Multiple jail filesystem root escapes

ppp(8): missing length validation in LcpDecodeConfig()

ppp(8): incorrect length calculation in mp_Enddisc()

posixshm: largepage shared memory objects not explicitly wired

Buffer overflow in libalias RTSP handler

Local privilege escalation via execve(2) TOCTOU race

Jail reference count underflow

Use-after-free in device pager page list

select(2) file descriptor set overflow causes stack overflow

Remote code execution via RPCSEC_GSS packet validation

Jail escape by a privileged user via nullfs

Multiple issues in ctl(4) CAM Target Layer

Multiple issues in ctl(4) CAM Target Layer

Multiple issues in ctl(4) CAM Target Layer

Multiple issues in ctl(4) CAM Target Layer

The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents

The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted

The fwctl driver implements a state machine which is executed when a bhyve guest accesses certain x86 I/O ports

In FreeBSD 12.2-STABLE before r365772, 11.4-STABLE before r365773, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p14 a ftpd(8) bug in the implementation…

In FreeBSD 12.0-STABLE before r349628, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349629, 11.3-RC3 before 11.3-RC3-p1, and 11.2-RELEASE before 11.2-RELEASE-p11,…

In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the reference count implementation for UNIX…

Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before…

In FreeBSD 12.2-STABLE before r369334, 11.4-STABLE before r369335, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 when a process, such as jexec(8) or killall(1), calls…

Heap out-of-bounds access in semop(2)

Use-after-free in kqueue copy-on-fork

posixshm: system calls can incorrectly free memory of largepage objects

Use-after-free in TCP RACK stack option handler

Missing validation in ptrace(PT_SC_REMOTE)

Kernel use-after-free bug in the TIOCNOTTY handler

bhyve(8) privileged guest escape via TPM device passthrough

Multiple vulnerabilities in libnv

bhyve(8) privileged guest escape via USB controller

A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow

bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS and VMCB read/write…

Unauthorized credential switching

ktrace(2) privilege incorrectly validated in jails

Heap overflow in libnv

Remotely triggerable out-of-bounds heap write in dhclient

Remote code execution via malicious DHCP options

A signal handler in sshd(8) may call a logging function that is not async-signal-safe

Openssh: regresshion - race condition in ssh allows rce/dos

In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE…

In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the…

The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and…

The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element…

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT)…

In FreeBSD through 11.1, the smb_strdupin function in sys/netsmb/smb_subr.c has a race condition with a resultant out-of-bounds read, because it can cause t2p->t_name strings to…

Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5…

TOCTOU race in POSIX shared memory large page configuration

ppp(8): missing length validation in mp_SetEnddisc()