Index: vuln.xml =================================================================== RCS file: /home/ncvs/ports/security/vuxml/vuln.xml,v retrieving revision 1.2745 diff -u -r1.2745 vuln.xml --- vuln.xml 25 Jun 2012 16:06:46 -0000 1.2745 +++ vuln.xml 27 Jun 2012 15:26:08 -0000 @@ -52,6 +52,164 @@ --> + + FreeBSD -- Privilege escalation when returning from kernel + + + FreeBSD + 7.47.4_9 + 8.18.1_12 + 8.28.2_9 + 8.38.3_3 + 9.09.0_3 + + + + +

Problem description:

+
+

FreeBSD/amd64 runs on CPUs from different vendors. Due to varying + behaviour of CPUs in 64 bit mode a sanity check of the kernel may be + insufficient when returning from a system call.

+

Successful exploitation of the problem can lead to local kernel privilege + escalation, kernel data corruption and/or crash. + + To exploit this vulnerability, an attacker must be able to run code with user + privileges on the target system.

+
+ + + + SA-12:04.sysret + CVE-2012-0217 + + + 2012-06-12 + 2012-06-27 + + + + + FreeBSD -- Incorrect handling of zero-length RDATA fields in named(8) + + + FreeBSD + 7.47.4_9 + 8.18.1_11 + 8.28.2_9 + 8.38.3_3 + 9.09.0_3 + + + + +

Problem description:

+
+

The named(8) server does not properly handle DNS resource records where + the RDATA field is zero length, which may cause various issues for the + servers handling them.

+

Resolving servers may crash or disclose some portion of memory to the + client. Authoritative servers may crash on restart after transferring a + zone containing records with zero-length RDATA fields. These would + result in a denial of service, or leak of sensitive information.

+
+ + + + SA-12:03.bind + CVE-2012-1667 + + + 2012-06-12 + 2012-06-27 + + + + + FreeBSD -- Incorrect crypt() hashing + + + FreeBSD + 7.47.4_8 + 8.18.1_10 + 8.28.2_8 + 8.38.3_2 + 9.09.0_2 + + + + +

Problem description:

+
+

There is a programming error in the DES implementation used in crypt() + when handling input which contains characters that can not be represented + with 7-bit ASCII.

+

When the input contains characters with only the most significant bit set + (0x80), that character and all characters after it will be ignored.

+
+ + + + SA-12:02.crypt + CVE-2012-2143 + + + 2012-05-30 + 2012-06-27 + + + + + FreeBSD -- OpenSSL multiple vulnerabilities + + + FreeBSD + 7.47.4_8 + 8.18.1_10 + 8.28.2_8 + 8.38.3_2 + 9.09.0_2 + + + + +

Problem description:

+
+

OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0 + records when operating as a client or a server that accept SSL 3.0 + handshakes. As a result, in each record, up to 15 bytes of uninitialized + memory may be sent, encrypted, to the SSL peer. This could include + sensitive contents of previously freed memory. [CVE-2011-4576]

+

OpenSSL support for handshake restarts for server gated cryptography (SGC) + can be used in a denial-of-service attack. [CVE-2011-4619]

+

If an application uses OpenSSL's certificate policy checking when + verifying X509 certificates, by enabling the X509_V_FLAG_POLICY_CHECK + flag, a policy check failure can lead to a double-free. [CVE-2011-4109]

+

A weakness in the OpenSSL PKCS #7 code can be exploited using + Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the + million message attack (MMA). [CVE-2012-0884]

+

The asn1_d2i_read_bio() function, used by the d2i_*_bio and d2i_*_fp + functions, in OpenSSL contains multiple integer errors that can cause + memory corruption when parsing encoded ASN.1 data. This error can occur + on systems that parse untrusted ASN.1 data, such as X.509 certificates + or RSA public keys. [CVE-2012-2110]

+
+ + + + SA-12:01.openssl + CVE-2011-4576 + CVE-2011-4619 + CVE-2011-4109 + CVE-2012-0884 + CVE-2012-2110 + + + 2012-05-03 + 2012-06-27 + + + pycrypto -- vulnerable ElGamal key generation