	Complete	Complete
In FreeBSD before 11.2-RELEASE, an application which calls setrlimit() to increase RLIMIT_STACK may turn a read-only memory region below the stack into a read-write region. A specially crafted executable could be exploited to execute arbitrary code in the user context.
40	CVE-2017-1084	119	Overflow	2018-09-12	2018-11-23	7.8	None	Remote	Low	Not required	None	None	Complete
In FreeBSD before 11.2-RELEASE, multiple issues with the implementation of the stack guard-page reduce the protections afforded by the guard-page. This results in the possibility a poorly written process could be cause a stack overflow.
41	CVE-2017-1083	119	Overflow	2018-09-12	2018-11-23	7.8	None	Remote	Low	Not required	None	None	Complete
In FreeBSD before 11.2-RELEASE, a stack guard-page is available but is disabled by default. This results in the possibility a poorly written process could be cause a stack overflow.
42	CVE-2017-1082	20	Overflow	2018-09-12	2018-11-27	5.0	None	Remote	Low	Not required	None	None	Partial
In FreeBSD 11.x before 11.1-RELEASE and 10.x before 10.4-RELEASE, the qsort algorithm has a deterministic recursion pattern. Feeding a pathological input to the algorithm can lead to excessive stack usage and potential overflow. Applications that use qsort to handle large data set may crash if the input follows the pathological pattern.
43	CVE-2017-1081	20		2018-04-10	2019-10-09	7.8	None	Remote	Low	Not required	None	None	Complete
In FreeBSD before 11.0-STABLE, 11.0-RELEASE-p10, 10.3-STABLE, and 10.3-RELEASE-p19, ipfilter using "keep state" or "keep frags" options can cause a kernel panic when fed specially crafted packet fragments due to incorrect memory handling.
44	CVE-2015-7973	254		2017-01-30	2021-04-26	5.8	None	Remote	Medium	Not required	None	Partial	Partial
NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.
45	CVE-2015-2923	20		2020-02-20	2020-02-28	3.3	None	Local Network	Low	Not required	None	None	Partial
The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.
46	CVE-2015-1415	200	+Info	2015-04-10	2018-10-09	2.1	None	Local	Low	Not required	Partial	None	None
The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile (/boot/encryption.key), which allows local users to obtain sensitive key information by reading the file.
47	CVE-2014-8117	399	DoS	2014-12-17	2018-01-05	5.0	None	Remote	Low	Not required	None	None	Partial
softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumption or crash) via unspecified vectors.
48	CVE-2014-8116	399	DoS	2014-12-17	2018-01-05	5.0	None	Remote	Low	Not required	None	None	Partial
The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities.
49	CVE-2014-3879	287	Bypass	2020-02-18	2020-02-27	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes the loaded policy chain to no be discarded and allows context-dependent attackers to bypass authentication via a login (1) without a password or (2) with an incorrect password.
50	CVE-2013-6834	20	+Info	2013-11-21	2014-03-04	4.9	None	Local	Low	Not required	Complete	None	None
The ql_eioctl function in sys/dev/qlxgbe/ql_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.

Total number of vulnerabilities : 88 Page : 1 (This Page)2