DeutschShown in its original language — a full translation is planned for a future version.
FreeBSD Project FreeBSD OS: Mehrere Schwachstellen
view advisory published 2026-06-09
Ein lokaler Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um erweiterte Rechte zu erlangen – möglicherweise sogar Administratorrechte –, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder andere, nicht näher definierte Angriffe durchzuführen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-49416US | — | — | ||
The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap… | ||||
| CVE-2026-49414US | — | — | ||
The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-re… | ||||
| CVE-2026-49417US | — | Exploit | ||
Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while… | ||||
| CVE-2026-49413US | — | Exploit | ||
The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the… | ||||
| CVE-2026-49412US | — | — | ||
The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread… | ||||
| CVE-2026-45259US | — | — | ||
sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a capability mode check re… | ||||
| CVE-2026-45258US | — | Exploit | ||
dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large… | ||||
| CVE-2026-45257US | — | — | ||
The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data place… | ||||
| CVE-2026-45256US | — | — | ||
When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the result before deliverin… | ||||
| CVE-2026-10846US | high7.5 | — | ||
NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the resp… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:49520 vom 2026-08-03external
- Red Hat Security Advisory RHSA-2026:49836 vom 2026-08-04external
- Red Hat Security Advisory RHSA-2026:50108 vom 2026-08-04external
- Red Hat Security Advisory RHSA-2026:53402 vom 2026-08-11external
- Red Hat Security Advisory RHSA-2026:54244 vom 2026-08-12external
- Red Hat Security Advisory RHSA-2026:54254 vom 2026-08-12external
- Red Hat Security Advisory RHSA-2026:54377 vom 2026-08-12external
- Writeup "Bumsrakete" for FreeBSD-SA-26:26.ktlsexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan