Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
FreeBSD
HIGH 7.8
The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size c…
FreeBSD
HIGH 7.8
The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than …
FreeBSD
HIGH 7.1
The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not…
FreeBSD
HIGH 7.0
Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could …
FreeBSD
HIGH 7.8
The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. Du…
FreeBSD
HIGH 7.8
dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition …
FreeBSD
MEDIUM 6.5
sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not inc…
FreeBSD
HIGH 7.8
The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumpti…
FreeBSD
MEDIUM 5.5
When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not ch…
FreeBSD
HIGH 8.4
ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the abil…
FreeBSD
HIGH 7.8
A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread doe…
FreeBSD
HIGH 7.5
When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the…
FreeBSD
MEDIUM 6.5
In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" in…
FreeBSD
MEDIUM 5.5
When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list o…
FreeBSD
HIGH 8.8
libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. Ho…
FreeBSD
HIGH 7.8
The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied li…
FreeBSD
HIGH 8.1
When processing the header of an incoming message, libnv failed to properly validate the message size. The lack of validation allows a malicious pro…
FreeBSD
HIGH 8.1
As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expands the ar…
FreeBSD
HIGH 7.8
When exchanging data over a socket, libnv uses select(2) to wait for data to arrive. However, it does not verify whether the provided socket descrip…
FreeBSD
HIGH 7.5
Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic. Re…
FreeBSD
HIGH 7.8
An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2…
FreeBSD
HIGH 8.1
The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives. …
FreeBSD
HIGH 8.4
The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' sessi…
FreeBSD
MEDIUM 6.2
In order to apply a particular protection key to an address range, the kernel must update the corresponding page table entries. The subroutine which…
FreeBSD
HIGH 7.5
A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address r…
FreeBSD
HIGH 8.8
Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a sta…
FreeBSD
HIGH 7.5
When a challenge ACK is to be sent tcp_respond() constructs and sends the challenge ACK and consumes the mbuf that is passed in. When no challenge A…
FreeBSD
HIGH 7.5
On a system exposing an NVMe/TCP target, a remote client can trigger a kernel panic by sending a CONNECT command for an I/O queue with a bogus or sta…
FreeBSD
HIGH 7.5
Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it receives. Once a certain number of leaked sockets …
FreeBSD
HIGH 7.5
The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddr_stor…