OpenBSD 7.3 Errata 002

CPE Details

OpenBSD 7.3 Errata 002
openbsd
openbsd
7.3
2023-11-24
16h22 +00:00
2023-11-24
16h22 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:o:openbsd:openbsd:7.3:errata_002:*:*:*:*:*:*

Informations

Vendor

openbsd

Product

openbsd

Version

7.3

Update

errata_002

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2023-38283 2023-08-28 22h00 +00:00 In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.
5.3
Medium
CVE-2023-40216 2023-08-09 22h00 +00:00 OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences.
5.5
Medium
CVE-2023-35784 2023-06-15 22h00 +00:00 A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.
9.8
Critical
CVE-2007-4305 2007-08-13 19h00 +00:00 Multiple race conditions in the (1) Sudo monitor mode and (2) Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system call interposition, and consequently bypass access control policy and auditing.
6.2
CVE-2006-6730 2006-12-26 22h00 +00:00 OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by replacing the System Management Mode (SMM) handler via a write to an SMRAM address within /dev/xf86 (aka the video card memory-mapped I/O range), and then launching the new handler via a System Management Interrupt (SMI), as demonstrated by a write to Programmed I/O port 0xB2.
6.6
CVE-2006-6397 2006-12-08 00h00 +00:00 Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal operations. This issue is not a vulnerability
4.4
CVE-2004-0492 2004-06-23 02h00 +00:00 Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
10
CVE-2004-0414 2004-06-11 02h00 +00:00 CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.
10
CVE-2004-0416 2004-06-11 02h00 +00:00 Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.
10
CVE-2004-0417 2004-06-11 02h00 +00:00 Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.
5
CVE-2004-0418 2004-06-11 02h00 +00:00 serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.
10
CVE-2002-0381 2003-04-02 03h00 +00:00 The TCP implementation in various BSD operating systems (tcp_input.c) does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address.
5
CVE-2002-0701 2003-04-02 03h00 +00:00 ktrace in BSD-based operating systems allows the owner of a process with special privileges to trace the process after its privileges have been lowered, which may allow the owner to obtain sensitive information that the process obtained while it was running with the extra privileges.
2.1
CVE-2001-0670 2002-03-09 04h00 +00:00 Buffer overflow in BSD line printer daemon (in.lpd or lpd) in various BSD-based operating systems allows remote attackers to execute arbitrary code via an incomplete print job followed by a request to display the printer queue.
7.5
CVE-1999-1225 2001-09-12 02h00 +00:00 rpc.mountd on Linux, Ultrix, and possibly other operating systems, allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists or not.
5
CVE-2000-0995 2001-01-22 04h00 +00:00 Format string vulnerability in OpenBSD yp_passwd program (and possibly other BSD-based operating systems) allows attackers to gain root privileges a malformed name.
7.2
CVE-2000-0996 2001-01-22 04h00 +00:00 Format string vulnerability in OpenBSD su program (and possibly other BSD-based operating systems) allows local attackers to gain root privileges via a malformed shell.
7.2
CVE-1999-0482 1999-09-29 02h00 +00:00 OpenBSD kernel crash through TSS handling, as caused by the crashme program.
5
CVE-1999-0483 1999-09-29 02h00 +00:00 OpenBSD crash using nlink value in FFS and EXT2FS filesystems.
2.1
CVE-1999-0484 1999-09-29 02h00 +00:00 Buffer overflow in OpenBSD ping.
2.1