DeutschShown in its original language — a full translation is planned for a future version.
FreeBSD Project FreeBSD OS: Mehrere Schwachstellen
view advisory published 2026-09-29
Ein Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder Denial-of-Service-Zustände zu verursachen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-58100US | — | — | ||
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before k… | ||||
| CVE-2026-58099US | — | — | ||
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as… | ||||
| CVE-2026-58098US | — | — | ||
When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC ide… | ||||
| CVE-2026-101306US | — | — | ||
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself… | ||||
| CVE-2026-101305US | — | — | ||
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root… | ||||
| CVE-2026-101304US | high7.1 | — | ||
When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of… | ||||
| CVE-2026-101303US | — | — | ||
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.
A process in a classic… | ||||
| CVE-2026-101302US | — | — | ||
TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type ha… | ||||
| CVE-2026-84783US | — | — | ||
Issue summary: The first concurrent use of the same X.509 certificate by
several threads may cause its cached extension data to be freed while
another thread is still using it.
Im… | ||||
| CVE-2026-84782US | — | — | ||
Issue summary: The DTLS retransmission logic does not correctly handle
a handshake message write that is suspended part-way through.
The retransmitted message can be read past the… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:76918 vom 2026-10-08external
- FreeBSD Security Advisory FreeBSD-SA-26:64.sysvsem vom 2026-09-29external
- FreeBSD Security Advisory FreeBSD-SA-26:65.kqueue vom 2026-09-29external
- FreeBSD Security Advisory FreeBSD-SA-26:66.jail vom 2026-09-29external
- FreeBSD Security Advisory FreeBSD-SA-26:67.ktls vom 2026-09-29external
- FreeBSD Security Advisory FreeBSD-SA-26:68.openssl vom 2026-09-29external
- FreeBSD Security Advisory FreeBSD-SA-26:69.udp vom 2026-09-29external
- WID-SEC-W-2026-3664 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan