The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents

The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted

The fwctl driver implements a state machine which is executed when a bhyve guest accesses certain x86 I/O ports

In FreeBSD 12.2-STABLE before r365772, 11.4-STABLE before r365773, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p14 a ftpd(8) bug in the implementation…

In FreeBSD 12.0-STABLE before r349628, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349629, 11.3-RC3 before 11.3-RC3-p1, and 11.2-RELEASE before 11.2-RELEASE-p11,…

In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the reference count implementation for UNIX…

Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before…

In FreeBSD 12.2-STABLE before r369334, 11.4-STABLE before r369335, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 when a process, such as jexec(8) or killall(1), calls…

Heap out-of-bounds access in semop(2)

Use-after-free in kqueue copy-on-fork

posixshm: system calls can incorrectly free memory of largepage objects

Use-after-free in TCP RACK stack option handler

Missing validation in ptrace(PT_SC_REMOTE)

Kernel use-after-free bug in the TIOCNOTTY handler

bhyve(8) privileged guest escape via TPM device passthrough

Multiple vulnerabilities in libnv

bhyve(8) privileged guest escape via USB controller

A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow

bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS and VMCB read/write…

Unauthorized credential switching

ktrace(2) privilege incorrectly validated in jails

Heap overflow in libnv

Remotely triggerable out-of-bounds heap write in dhclient

Remote code execution via malicious DHCP options

A signal handler in sshd(8) may call a logging function that is not async-signal-safe

Openssh: regresshion - race condition in ssh allows rce/dos

In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE…

In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the…

The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and…

The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element…

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT)…

In FreeBSD through 11.1, the smb_strdupin function in sys/netsmb/smb_subr.c has a race condition with a resultant out-of-bounds read, because it can cause t2p->t_name strings to…

Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5…

TOCTOU race in POSIX shared memory large page configuration

ppp(8): missing length validation in mp_SetEnddisc()

Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl

Use-after-free in unix SOCK_STREAM message handling

hwpmc fails to detach PMCs during exec credential transitions

Heap out-of-bounds access in semctl(2)

Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl

Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl

Integer overflow in vt(4) CONS_HISTORY ioctl

ASLR bypass for setuid executables via procctl(2)

Use-after-free bug in the IPV6_MSFILTER socket option handler

Multiple vulnerabilities in the sound(4) mmap path

Arbitrary file overwrite via the KTLS receive path

Kernel use-after-free via file descriptor syscalls

Stack buffer overflow via setcred(2)

Stack overflow via select() file descriptor set overflow

Local privilege escalation via execve()