openbsd CVEs | Waratek

Look up CVE IDs Status Exploitation Severity

Reset

Overview 201 matches · 0 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 44 public PoC · 4 EPSS ≥ 0.5

201matches 0in Waratek scope0.0% 0protected0.0% 2exploited1.0% 0CISA KEV0.0% 44public PoC21.9% 4EPSS ≥ 0.52.0%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 0.5% Not applicable 200 99.5% Withdrawn CVE 0 0.0%

Critical 10 5.0% High 85 42.3% Medium 89 44.3% Low 17 8.5% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 201 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 2 1.0% Working exploit published 41 20.4% Proof of concept only 2 1.0% Forecast only 1 0.5% No public exploit 155 77.1%

split by StatusSeverityProtectionExploit maturity peak 29 / year

1999200220052008201120142017202020232026

201 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2004-0687	High	2004-10-20	Not applicable	No public exploit	Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) ParsePixels in parse.c for libXpm before 6.8.1 allow remote attackers to execute arbitrary code via a malformed XPM image file.
CVE-2004-0819	Medium	2004-08-25	Not applicable	No public exploit	The bridge functionality in OpenBSD 3.4 and 3.5, when running a gateway configured as a bridging firewall with the link2 option for IPSec enabled, allows remote attackers to cause a denial of service (crash) via an ICMP echo (ping) packet.
CVE-2004-0492	High	2004-08-06	Not applicable	No public exploit	Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
CVE-2004-0418	High	2004-08-06	Not applicable	No public exploit	serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.
CVE-2004-0417	Medium	2004-08-06	Not applicable	No public exploit	Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.
CVE-2004-0416	High	2004-08-06	Not applicable	Working exploit published	Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.
CVE-2004-0414	High	2004-08-06	Not applicable	No public exploit	CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.
CVE-2004-0482	Medium	2004-07-07	Not applicable	No public exploit	Multiple integer overflows in (1) procfs_cmdline.c, (2) procfs_fpregs.c, (3) procfs_linux.c, (4) procfs_regs.c, (5) procfs_status.c, and (6) procfs_subr.c in procfs for OpenBSD 3.5 and earlier allow local users to read sensitive kernel memory and possibly perform other unauthorized activities.
CVE-2004-0222	Medium	2004-05-04	Not applicable	No public exploit	Multiple memory leaks in isakmpd in OpenBSD 3.4 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via certain ISAKMP packets, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVE-2004-0221	Medium	2004-05-04	Not applicable	No public exploit	isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a delete payload containing a large number of SPIs, which triggers an out-of-bounds read error, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVE-2004-0220	High	2004-05-04	Not applicable	No public exploit	isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service via an ISAKMP packet with a malformed Cert Request payload, which causes an integer underflow that is used in a malloc operation that is not properly handled, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVE-2004-0219	Medium	2004-05-04	Not applicable	No public exploit	isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a malformed IPSEC SA payload, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVE-2004-0218	Medium	2004-05-04	Not applicable	No public exploit	isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (infinite loop) via an ISAKMP packet with a zero-length payload, as demonstrated by the Striker ISAKMP Protocol Test Suite.
CVE-2004-0171	Medium	2004-03-15	Not applicable	No public exploit	FreeBSD 5.1 and earlier, and Mac OS X before 10.3.4, allows remote attackers to cause a denial of service (resource exhaustion of memory buffers and system crash) via a large number of out-of-sequence TCP packets, which prevents the operating system from creating new connections.
CVE-2004-0114	Medium	2004-03-03	Not applicable	Working exploit published	The shmat system call in the System V Shared Memory interface for FreeBSD 5.2 and earlier, NetBSD 1.3 and earlier, and OpenBSD 2.6 and earlier, does not properly decrement a shared memory segment's reference count when the vm_map_find function fails, which could allow local users to gain read or write access to a portion of kernel memory and gain privileges.
CVE-2004-0106	High	2004-03-03	Not applicable	No public exploit	Multiple unknown vulnerabilities in XFree86 4.1.0 to 4.3.0, related to improper handling of font files, a different set of vulnerabilities than CVE-2004-0083 and CVE-2004-0084.
CVE-2004-0084	High	2004-03-03	Not applicable	Working exploit published	Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CVE-2004-0083 and CVE-2004-0106.
CVE-2004-0083	High	2004-03-03	Not applicable	Working exploit published	Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106.
CVE-2004-1082	High	2004-02-03	Not applicable	No public exploit	mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.
CVE-2003-1366	Low	2003-12-31	Not applicable	Working exploit published	chpass in OpenBSD 2.0 through 3.2 allows local users to read portions of arbitrary files via a hard link attack on a temporary file used to store user database information.
CVE-2003-0955	Medium	2003-12-15	Not applicable	Working exploit published	OpenBSD kernel 3.3 and 3.4 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code in 3.4 via a program with an invalid header that is not properly handled by (1) ibcs2_exec.c in the iBCS2 emulation (compat_ibcs2) or (2) exec_elf.c, which leads to a stack-based buffer overflow.
CVE-2003-0804	Medium	2003-11-17	Not applicable	No public exploit	The arplookup function in FreeBSD 5.1 and earlier, Mac OS X before 10.2.8, and possibly other BSD-based systems, allows remote attackers on a local subnet to cause a denial of service (resource starvation and panic) via a flood of spoofed ARP requests.
CVE-2003-0688	Medium	2003-10-20	Not applicable	No public exploit	The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data.
CVE-2003-0681	High	2003-10-06	Not applicable	Exploited	A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences.
CVE-2003-0466	Critical	2003-08-27	Not applicable	Working exploit published	Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.
CVE-2002-1420	High	2003-04-11	Not applicable	No public exploit	Integer signedness error in select() on OpenBSD 3.1 and earlier allows local users to overwrite arbitrary kernel memory via a negative value for the size parameter, which satisfies the boundary check as a signed integer, but is later used as an unsigned integer during a data copying operation.
CVE-2003-0144	High	2003-03-31	Not applicable	Working exploit published	Buffer overflow in the lprm command in the lprold lpr package on SuSE 7.1 through 7.3, OpenBSD 3.2 and earlier, and possibly other operating systems, allows local users to gain root privileges via long command line arguments such as (1) request ID or (2) user name.
CVE-2003-0028	High	2003-03-25	Not applicable	No public exploit	Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.
CVE-2003-0078	Medium	2003-03-03	Not applicable	Working exploit published	ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack."
CVE-2002-2280	Low	2002-12-31	Not applicable	No public exploit	syslogd on OpenBSD 2.9 through 3.2 does not change the source IP address of syslog packets when the machine's IP addressed is changed without rebooting, e.g. via ifconfig, which can cause incorrect information to be sent to the syslog server.
CVE-2002-2222	Medium	2002-12-31	Not applicable	No public exploit	isakmpd/message.c in isakmpd in FreeBSD before isakmpd-20020403_1, and in OpenBSD 3.1, allows remote attackers to cause a denial of service (crash) by sending Internet Key Exchange (IKE) payloads out of sequence.
CVE-2002-2188	Medium	2002-12-31	Not applicable	No public exploit	OpenBSD before 3.2 allows local users to cause a denial of service (kernel crash) via a call to getrlimit(2) with invalid arguments, possibly due to an integer signedness error.
CVE-2002-2180	Medium	2002-12-31	Not applicable	No public exploit	The setitimer(2) system call in OpenBSD 2.0 through 3.1 does not properly check certain arguments, which allows local users to write to kernel memory and possibly gain root privileges, possibly via an integer signedness error.
CVE-2002-2092	Low	2002-12-31	Not applicable	No public exploit	Race condition in exec in OpenBSD 4.0 and earlier, NetBSD 1.5.2 and earlier, and FreeBSD 4.4 and earlier allows local users to gain privileges by attaching a debugger to a process before the kernel has determined that the process is setuid or setgid.
CVE-2002-1915	Medium	2002-12-31	Not applicable	No public exploit	tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.
CVE-2002-1345	Medium	2002-12-23	Not applicable	No public exploit	Directory traversal vulnerabilities in multiple FTP clients on UNIX systems allow remote malicious FTP servers to create or overwrite files as the client user via filenames containing /absolute/path or .. (dot dot) sequences.
CVE-2002-1221	Medium	2002-11-29	Not applicable	No public exploit	BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference.
CVE-2002-1220	Medium	2002-11-29	Not applicable	Working exploit published	BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size.
CVE-2002-1219	High	2002-11-29	Not applicable	No public exploit	Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR).
CVE-2002-0766	High	2002-08-12	Not applicable	No public exploit	OpenBSD 2.9 through 3.1 allows local users to cause a denial of service (resource exhaustion) and gain root privileges by filling the kernel's file descriptor table and closing file descriptors 0, 1, or 2 before executing a privileged process, which is not properly handled when OpenBSD fails to open an alternate descriptor.
CVE-2002-0765	High	2002-08-12	Not applicable	No public exploit	sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password.
CVE-2002-0514	Medium	2002-08-12	Not applicable	No public exploit	PF in OpenBSD 3.0 with the return-rst rule sets the TTL to 128 in the RST packet, which allows remote attackers to determine if a port is being filtered because the TTL is different than the default TTL.
CVE-2002-0414	High	2002-08-12	Not applicable	No public exploit	KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems, does not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets.
CVE-2002-0391	Critical	2002-08-12	Not applicable	Forecast only	Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.
CVE-2000-1208	High	2002-08-12	Not applicable	No public exploit	Format string vulnerability in startprinting() function of printjob.c in BSD-based lpr lpd package may allow local users to gain privileges via an improper syslog call that uses format strings from the checkremote() call.
CVE-2002-0701	Low	2002-07-23	Not applicable	No public exploit	ktrace in BSD-based operating systems allows the owner of a process with special privileges to trace the process after its privileges have been lowered, which may allow the owner to obtain sensitive information that the process obtained while it was running with the extra privileges.
CVE-2002-0572	High	2002-07-03	Not applicable	Working exploit published	FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, allows local users to write to or read from restricted files by closing the file descriptors 0 (standard input), 1 (standard output), or 2 (standard error), which may then be reused by a called setuid process that intended to perform I/O on normal files.
CVE-2002-0557	High	2002-07-03	Not applicable	No public exploit	Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes (1) rexec or (2) rsh to run another user's shell, or (3) atrun to change to a different user's directory, possibly due to memory allocation failures or an incorrect call to auth_approval().
CVE-2002-0542	High	2002-07-03	Not applicable	Working exploit published	mail in OpenBSD 2.9 and 3.0 processes a tilde (~) escape character in a message even when it is not in interactive mode, which could allow local users to gain root privileges via calls to mail in cron.
CVE-2002-0381	Medium	2002-06-25	Not applicable	No public exploit	The TCP implementation in various BSD operating systems (tcp_input.c) does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address.
CVE-2001-1559	Medium	2001-12-31	Not applicable	Working exploit published	The uipc system calls (uipc_syscalls.c) in OpenBSD 2.9 and 3.0 provide user mode return instead of versus rval kernel mode values to the fdrelease function, which allows local users to cause a denial of service and trigger a null dereference.
CVE-2001-1415	Medium	2001-11-13	Not applicable	No public exploit	vi.recover in OpenBSD before 3.1 allows local users to remove arbitrary zero-byte files such as device nodes.
CVE-2001-0670	High	2001-10-03	Not applicable	No public exploit	Buffer overflow in BSD line printer daemon (in.lpd or lpd) in various BSD-based operating systems allows remote attackers to execute arbitrary code via an incomplete print job followed by a request to display the printer queue.
CVE-2001-1145	Medium	2001-08-17	Not applicable	No public exploit	fts routines in FreeBSD 4.3 and earlier, NetBSD before 1.5.2, and OpenBSD 2.9 and earlier can be forced to change (chdir) into a different directory than intended when the directory above the current directory is moved, which could cause scripts to perform dangerous actions on the wrong directories.
CVE-2001-0554	High	2001-08-14	Not applicable	Exploited	Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.
CVE-2001-1244	Medium	2001-07-07	Not applicable	Working exploit published	Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum segment size (MSS) to a very small number and requesting large amounts of data, which generates more packets with less TCP-level data that amplify network traffic and consume more server CPU to process.
CVE-2001-0378	Low	2001-06-27	Not applicable	No public exploit	readline prior to 4.1, in OpenBSD 2.8 and earlier, creates history files with insecure permissions, which allows a local attacker to recover potentially sensitive information via readline history files.
CVE-2001-0402	High	2001-06-18	Not applicable	Working exploit published	IPFilter 3.4.16 and earlier does not include sufficient session information in its cache, which allows remote attackers to bypass access restrictions by sending fragmented packets to a restricted port after sending unfragmented packets to an unrestricted port.
CVE-2001-0247	High	2001-06-18	Not applicable	Working exploit published	Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3.
CVE-2001-1047	Low	2001-06-02	Not applicable	No public exploit	Race condition in OpenBSD VFS allows local users to cause a denial of service (kernel panic) by (1) creating a pipe in one thread and causing another thread to set one of the file descriptors to NULL via a close, or (2) calling dup2 on a file descriptor in one process, then setting the descriptor to NULL via a close in another process that is created via rfork.
CVE-2001-0284	High	2001-05-03	Not applicable	No public exploit	Buffer overflow in IPSEC authentication mechanism for OpenBSD 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a malformed Authentication header (AH) IPv4 option.
CVE-2001-0268	High	2001-05-03	Not applicable	No public exploit	The i386_set_ldt system call in NetBSD 1.5 and earlier, and OpenBSD 2.8 and earlier, when the USER_LDT kernel option is enabled, does not validate a call gate target, which allows local users to gain root privileges by creating a segment call gate in the Local Descriptor Table (LDT) with a target that specifies an arbitrary kernel address.
CVE-2000-0313	Medium	2001-03-12	Not applicable	No public exploit	Vulnerability in OpenBSD 2.6 allows a local user to change interface media configurations.
CVE-2000-0312	High	2001-03-12	Not applicable	No public exploit	cron in OpenBSD 2.5 allows local users to gain root privileges via an argv[] that is not NULL terminated, which is passed to cron's fake popen function.
CVE-2000-0310	Medium	2001-03-12	Not applicable	No public exploit	IP fragment assembly in OpenBSD 2.4 allows a remote attacker to cause a denial of service by sending a large number of fragmented packets.
CVE-2000-0309	Low	2001-03-12	Not applicable	No public exploit	The i386 trace-trap handling in OpenBSD 2.4 with DDB enabled allows a local user to cause a denial of service.
CVE-2001-0053	High	2001-02-12	Not applicable	Working exploit published	One-byte buffer overflow in replydirname function in BSD-based ftpd allows remote attackers to gain root privileges.
CVE-2000-0997	High	2000-12-19	Not applicable	No public exploit	Format string vulnerabilities in eeprom program in OpenBSD, NetBSD, and possibly other operating systems allows local attackers to gain root privileges.
CVE-2000-0996	High	2000-12-19	Not applicable	No public exploit	Format string vulnerability in OpenBSD su program (and possibly other BSD-based operating systems) allows local attackers to gain root privileges via a malformed shell.
CVE-2000-0995	High	2000-12-19	Not applicable	No public exploit	Format string vulnerability in OpenBSD yp_passwd program (and possibly other BSD-based operating systems) allows attackers to gain root privileges a malformed name.
CVE-2000-0994	High	2000-12-19	Not applicable	Working exploit published	Format string vulnerability in OpenBSD fstat program (and possibly other BSD-based operating systems) allows local users to gain root privileges via the PWD environmental variable.
CVE-2000-0993	High	2000-12-19	Not applicable	Working exploit published	Format string vulnerability in pw_error function in BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd.
CVE-2000-0962	Medium	2000-12-19	Not applicable	No public exploit	The IPSEC implementation in OpenBSD 2.7 does not properly handle empty AH/ESP packets, which allows remote attackers to cause a denial of service.
CVE-2000-0914	Medium	2000-12-19	Not applicable	Working exploit published	OpenBSD 2.6 and earlier allows remote attackers to cause a denial of service by flooding the server with ARP requests.
CVE-2000-1010	High	2000-12-11	Not applicable	No public exploit	Format string vulnerability in talkd in OpenBSD and possibly other BSD-based OSes allows remote attackers to execute arbitrary commands via a user name that contains format characters.
CVE-2000-1004	Medium	2000-12-11	Not applicable	No public exploit	Format string vulnerability in OpenBSD photurisd allows local users to execute arbitrary commands via a configuration file directory name that contains formatting characters.
CVE-2000-0751	High	2000-10-20	Not applicable	Working exploit published	mopd (Maintenance Operations Protocol loader daemon) does not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands.
CVE-2000-0750	High	2000-10-20	Not applicable	No public exploit	Buffer overflow in mopd (Maintenance Operations Protocol loader daemon) allows remote attackers to execute arbitrary commands via a long file name.
CVE-2000-0092	Medium	2000-01-19	Not applicable	No public exploit	The BSD make program allows local users to modify files via a symlink attack when the -j option is being used.
CVE-1999-0001	Medium	1999-12-30	Not applicable	No public exploit	ip_input.c in BSD-derived TCP/IP implementations allows remote attackers to cause a denial of service (crash or hang) via crafted packets.
CVE-2000-0489	Low	1999-09-05	Not applicable	Working exploit published	FreeBSD, NetBSD, and OpenBSD allow an attacker to cause a denial of service by creating a large number of socket pairs using the socketpair function, setting a large buffer size via setsockopt, then writing large buffers.
CVE-1999-0724	Medium	1999-08-12	Not applicable	No public exploit	Buffer overflow in OpenBSD procfs and fdescfs file systems via uio_offset in the readdir() function.
CVE-1999-0674	High	1999-08-09	Not applicable	Working exploit published	The BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve.
CVE-1999-0727	Medium	1999-08-06	Not applicable	No public exploit	A kernel leak in the OpenBSD kernel allows IPsec packets to be sent unencrypted.
CVE-1999-0703	Low	1999-08-03	Not applicable	No public exploit	OpenBSD, BSDI, and other Unix operating systems allow users to set chflags and fchflags on character and block devices.
CVE-1999-0481	Medium	1999-03-22	Not applicable	No public exploit	Denial of service in "poll" in OpenBSD.
CVE-1999-0482	Medium	1999-03-21	Not applicable	No public exploit	OpenBSD kernel crash through TSS handling, as caused by the crashme program.
CVE-1999-0483	Low	1999-02-25	Not applicable	No public exploit	OpenBSD crash using nlink value in FFS and EXT2FS filesystems.
CVE-1999-0484	Low	1999-02-23	Not applicable	No public exploit	Buffer overflow in OpenBSD ping.
CVE-1999-0485	Low	1999-02-19	Not applicable	No public exploit	Remote attackers can cause a system crash through ipintr() in ipq in OpenBSD.
CVE-1999-0396	Low	1999-02-17	Not applicable	No public exploit	A race condition between the select() and accept() calls in NetBSD TCP servers allows remote attackers to cause a denial of service.
CVE-1999-0798	High	1998-12-04	Not applicable	No public exploit	Buffer overflow in bootpd on OpenBSD, FreeBSD, and Linux systems via a malformed header type.
CVE-1999-0052	High	1998-11-04	Not applicable	No public exploit	IP fragmentation denial of service in FreeBSD allows a remote attacker to cause a crash.
CVE-1999-0062	High	1998-08-03	Not applicable	No public exploit	The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage.
CVE-1999-0303	Medium	1998-05-21	Not applicable	No public exploit	Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames.
CVE-1999-0323	High	1998-02-20	Not applicable	No public exploit	FreeBSD mmap function allows users to modify append-only or immutable files.
CVE-1999-0305	Medium	1998-02-01	Not applicable	No public exploit	The system configuration control (sysctl) facility in BSD based operating systems OpenBSD 2.2 and earlier, and FreeBSD 2.2.5 and earlier, does not properly restrict source routed packets even when the (1) dosourceroute or (2) forwarding variables are set, which allows remote attackers to spoof TCP connections.
CVE-1999-0304	High	1998-02-01	Not applicable	No public exploit	mmap function in BSD allows local attackers in the kmem group to modify memory through devices.
CVE-1999-0061	Medium	1997-10-02	Not applicable	No public exploit	File creation and deletion, and remote execution, in the BSD line printer daemon (lpd).
CVE-1999-1214	Low	1997-09-15	Not applicable	No public exploit	The asynchronous I/O facility in 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification, which allows local users to cause a denial of service by using certain ioctl and fcntl calls to cause the signal to be sent to an arbitrary process ID.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2004-0687

High

2004-10-20

Not applicable

No public exploit

Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) ParsePixels in parse.c for libXpm before 6.8.1 allow remote attackers to execute arbitrary code via a malformed XPM image file.

CVE-2004-0819

Medium

2004-08-25

Not applicable

No public exploit

The bridge functionality in OpenBSD 3.4 and 3.5, when running a gateway configured as a bridging firewall with the link2 option for IPSec enabled, allows remote attackers to cause a denial of service (crash) via an ICMP echo (ping) packet.

CVE-2004-0492

High

2004-08-06

Not applicable

No public exploit

Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.

CVE-2004-0418

High

2004-08-06

Not applicable

No public exploit

serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.

CVE-2004-0417

Medium

2004-08-06

Not applicable

No public exploit

Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.

CVE-2004-0416

High

2004-08-06

Not applicable

Working exploit published

Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.

CVE-2004-0414

High

2004-08-06

Not applicable

No public exploit

CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.

CVE-2004-0482

Medium

2004-07-07

Not applicable

No public exploit

Multiple integer overflows in (1) procfs_cmdline.c, (2) procfs_fpregs.c, (3) procfs_linux.c, (4) procfs_regs.c, (5) procfs_status.c, and (6) procfs_subr.c in procfs for OpenBSD 3.5 and earlier allow local users to read sensitive kernel memory and possibly perform other unauthorized activities.

CVE-2004-0222

Medium

2004-05-04

Not applicable

No public exploit

Multiple memory leaks in isakmpd in OpenBSD 3.4 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via certain ISAKMP packets, as demonstrated by the Striker ISAKMP Protocol Test Suite.

CVE-2004-0221

Medium

2004-05-04

Not applicable

No public exploit

isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a delete payload containing a large number of SPIs, which triggers an out-of-bounds read error, as demonstrated by the Striker ISAKMP Protocol Test Suite.

CVE-2004-0220

High

2004-05-04

Not applicable

No public exploit

isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service via an ISAKMP packet with a malformed Cert Request payload, which causes an integer underflow that is used in a malloc operation that is not properly handled, as demonstrated by the Striker ISAKMP Protocol Test Suite.

CVE-2004-0219

Medium

2004-05-04

Not applicable

No public exploit

isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a malformed IPSEC SA payload, as demonstrated by the Striker ISAKMP Protocol Test Suite.

CVE-2004-0218

Medium

2004-05-04

Not applicable

No public exploit

isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (infinite loop) via an ISAKMP packet with a zero-length payload, as demonstrated by the Striker ISAKMP Protocol Test Suite.

CVE-2004-0171

Medium

2004-03-15

Not applicable

No public exploit

FreeBSD 5.1 and earlier, and Mac OS X before 10.3.4, allows remote attackers to cause a denial of service (resource exhaustion of memory buffers and system crash) via a large number of out-of-sequence TCP packets, which prevents the operating system from creating new connections.

CVE-2004-0114

Medium

2004-03-03

Not applicable

Working exploit published

The shmat system call in the System V Shared Memory interface for FreeBSD 5.2 and earlier, NetBSD 1.3 and earlier, and OpenBSD 2.6 and earlier, does not properly decrement a shared memory segment's reference count when the vm_map_find function fails, which could allow local users to gain read or write access to a portion of kernel memory and gain privileges.

CVE-2004-0106

High

2004-03-03

Not applicable

No public exploit

Multiple unknown vulnerabilities in XFree86 4.1.0 to 4.3.0, related to improper handling of font files, a different set of vulnerabilities than CVE-2004-0083 and CVE-2004-0084.

CVE-2004-0084

High

2004-03-03

Not applicable

Working exploit published

Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CVE-2004-0083 and CVE-2004-0106.

CVE-2004-0083

High

2004-03-03

Not applicable

Working exploit published

Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106.

CVE-2004-1082

High

2004-02-03

Not applicable

No public exploit

mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.

CVE-2003-1366

Low

2003-12-31

Not applicable

Working exploit published

chpass in OpenBSD 2.0 through 3.2 allows local users to read portions of arbitrary files via a hard link attack on a temporary file used to store user database information.

CVE-2003-0955

Medium

2003-12-15

Not applicable

Working exploit published

OpenBSD kernel 3.3 and 3.4 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code in 3.4 via a program with an invalid header that is not properly handled by (1) ibcs2_exec.c in the iBCS2 emulation (compat_ibcs2) or (2) exec_elf.c, which leads to a stack-based buffer overflow.

CVE-2003-0804

Medium

2003-11-17

Not applicable

No public exploit

The arplookup function in FreeBSD 5.1 and earlier, Mac OS X before 10.2.8, and possibly other BSD-based systems, allows remote attackers on a local subnet to cause a denial of service (resource starvation and panic) via a flood of spoofed ARP requests.

CVE-2003-0688

Medium

2003-10-20

Not applicable

No public exploit

The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data.

CVE-2003-0681

High

2003-10-06

Not applicable

Exploited

A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences.

CVE-2003-0466

Critical

2003-08-27

Not applicable

Working exploit published

Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.

CVE-2002-1420

High

2003-04-11

Not applicable

No public exploit

Integer signedness error in select() on OpenBSD 3.1 and earlier allows local users to overwrite arbitrary kernel memory via a negative value for the size parameter, which satisfies the boundary check as a signed integer, but is later used as an unsigned integer during a data copying operation.

CVE-2003-0144

High

2003-03-31

Not applicable

Working exploit published

Buffer overflow in the lprm command in the lprold lpr package on SuSE 7.1 through 7.3, OpenBSD 3.2 and earlier, and possibly other operating systems, allows local users to gain root privileges via long command line arguments such as (1) request ID or (2) user name.

CVE-2003-0028

High

2003-03-25

Not applicable

No public exploit

Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.

CVE-2003-0078

Medium

2003-03-03

Not applicable

Working exploit published

ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack."

CVE-2002-2280

Low

2002-12-31

Not applicable

No public exploit

syslogd on OpenBSD 2.9 through 3.2 does not change the source IP address of syslog packets when the machine's IP addressed is changed without rebooting, e.g. via ifconfig, which can cause incorrect information to be sent to the syslog server.

CVE-2002-2222

Medium

2002-12-31

Not applicable

No public exploit

isakmpd/message.c in isakmpd in FreeBSD before isakmpd-20020403_1, and in OpenBSD 3.1, allows remote attackers to cause a denial of service (crash) by sending Internet Key Exchange (IKE) payloads out of sequence.

CVE-2002-2188

Medium

2002-12-31

Not applicable

No public exploit

OpenBSD before 3.2 allows local users to cause a denial of service (kernel crash) via a call to getrlimit(2) with invalid arguments, possibly due to an integer signedness error.

CVE-2002-2180

Medium

2002-12-31

Not applicable

No public exploit

The setitimer(2) system call in OpenBSD 2.0 through 3.1 does not properly check certain arguments, which allows local users to write to kernel memory and possibly gain root privileges, possibly via an integer signedness error.

CVE-2002-2092

Low

2002-12-31

Not applicable

No public exploit

Race condition in exec in OpenBSD 4.0 and earlier, NetBSD 1.5.2 and earlier, and FreeBSD 4.4 and earlier allows local users to gain privileges by attaching a debugger to a process before the kernel has determined that the process is setuid or setgid.

CVE-2002-1915

Medium

2002-12-31

Not applicable

No public exploit

tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file.

CVE-2002-1345

Medium

2002-12-23

Not applicable

No public exploit

Directory traversal vulnerabilities in multiple FTP clients on UNIX systems allow remote malicious FTP servers to create or overwrite files as the client user via filenames containing /absolute/path or .. (dot dot) sequences.

CVE-2002-1221

Medium

2002-11-29

Not applicable

No public exploit

BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference.

CVE-2002-1220

Medium

2002-11-29

Not applicable

Working exploit published

BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size.

CVE-2002-1219

High

2002-11-29

Not applicable

No public exploit

Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR).

CVE-2002-0766

High

2002-08-12

Not applicable

No public exploit

OpenBSD 2.9 through 3.1 allows local users to cause a denial of service (resource exhaustion) and gain root privileges by filling the kernel's file descriptor table and closing file descriptors 0, 1, or 2 before executing a privileged process, which is not properly handled when OpenBSD fails to open an alternate descriptor.

CVE-2002-0765

High

2002-08-12

Not applicable

No public exploit

sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password.

CVE-2002-0514

Medium

2002-08-12

Not applicable

No public exploit

PF in OpenBSD 3.0 with the return-rst rule sets the TTL to 128 in the RST packet, which allows remote attackers to determine if a port is being filtered because the TTL is different than the default TTL.

CVE-2002-0414

High

2002-08-12

Not applicable

No public exploit

KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems, does not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets.

CVE-2002-0391

Critical

2002-08-12

Not applicable

Forecast only

Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.

CVE-2000-1208

High

2002-08-12

Not applicable

No public exploit

Format string vulnerability in startprinting() function of printjob.c in BSD-based lpr lpd package may allow local users to gain privileges via an improper syslog call that uses format strings from the checkremote() call.

CVE-2002-0701

Low

2002-07-23

Not applicable

No public exploit

ktrace in BSD-based operating systems allows the owner of a process with special privileges to trace the process after its privileges have been lowered, which may allow the owner to obtain sensitive information that the process obtained while it was running with the extra privileges.

CVE-2002-0572

High

2002-07-03

Not applicable

Working exploit published

FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, allows local users to write to or read from restricted files by closing the file descriptors 0 (standard input), 1 (standard output), or 2 (standard error), which may then be reused by a called setuid process that intended to perform I/O on normal files.

CVE-2002-0557

High

2002-07-03

Not applicable

No public exploit

Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes (1) rexec or (2) rsh to run another user's shell, or (3) atrun to change to a different user's directory, possibly due to memory allocation failures or an incorrect call to auth_approval().

CVE-2002-0542

High

2002-07-03

Not applicable

Working exploit published

mail in OpenBSD 2.9 and 3.0 processes a tilde (~) escape character in a message even when it is not in interactive mode, which could allow local users to gain root privileges via calls to mail in cron.

CVE-2002-0381

Medium

2002-06-25

Not applicable

No public exploit

The TCP implementation in various BSD operating systems (tcp_input.c) does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address.

CVE-2001-1559

Medium

2001-12-31

Not applicable

Working exploit published

The uipc system calls (uipc_syscalls.c) in OpenBSD 2.9 and 3.0 provide user mode return instead of versus rval kernel mode values to the fdrelease function, which allows local users to cause a denial of service and trigger a null dereference.

CVE-2001-1415

Medium

2001-11-13

Not applicable

No public exploit

vi.recover in OpenBSD before 3.1 allows local users to remove arbitrary zero-byte files such as device nodes.

CVE-2001-0670

High

2001-10-03

Not applicable

No public exploit

Buffer overflow in BSD line printer daemon (in.lpd or lpd) in various BSD-based operating systems allows remote attackers to execute arbitrary code via an incomplete print job followed by a request to display the printer queue.

CVE-2001-1145

Medium

2001-08-17

Not applicable

No public exploit

fts routines in FreeBSD 4.3 and earlier, NetBSD before 1.5.2, and OpenBSD 2.9 and earlier can be forced to change (chdir) into a different directory than intended when the directory above the current directory is moved, which could cause scripts to perform dangerous actions on the wrong directories.

CVE-2001-0554

High

2001-08-14

Not applicable

Exploited

Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.

CVE-2001-1244

Medium

2001-07-07

Not applicable

Working exploit published

Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum segment size (MSS) to a very small number and requesting large amounts of data, which generates more packets with less TCP-level data that amplify network traffic and consume more server CPU to process.

CVE-2001-0378

Low

2001-06-27

Not applicable

No public exploit

readline prior to 4.1, in OpenBSD 2.8 and earlier, creates history files with insecure permissions, which allows a local attacker to recover potentially sensitive information via readline history files.

CVE-2001-0402

High

2001-06-18

Not applicable

Working exploit published

IPFilter 3.4.16 and earlier does not include sufficient session information in its cache, which allows remote attackers to bypass access restrictions by sending fragmented packets to a restricted port after sending unfragmented packets to an unrestricted port.

CVE-2001-0247

High

2001-06-18

Not applicable

Working exploit published

Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3.

CVE-2001-1047

Low

2001-06-02

Not applicable

No public exploit

Race condition in OpenBSD VFS allows local users to cause a denial of service (kernel panic) by (1) creating a pipe in one thread and causing another thread to set one of the file descriptors to NULL via a close, or (2) calling dup2 on a file descriptor in one process, then setting the descriptor to NULL via a close in another process that is created via rfork.

CVE-2001-0284

High

2001-05-03

Not applicable

No public exploit

Buffer overflow in IPSEC authentication mechanism for OpenBSD 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a malformed Authentication header (AH) IPv4 option.

CVE-2001-0268

High

2001-05-03

Not applicable

No public exploit

The i386_set_ldt system call in NetBSD 1.5 and earlier, and OpenBSD 2.8 and earlier, when the USER_LDT kernel option is enabled, does not validate a call gate target, which allows local users to gain root privileges by creating a segment call gate in the Local Descriptor Table (LDT) with a target that specifies an arbitrary kernel address.

CVE-2000-0313

Medium

2001-03-12

Not applicable

No public exploit

Vulnerability in OpenBSD 2.6 allows a local user to change interface media configurations.

CVE-2000-0312

High

2001-03-12

Not applicable

No public exploit

cron in OpenBSD 2.5 allows local users to gain root privileges via an argv[] that is not NULL terminated, which is passed to cron's fake popen function.

CVE-2000-0310

Medium

2001-03-12

Not applicable

No public exploit

IP fragment assembly in OpenBSD 2.4 allows a remote attacker to cause a denial of service by sending a large number of fragmented packets.

CVE-2000-0309

Low

2001-03-12

Not applicable

No public exploit

The i386 trace-trap handling in OpenBSD 2.4 with DDB enabled allows a local user to cause a denial of service.

CVE-2001-0053

High

2001-02-12

Not applicable

Working exploit published

One-byte buffer overflow in replydirname function in BSD-based ftpd allows remote attackers to gain root privileges.

CVE-2000-0997

High

2000-12-19

Not applicable

No public exploit

Format string vulnerabilities in eeprom program in OpenBSD, NetBSD, and possibly other operating systems allows local attackers to gain root privileges.

CVE-2000-0996

High

2000-12-19

Not applicable

No public exploit

Format string vulnerability in OpenBSD su program (and possibly other BSD-based operating systems) allows local attackers to gain root privileges via a malformed shell.

CVE-2000-0995

High

2000-12-19

Not applicable

No public exploit

Format string vulnerability in OpenBSD yp_passwd program (and possibly other BSD-based operating systems) allows attackers to gain root privileges a malformed name.

CVE-2000-0994

High

2000-12-19

Not applicable

Working exploit published

Format string vulnerability in OpenBSD fstat program (and possibly other BSD-based operating systems) allows local users to gain root privileges via the PWD environmental variable.

CVE-2000-0993

High

2000-12-19

Not applicable

Working exploit published

Format string vulnerability in pw_error function in BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd.

CVE-2000-0962

Medium

2000-12-19

Not applicable

No public exploit

The IPSEC implementation in OpenBSD 2.7 does not properly handle empty AH/ESP packets, which allows remote attackers to cause a denial of service.

CVE-2000-0914

Medium

2000-12-19

Not applicable

Working exploit published

OpenBSD 2.6 and earlier allows remote attackers to cause a denial of service by flooding the server with ARP requests.

CVE-2000-1010

High

2000-12-11

Not applicable

No public exploit

Format string vulnerability in talkd in OpenBSD and possibly other BSD-based OSes allows remote attackers to execute arbitrary commands via a user name that contains format characters.

CVE-2000-1004

Medium

2000-12-11

Not applicable

No public exploit

Format string vulnerability in OpenBSD photurisd allows local users to execute arbitrary commands via a configuration file directory name that contains formatting characters.

CVE-2000-0751

High

2000-10-20

Not applicable

Working exploit published

mopd (Maintenance Operations Protocol loader daemon) does not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands.

CVE-2000-0750

High

2000-10-20

Not applicable

No public exploit

Buffer overflow in mopd (Maintenance Operations Protocol loader daemon) allows remote attackers to execute arbitrary commands via a long file name.

CVE-2000-0092

Medium

2000-01-19

Not applicable

No public exploit

The BSD make program allows local users to modify files via a symlink attack when the -j option is being used.

CVE-1999-0001

Medium

1999-12-30

Not applicable

No public exploit

ip_input.c in BSD-derived TCP/IP implementations allows remote attackers to cause a denial of service (crash or hang) via crafted packets.

CVE-2000-0489

Low

1999-09-05

Not applicable

Working exploit published

FreeBSD, NetBSD, and OpenBSD allow an attacker to cause a denial of service by creating a large number of socket pairs using the socketpair function, setting a large buffer size via setsockopt, then writing large buffers.

CVE-1999-0724

Medium

1999-08-12

Not applicable

No public exploit

Buffer overflow in OpenBSD procfs and fdescfs file systems via uio_offset in the readdir() function.

CVE-1999-0674

High

1999-08-09

Not applicable

Working exploit published

The BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve.

CVE-1999-0727

Medium

1999-08-06

Not applicable

No public exploit

A kernel leak in the OpenBSD kernel allows IPsec packets to be sent unencrypted.

CVE-1999-0703

Low

1999-08-03

Not applicable

No public exploit

OpenBSD, BSDI, and other Unix operating systems allow users to set chflags and fchflags on character and block devices.

CVE-1999-0481

Medium

1999-03-22

Not applicable

No public exploit

Denial of service in "poll" in OpenBSD.

CVE-1999-0482

Medium

1999-03-21

Not applicable

No public exploit

OpenBSD kernel crash through TSS handling, as caused by the crashme program.

CVE-1999-0483

Low

1999-02-25

Not applicable

No public exploit

OpenBSD crash using nlink value in FFS and EXT2FS filesystems.

CVE-1999-0484

Low

1999-02-23

Not applicable

No public exploit

Buffer overflow in OpenBSD ping.

CVE-1999-0485

Low

1999-02-19

Not applicable

No public exploit

Remote attackers can cause a system crash through ipintr() in ipq in OpenBSD.

CVE-1999-0396

Low

1999-02-17

Not applicable

No public exploit

A race condition between the select() and accept() calls in NetBSD TCP servers allows remote attackers to cause a denial of service.

CVE-1999-0798

High

1998-12-04

Not applicable

No public exploit

Buffer overflow in bootpd on OpenBSD, FreeBSD, and Linux systems via a malformed header type.

CVE-1999-0052

High

1998-11-04

Not applicable

No public exploit

IP fragmentation denial of service in FreeBSD allows a remote attacker to cause a crash.

CVE-1999-0062

High

1998-08-03

Not applicable

No public exploit

The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage.

CVE-1999-0303

Medium

1998-05-21

Not applicable

No public exploit

Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames.

CVE-1999-0323

High

1998-02-20

Not applicable

No public exploit

FreeBSD mmap function allows users to modify append-only or immutable files.

CVE-1999-0305

Medium

1998-02-01

Not applicable

No public exploit

The system configuration control (sysctl) facility in BSD based operating systems OpenBSD 2.2 and earlier, and FreeBSD 2.2.5 and earlier, does not properly restrict source routed packets even when the (1) dosourceroute or (2) forwarding variables are set, which allows remote attackers to spoof TCP connections.

CVE-1999-0304

High

1998-02-01

Not applicable

No public exploit

mmap function in BSD allows local attackers in the kmem group to modify memory through devices.

CVE-1999-0061

Medium

1997-10-02

Not applicable

No public exploit

File creation and deletion, and remote execution, in the BSD line printer daemon (lpd).

CVE-1999-1214

Low

1997-09-15

Not applicable

No public exploit

The asynchronous I/O facility in 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification, which allows local users to cause a denial of service by using certain ioctl and fcntl calls to cause the signal to be sent to an arbitrary process ID.