Overview 85 matches · 0 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 24 public PoC · 1 EPSS ≥ 0.5
85matches
0in Waratek scope0.0%
0protected0.0%
2exploited2.4%
0CISA KEV0.0%
24public PoC28.2%
1EPSS ≥ 0.51.2%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
85
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
85
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 16 / year
19985
Not applicable5
High5
not blocked5
No public exploit5
19991
Not applicable1
High1
not blocked1
Working exploit published1
20008
Not applicable8
High8
not blocked8
Working exploit published3
No public exploit5
20018
Not applicable8
High8
not blocked8
Exploited1
Working exploit published3
No public exploit4
20028
Not applicable8
High8
not blocked8
Working exploit published2
No public exploit6
20034
Not applicable4
High4
not blocked4
Exploited1
Working exploit published1
No public exploit2
200416
Not applicable16
High16
not blocked16
Working exploit published4
No public exploit12
20050
20062
Not applicable2
High2
not blocked2
No public exploit2
20073
Not applicable3
High3
not blocked3
Working exploit published2
No public exploit1
20085
Not applicable5
High5
not blocked5
Working exploit published1
Proof of concept only1
No public exploit3
20091
Not applicable1
High1
not blocked1
Working exploit published1
20100
20112
Not applicable2
High2
not blocked2
No public exploit2
20120
20130
20140
20150
20160
20174
Not applicable4
High4
not blocked4
Working exploit published1
No public exploit3
20180
20196
Not applicable6
High6
not blocked6
Working exploit published1
No public exploit5
20201
Not applicable1
High1
not blocked1
Working exploit published1
20211
Not applicable1
High1
not blocked1
No public exploit1
20222
Not applicable2
High2
not blocked2
No public exploit2
20232
Not applicable2
High2
not blocked2
No public exploit2
20243
Not applicable3
High3
not blocked3
No public exploit3
20251
Not applicable1
High1
not blocked1
No public exploit1
20262
Not applicable2
High2
not blocked2
Proof of concept only1
No public exploit1
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-57589 | High | 2026-06-25 | Not applicable | No public exploit | sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget(). |
| CVE-2026-55706 | High | 2026-06-17 | Not applicable | Proof of concept only | sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths. |
| CVE-2025-30334 | High | 2025-03-20 | Not applicable | No public exploit | In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash. |
| CVE-2024-11148 | High | 2024-12-05 | Not applicable | No public exploit | In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request. |
| CVE-2023-52558 | High | 2024-03-01 | Not applicable | No public exploit | In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after receiving specially crafted escape sequences. |
| CVE-2023-52557 | High | 2024-03-01 | Not applicable | No public exploit | In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length. |
| CVE-2023-29323 | High | 2023-04-04 | Not applicable | No public exploit | ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit f748277, can abort upon a connection from a local, scoped IPv6 address. |
| CVE-2023-27567 | High | 2023-03-03 | Not applicable | No public exploit | In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel. |
| CVE-2022-27882 | High | 2022-03-25 | Not applicable | No public exploit | slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow triggerable by a crafted IPv6 router advertisement. NOTE: privilege separation and pledge can prevent exploitation. |
| CVE-2022-27881 | High | 2022-03-25 | Not applicable | No public exploit | engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement with more than seven nameservers. NOTE: privilege separation and pledge can prevent exploitation. |
| CVE-2010-4816 | High | 2021-06-22 | Not applicable | No public exploit | It was found in FreeBSD 8.0, 6.3 and 4.9, and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of service of the ftpd service. |
| CVE-2011-3336 | High | 2020-02-12 | Not applicable | Working exploit published | regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. |
| CVE-2019-19726 | High | 2019-12-12 | Not applicable | Working exploit published | OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), _dl_setup_env in ld.so tries to strip LD_LIBRARY_PATH from the environment, but fails when it cannot allocate memory. Thus, the attacker is able to execute their own library code as root. |
| CVE-2019-14899 | High | 2019-12-11 | Not applicable | No public exploit | A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel. |
| CVE-2019-19522 | High | 2019-12-05 | Not applicable | No public exploit | OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned by root. |
| CVE-2019-19520 | High | 2019-12-05 | Not applicable | No public exploit | xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, because xenocara/lib/mesa/src/loader/loader.c mishandles dlopen. |
| CVE-2019-19519 | High | 2019-12-05 | Not applicable | No public exploit | In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in su/su.c. |
| CVE-2019-8460 | High | 2019-08-26 | Not applicable | No public exploit | OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service. |
| CVE-2017-5850 | High | 2017-03-27 | Not applicable | Working exploit published | httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header. |
| CVE-2016-6244 | High | 2017-03-07 | Not applicable | No public exploit | The sys_thrsigdivert function in kern/kern_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) via a negative "ts.tv_sec" value. |
| CVE-2016-6241 | High | 2017-03-07 | Not applicable | No public exploit | Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value. |
| CVE-2016-6240 | High | 2017-03-07 | Not applicable | No public exploit | Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value. |
| CVE-2011-2895 | High | 2011-08-19 | Not applicable | No public exploit | The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896. |
| CVE-2011-1013 | High | 2011-05-09 | Not applicable | No public exploit | Integer signedness error in the drm_modeset_ctl function in (1) drivers/gpu/drm/drm_irq.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.38 and (2) sys/dev/pci/drm/drm_irq.c in the kernel in OpenBSD before 4.9 allows local users to trigger out-of-bounds write operations, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via a crafted num_crtcs (aka vb_num) structure member in an ioctl argument. |
| CVE-2009-0687 | High | 2009-08-11 | Not applicable | Working exploit published | The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload. |
| CVE-2008-4609 | High | 2008-10-20 | Not applicable | Proof of concept only | The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress. |
| CVE-2008-2476 | High | 2008-10-03 | Not applicable | No public exploit | The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB). |
| CVE-2008-4247 | High | 2008-09-25 | Not applicable | Working exploit published | ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser. |
| CVE-2008-1058 | High | 2008-02-28 | Not applicable | No public exploit | The tcp_respond function in netinet/tcp_subr.c in OpenBSD 4.1 and 4.2 allows attackers to cause a denial of service (panic) via crafted TCP packets. NOTE: some of these details are obtained from third party information. |
| CVE-2008-1057 | High | 2008-02-28 | Not applicable | No public exploit | The ip6_check_rh0hdr function in netinet6/ip6_input.c in OpenBSD 4.2 allows attackers to cause a denial of service (panic) via malformed IPv6 routing headers. |
| CVE-2007-5365 | High | 2007-10-11 | Not applicable | Working exploit published | Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU. |
| CVE-2007-1351 | High | 2007-04-06 | Not applicable | No public exploit | Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow. |
| CVE-2007-1365 | High | 2007-03-10 | Not applicable | Working exploit published | Buffer overflow in kern/uipc_mbuf2.c in OpenBSD 3.9 and 4.0 allows remote attackers to execute arbitrary code via fragmented IPv6 packets due to "incorrect mbuf handling for ICMP6 packets." NOTE: this was originally reported as a denial of service. |
| CVE-2006-6164 | High | 2006-11-29 | Not applicable | No public exploit | The _dl_unsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LD_PRELOAD to loading processes, which might be leveraged to gain privileges. |
| CVE-2006-4304 | High | 2006-08-24 | Not applicable | No public exploit | Buffer overflow in the sppp driver in FreeBSD 4.11 through 6.1, NetBSD 2.0 through 4.0 beta before 20060823, and OpenBSD 3.8 and 3.9 before 20060902 allows remote attackers to cause a denial of service (panic), obtain sensitive information, and possibly execute arbitrary code via crafted Link Control Protocol (LCP) packets with an option length that exceeds the overall length, which triggers the overflow in (1) pppoe and (2) ippp. NOTE: this issue was originally incorrectly reported for the ppp driver. |
| CVE-2004-2338 | High | 2004-12-31 | Not applicable | No public exploit | OpenBSD 3.3 and 3.4 does not properly parse Accept and Deny rules without netmasks on big-endian 64-bit platforms such as SPARC64, which may allow remote attackers to bypass access restrictions. |
| CVE-2004-2163 | High | 2004-12-31 | Not applicable | No public exploit | login_radius on OpenBSD 3.2, 3.5, and possibly other versions does not verify the shared secret in a response packet from a RADIUS server, which allows remote attackers to bypass authentication by spoofing server replies. |
| CVE-2004-1799 | High | 2004-12-31 | Not applicable | No public exploit | PF in certain OpenBSD versions, when stateful filtering is enabled, does not limit packets for a session to the original interface, which allows remote attackers to bypass intended packet filters via spoofed packets to other interfaces. |
| CVE-2004-1471 | High | 2004-12-31 | Not applicable | Working exploit published | Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line. |
| CVE-2004-0079 | High | 2004-11-23 | Not applicable | No public exploit | The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference. |
| CVE-2004-0688 | High | 2004-10-20 | Not applicable | No public exploit | Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file. |
| CVE-2004-0687 | High | 2004-10-20 | Not applicable | No public exploit | Multiple stack-based buffer overflows in (1) xpmParseColors in parse.c, (2) ParseAndPutPixels in create.c, and (3) ParsePixels in parse.c for libXpm before 6.8.1 allow remote attackers to execute arbitrary code via a malformed XPM image file. |
| CVE-2004-0492 | High | 2004-08-06 | Not applicable | No public exploit | Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied. |
| CVE-2004-0418 | High | 2004-08-06 | Not applicable | No public exploit | serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data. |
| CVE-2004-0416 | High | 2004-08-06 | Not applicable | Working exploit published | Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code. |
| CVE-2004-0414 | High | 2004-08-06 | Not applicable | No public exploit | CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution. |
| CVE-2004-0220 | High | 2004-05-04 | Not applicable | No public exploit | isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service via an ISAKMP packet with a malformed Cert Request payload, which causes an integer underflow that is used in a malloc operation that is not properly handled, as demonstrated by the Striker ISAKMP Protocol Test Suite. |
| CVE-2004-0106 | High | 2004-03-03 | Not applicable | No public exploit | Multiple unknown vulnerabilities in XFree86 4.1.0 to 4.3.0, related to improper handling of font files, a different set of vulnerabilities than CVE-2004-0083 and CVE-2004-0084. |
| CVE-2004-0084 | High | 2004-03-03 | Not applicable | Working exploit published | Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenticated users to execute arbitrary code via a malformed entry in the font alias (font.alias) file, a different vulnerability than CVE-2004-0083 and CVE-2004-0106. |
| CVE-2004-0083 | High | 2004-03-03 | Not applicable | Working exploit published | Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a font alias file (font.alias) with a long token, a different vulnerability than CVE-2004-0084 and CVE-2004-0106. |
| CVE-2004-1082 | High | 2004-02-03 | Not applicable | No public exploit | mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials. |
| CVE-2003-0681 | High | 2003-10-06 | Not applicable | Exploited | A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences. |
| CVE-2002-1420 | High | 2003-04-11 | Not applicable | No public exploit | Integer signedness error in select() on OpenBSD 3.1 and earlier allows local users to overwrite arbitrary kernel memory via a negative value for the size parameter, which satisfies the boundary check as a signed integer, but is later used as an unsigned integer during a data copying operation. |
| CVE-2003-0144 | High | 2003-03-31 | Not applicable | Working exploit published | Buffer overflow in the lprm command in the lprold lpr package on SuSE 7.1 through 7.3, OpenBSD 3.2 and earlier, and possibly other operating systems, allows local users to gain root privileges via long command line arguments such as (1) request ID or (2) user name. |
| CVE-2003-0028 | High | 2003-03-25 | Not applicable | No public exploit | Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391. |
| CVE-2002-1219 | High | 2002-11-29 | Not applicable | No public exploit | Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR). |
| CVE-2002-0766 | High | 2002-08-12 | Not applicable | No public exploit | OpenBSD 2.9 through 3.1 allows local users to cause a denial of service (resource exhaustion) and gain root privileges by filling the kernel's file descriptor table and closing file descriptors 0, 1, or 2 before executing a privileged process, which is not properly handled when OpenBSD fails to open an alternate descriptor. |
| CVE-2002-0765 | High | 2002-08-12 | Not applicable | No public exploit | sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password. |
| CVE-2002-0414 | High | 2002-08-12 | Not applicable | No public exploit | KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems, does not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets. |
| CVE-2000-1208 | High | 2002-08-12 | Not applicable | No public exploit | Format string vulnerability in startprinting() function of printjob.c in BSD-based lpr lpd package may allow local users to gain privileges via an improper syslog call that uses format strings from the checkremote() call. |
| CVE-2002-0572 | High | 2002-07-03 | Not applicable | Working exploit published | FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, allows local users to write to or read from restricted files by closing the file descriptors 0 (standard input), 1 (standard output), or 2 (standard error), which may then be reused by a called setuid process that intended to perform I/O on normal files. |
| CVE-2002-0557 | High | 2002-07-03 | Not applicable | No public exploit | Vulnerability in OpenBSD 3.0, when using YP with netgroups in the password database, causes (1) rexec or (2) rsh to run another user's shell, or (3) atrun to change to a different user's directory, possibly due to memory allocation failures or an incorrect call to auth_approval(). |
| CVE-2002-0542 | High | 2002-07-03 | Not applicable | Working exploit published | mail in OpenBSD 2.9 and 3.0 processes a tilde (~) escape character in a message even when it is not in interactive mode, which could allow local users to gain root privileges via calls to mail in cron. |
| CVE-2001-0670 | High | 2001-10-03 | Not applicable | No public exploit | Buffer overflow in BSD line printer daemon (in.lpd or lpd) in various BSD-based operating systems allows remote attackers to execute arbitrary code via an incomplete print job followed by a request to display the printer queue. |
| CVE-2001-0554 | High | 2001-08-14 | Not applicable | Exploited | Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function. |
| CVE-2001-0402 | High | 2001-06-18 | Not applicable | Working exploit published | IPFilter 3.4.16 and earlier does not include sufficient session information in its cache, which allows remote attackers to bypass access restrictions by sending fragmented packets to a restricted port after sending unfragmented packets to an unrestricted port. |
| CVE-2001-0247 | High | 2001-06-18 | Not applicable | Working exploit published | Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3. |
| CVE-2001-0284 | High | 2001-05-03 | Not applicable | No public exploit | Buffer overflow in IPSEC authentication mechanism for OpenBSD 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a malformed Authentication header (AH) IPv4 option. |
| CVE-2001-0268 | High | 2001-05-03 | Not applicable | No public exploit | The i386_set_ldt system call in NetBSD 1.5 and earlier, and OpenBSD 2.8 and earlier, when the USER_LDT kernel option is enabled, does not validate a call gate target, which allows local users to gain root privileges by creating a segment call gate in the Local Descriptor Table (LDT) with a target that specifies an arbitrary kernel address. |
| CVE-2000-0312 | High | 2001-03-12 | Not applicable | No public exploit | cron in OpenBSD 2.5 allows local users to gain root privileges via an argv[] that is not NULL terminated, which is passed to cron's fake popen function. |
| CVE-2001-0053 | High | 2001-02-12 | Not applicable | Working exploit published | One-byte buffer overflow in replydirname function in BSD-based ftpd allows remote attackers to gain root privileges. |
| CVE-2000-0997 | High | 2000-12-19 | Not applicable | No public exploit | Format string vulnerabilities in eeprom program in OpenBSD, NetBSD, and possibly other operating systems allows local attackers to gain root privileges. |
| CVE-2000-0996 | High | 2000-12-19 | Not applicable | No public exploit | Format string vulnerability in OpenBSD su program (and possibly other BSD-based operating systems) allows local attackers to gain root privileges via a malformed shell. |
| CVE-2000-0995 | High | 2000-12-19 | Not applicable | No public exploit | Format string vulnerability in OpenBSD yp_passwd program (and possibly other BSD-based operating systems) allows attackers to gain root privileges a malformed name. |
| CVE-2000-0994 | High | 2000-12-19 | Not applicable | Working exploit published | Format string vulnerability in OpenBSD fstat program (and possibly other BSD-based operating systems) allows local users to gain root privileges via the PWD environmental variable. |
| CVE-2000-0993 | High | 2000-12-19 | Not applicable | Working exploit published | Format string vulnerability in pw_error function in BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd. |
| CVE-2000-1010 | High | 2000-12-11 | Not applicable | No public exploit | Format string vulnerability in talkd in OpenBSD and possibly other BSD-based OSes allows remote attackers to execute arbitrary commands via a user name that contains format characters. |
| CVE-2000-0751 | High | 2000-10-20 | Not applicable | Working exploit published | mopd (Maintenance Operations Protocol loader daemon) does not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands. |
| CVE-2000-0750 | High | 2000-10-20 | Not applicable | No public exploit | Buffer overflow in mopd (Maintenance Operations Protocol loader daemon) allows remote attackers to execute arbitrary commands via a long file name. |
| CVE-1999-0674 | High | 1999-08-09 | Not applicable | Working exploit published | The BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve. |
| CVE-1999-0798 | High | 1998-12-04 | Not applicable | No public exploit | Buffer overflow in bootpd on OpenBSD, FreeBSD, and Linux systems via a malformed header type. |
| CVE-1999-0052 | High | 1998-11-04 | Not applicable | No public exploit | IP fragmentation denial of service in FreeBSD allows a remote attacker to cause a crash. |
| CVE-1999-0062 | High | 1998-08-03 | Not applicable | No public exploit | The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage. |
| CVE-1999-0323 | High | 1998-02-20 | Not applicable | No public exploit | FreeBSD mmap function allows users to modify append-only or immutable files. |
| CVE-1999-0304 | High | 1998-02-01 | Not applicable | No public exploit | mmap function in BSD allows local attackers in the kmem group to modify memory through devices. |