DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
FreeBSD Project FreeBSD OS: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-06-30
Ein Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, und um beliebigen Programmcode auszuführen.
01
beschreibt (17)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-58082US | — | — | ||
The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character,… | ||||
| CVE-2026-58081US | — | — | ||
Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters.
An applicati… | ||||
| CVE-2026-49425US | — | — | ||
The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct.
An unprivileged user may observe a s… | ||||
| CVE-2026-49424US | — | — | ||
The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct.
An unprivileged user may ob… | ||||
| CVE-2026-49423US | — | — | ||
When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipp… | ||||
| CVE-2026-49431US | —OT erhöht | — | ||
The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the datas… | ||||
| CVE-2026-49430US | — | — | ||
The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length… | ||||
| CVE-2026-49429US | — | — | ||
The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size a… | ||||
| CVE-2026-49428US | — | — | ||
Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage… | ||||
| CVE-2026-49427US | — | — | ||
Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages a… | ||||
| CVE-2026-49426US | — | — | ||
When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual resul… | ||||
| CVE-2026-49422US | — | — | ||
The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack h… | ||||
| CVE-2026-49421US | — | — | ||
The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was si… | ||||
| CVE-2026-49420US | — | — | ||
The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back… | ||||
| CVE-2026-49419US | — | — | ||
When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the de… | ||||
| CVE-2026-49418US | — | — | ||
When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A s… | ||||
| CVE-2026-49415US | — | — | ||
During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user ca… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- FreeBSD Security Advisory FreeBSD-SA-26:37.vm vom 2026-06-30external
- FreeBSD Security Advisory FreeBSD-SA-26:38.jail vom 2026-06-30external
- FreeBSD Security Advisory FreeBSD-SA-26:39.execve vom 2026-06-30external
- FreeBSD Security Advisory FreeBSD-SA-26:40.zfs vom 2026-06-30external
- FreeBSD Security Advisory FreeBSD-SA-26:41.libalias vom 2026-06-30external
- FreeBSD Security Advisory FreeBSD-SA-26:42.unlinkat vom 2026-06-30external
- FreeBSD Security Advisory FreeBSD-SA-26:43.tcp vom 2026-06-30external
- FreeBSD Security Advisory FreeBSD-SA-26:44.posixshm vom 2026-06-30external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan