CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Freebsd » Freebsd » 4.1 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:freebsd:freebsd:4.1:*:*:*:*:*:*:*
CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-6834 20 +Info 2013-11-21 2014-03-04
4.9
 None Local Low Not required Complete None None
The ql_eioctl function in sys/dev/qlxgbe/ql_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.
2 CVE-2013-6833 20 +Info 2013-11-21 2013-11-25
4.9
 None Local Low Not required Complete None None
The qls_eioctl function in sys/dev/qlxge/qls_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.
3 CVE-2013-6832 200 +Info 2013-11-21 2013-11-25
4.9
 None Local Low Not required Complete None None
The nand_ioctl function in sys/dev/nand/nand_geom.c in the nand driver in the kernel in FreeBSD 10 and earlier does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.
4 CVE-2012-2143 310 2012-07-05 2016-12-08
4.3
 None Remote Medium Not required None Partial None
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
5 CVE-2008-4609 16 DoS 2008-10-20 2021-07-07
7.1
 None Remote Medium Not required None None Complete
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
6 CVE-2006-1283 +Priv 2006-03-23 2017-07-20
7.2
 None Local Low Not required Complete Complete Complete
opiepasswd in One-Time Passwords in Everything (OPIE) in FreeBSD 4.10-RELEASE-p22 through 6.1-STABLE before 20060322 uses the getlogin function to determine the invoking user account, which might allow local users to configure OPIE access to the root account and possibly gain root privileges if a root shell is permitted by the configuration of the wheel group or sshd.
7 CVE-2005-2068 2005-07-05 2008-09-05
5.0
 None Remote Low Not required None Partial None
FreeBSD 4.x through 4.11 and 5.x through 5.4 allows remote attackers to modify certain TCP options via a TCP packet with the SYN flag set for an already established session.
8 CVE-2005-1406 2005-05-06 2011-03-08
4.6
 None Local Low Not required Partial Partial Partial
The kernel in FreeBSD 4.x to 4.11 and 5.x to 5.4 does not properly clear certain fixed-length buffers when copying variable-length data for use by applications, which could allow those applications to read previously used sensitive memory.
9 CVE-2005-1126 399 2005-04-15 2017-07-11
2.1
 None Local Low Not required Partial None None
The SIOCGIFCONF ioctl (ifconf function) in FreeBSD 4.x through 4.11 and 5.x through 5.4 does not properly clear a buffer before using it, which allows local users to obtain portions of sensitive kernel memory.
10 CVE-2005-0988 2005-05-02 2017-10-11
3.7
 None Local High Not required Partial Partial Partial
Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete.
11 CVE-2005-0708 +Info 2005-05-02 2017-10-12
10.0
 None Remote Low Not required Complete Complete Complete
The sendfile system call in FreeBSD 4.8 through 4.11 and 5 through 5.4 can transfer portions of kernel memory if a file is truncated while it is being sent, which could allow remote attackers to obtain sensitive information.
12 CVE-2005-0610 Exec Code 2005-04-12 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
Multiple symlink vulnerabilities in portupgrade before 20041226_2 in FreeBSD allow local users to (1) overwrite arbitrary files and possibly replace packages to execute arbitrary code via pkg_fetch, (2) overwrite arbitrary files via temporary files when portupgrade upgrades a port or package, or (3) create arbitrary zero-byte files via the pkgdb.fixme temporary file.
13 CVE-2005-0109 +Info 2005-03-05 2018-10-16
4.7
 None Local Medium Not required Complete None None
Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic keys, via a timing attack on memory cache misses.
14 CVE-2004-1471 DoS Exec Code 2004-12-31 2017-07-11
7.1
 None Remote High ??? Complete Complete Complete
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
15 CVE-2004-1066 DoS 2005-01-10 2017-07-11
3.6
 None Local Low Not required Partial None Partial
The cmdline pseudofiles in (1) procfs on FreeBSD 4.8 through 5.3, and (2) linprocfs on FreeBSD 5.x through 5.3, do not properly validate a process argument vector, which allows local users to cause a denial of service (panic) or read portions of kernel memory. NOTE: this candidate might be SPLIT into 2 separate items in the future.
16 CVE-2004-0125 2004-08-06 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
The jail system call in FreeBSD 4.x before 4.10-RELEASE does not verify that an attempt to manipulate routing tables originated from a non-jailed process, which could allow local users to modify the routing table.
17 CVE-2004-0002 DoS 2004-03-03 2008-09-10
10.0
 None Remote Low Not required Complete Complete Complete
The TCP MSS (maximum segment size) functionality in netinet allows remote attackers to cause a denial of service (resource exhaustion) via (1) a low MTU, which causes a large number of small packets to be produced, or (2) via a large number of packets with a small TCP payload, which cause a large number of calls to the resource-intensive sowakeup function.
18 CVE-2003-0804 DoS 2003-11-17 2008-09-10
5.0
 None Remote Low Not required None None Partial
The arplookup function in FreeBSD 5.1 and earlier, Mac OS X before 10.2.8, and possibly other BSD-based systems, allows remote attackers on a local subnet to cause a denial of service (resource starvation and panic) via a flood of spoofed ARP requests.
19 CVE-2003-0466 Exec Code Overflow 2003-08-27 2018-05-03
10.0
 None Remote Low Not required Complete Complete Complete
Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.
20 CVE-2003-0028 Exec Code Overflow 2003-03-25 2020-01-21
7.5
 None Remote Low Not required Partial Partial Partial
Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.
21 CVE-2002-2092 +Priv 2002-12-31 2017-12-19
3.7
 None Local High Not required Partial Partial Partial
Race condition in exec in OpenBSD 4.0 and earlier, NetBSD 1.5.2 and earlier, and FreeBSD 4.4 and earlier allows local users to gain privileges by attaching a debugger to a process before the kernel has determined that the process is setuid or setgid.
22 CVE-2002-1915 DoS 2002-12-31 2008-09-05
2.1
 None Local Low Not required None None Partial
tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.
23 CVE-2002-1674 DoS 2002-12-31 2017-07-11
1.2
 None Local High Not required None None Partial
procfs on FreeBSD before 4.5 allows local users to cause a denial of service (kernel panic) by removing a file that the fstatfs function refers to.
24 CVE-2002-0973 2002-09-24 2016-10-18
4.6
 None Local Low Not required Partial Partial Partial
Integer signedness error in several system calls for FreeBSD 4.6.1 RELEASE-p10 and earlier may allow attackers to access sensitive kernel memory via large negative values to the (1) accept, (2) getsockname, and (3) getpeername system calls, and the (4) vesa FBIO_GETPALETTE ioctl.
25 CVE-2002-0754 +Priv 2002-08-12 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
Kerberos 5 su (k5su) in FreeBSD 4.4 and earlier relies on the getlogin system call to determine if the user running k5su is root, which could allow a root-initiated process to regain its privileges after it has dropped them.
26 CVE-2002-0062 Overflow +Priv 2002-03-08 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in ncurses 5.0, and the ncurses4 compatibility package as used in Red Hat Linux, allows local users to gain privileges, related to "routines for moving the physical cursor and scrolling."
27 CVE-2001-1180 +Priv 2001-07-10 2017-10-10
7.2
 None Local Low Not required Complete Complete Complete
FreeBSD 4.3 does not properly clear shared signal handlers when executing a process, which allows local users to gain privileges by calling rfork with a shared signal handler, having the child process execute a setuid program, and sending a signal to the child.
28 CVE-2001-1166 2001-08-21 2008-09-05
5.0
 None Remote Low Not required Partial None None
linprocfs on FreeBSD 4.3 and earlier does not properly restrict access to kernel memory, which allows one process with debugging rights on a privileged process to read restricted memory from that process.
29 CVE-2001-0554 120 Exec Code Overflow 2001-08-14 2022-01-21
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.
30 CVE-2001-0247 Exec Code Overflow 2001-06-18 2020-01-21
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3.
31 CVE-2001-0183 Bypass 2001-03-26 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
ipfw and ip6fw in FreeBSD 4.2 and earlier allows remote attackers to bypass access restrictions by setting the ECE flag in a TCP packet, which makes the packet appear to be part of an established connection.
32 CVE-2001-0063 +Priv Bypass 2001-02-12 2017-10-10
7.2
 None Local Low Not required Complete Complete Complete
procfs in FreeBSD and possibly other operating systems allows local users to bypass access control restrictions for a jail environment and gain additional privileges.
33 CVE-2001-0062 DoS 2001-02-12 2017-10-10
2.1
 None Local Low Not required None None Partial
procfs in FreeBSD and possibly other operating systems allows local users to cause a denial of service by calling mmap on the process' own mem file, which causes the kernel to hang.
34 CVE-2001-0061 +Priv 2001-02-12 2017-10-10
7.2
 None Local Low Not required Complete Complete Complete
procfs in FreeBSD and possibly other operating systems does not properly restrict access to per-process mem and ctl files, which allows local users to gain root privileges by forking a child process and executing a privileged process from the child, while the parent retains access to the child's address space.
35 CVE-2000-1184 DoS 2001-01-09 2017-10-10
5.0
 None Remote Low Not required None None Partial
telnetd in FreeBSD 4.2 and earlier, and possibly other operating systems, allows remote attackers to cause a denial of service by specifying an arbitrary large file in the TERMCAP environmental variable, which consumes resources as the server processes the file.
36 CVE-2000-1167 2001-01-09 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
ppp utility in FreeBSD 4.1.1 and earlier does not properly restrict access as specified by the "nat deny_incoming" command, which allows remote attackers to connect to the target system.
37 CVE-2000-1066 DoS 2000-12-11 2017-07-11
5.0
 None Remote Low Not required None None Partial
The getnameinfo function in FreeBSD 4.1.1 and earlier, and possibly other operating systems, allows a remote attacker to cause a denial of service via a long DNS hostname.
38 CVE-2000-1013 2000-12-11 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
The setlocale function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable.
39 CVE-2000-1012 2000-12-11 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
The catopen function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable.
40 CVE-2000-1011 Overflow +Priv 2000-12-11 2017-10-10
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in catopen() function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to gain root privileges via a long environmental variable.
41 CVE-2000-0998 +Priv 2000-12-11 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
Format string vulnerability in top program allows local attackers to gain root privileges via the "kill" or "renice" function.
42 CVE-2000-0963 Exec Code Overflow 2000-12-19 2017-07-11
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in ncurses library allows local users to execute arbitrary commands via long environmental information such as TERM or TERMINFO_DIRS.
43 CVE-2000-0916 2000-12-19 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
FreeBSD 4.1.1 and earlier, and possibly other BSD-based OSes, uses an insufficient random number generator to generate initial TCP sequence numbers (ISN), which allows remote attackers to spoof TCP connections.
44 CVE-2000-0752 Overflow +Priv 2000-10-20 2008-09-05
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflows in brouted in FreeBSD and possibly other OSes allows local users to gain root privileges via long command line arguments.
45 CVE-2000-0749 Overflow +Priv 2000-10-20 2017-10-10
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in the Linux binary compatibility module in FreeBSD 3.x through 5.x allows local users to gain root privileges via long filenames in the linux shadow file system.
46 CVE-2000-0729 DoS 2000-10-20 2017-10-10
2.1
 None Local Low Not required None None Partial
FreeBSD 5.x, 4.x, and 3.x allows local users to cause a denial of service by executing a program with a malformed ELF image header.
Total number of vulnerabilities : 46   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.