Przemyslaw Frasunek

**Name of the Vulnerable Software and Affected Versions** FreeBSD versions 14.x **Description** A stack buffer overflow exists in the `setcred(2)` system call. The issue occurs because a user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer before the privilege level of the caller is verified and without validating the length of the list. An unprivileged local user can trigger this overflow, potentially allowing the execution of arbitrary code within the kernel context to gain elevated privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rsync versions 3.0.1 through 3.4.1 **Description** The `receive xattr()` function relies on an untrusted length value during a `qsort()` call, which can lead to a use-after-free condition on the receiver side. This occurs when the victim runs the software with the `-X` (or `--xattrs`) option. While many common configurations on Linux are affected, non-Linux platforms are more widely susceptible. **Recommendations** Update rsync to a version later than 3.4.1. As a temporary workaround, avoid running rsync with the `-X` or `--xattrs` option.

**Name of the Vulnerable Software and Affected Versions** FreeBSD versions 6.3 through 6.4 **Description** A race condition exists in the Pipe (IPC) close function, which can be exploited by local users to cause a denial of service (crash) or gain privileges. This issue is related to kqueues and can trigger a use after free, resulting in a NULL pointer dereference or memory corruption. **Recommendations** For FreeBSD versions 6.3 and 6.4, consider applying a patch or updating to a newer version to resolve the issue. As a temporary workaround, restrict access to the Pipe (IPC) close function to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Sun Solaris 10 on x86 systems Description: The issue allows local users to execute arbitrary code with PRIV NET RAWACCESS privileges. This can be achieved through either a large number of -g arguments or a malformed -s argument with a trailing dot. Recommendations: For Sun Solaris 10 on x86 systems, consider restricting the use of the `traceroute` command until a patch is available. As a temporary workaround, limit the number of -g arguments and avoid using malformed -s arguments to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zyxel P681 version Vt020225a **Description** The issue allows remote attackers to obtain sensitive information by sniffing the network, as the device contains portions of memory in an ARP request. **Recommendations** For Zyxel P681 version Vt020225a, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tcpdump versions 3.8.1 and earlier **Description** The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and memory consumption. This occurs when a packet with invalid data is sent to UDP port 1701, causing the `l2tp avp print` function to use a bad length value when calling `print octets`. **Recommendations** For versions 3.8.1 and earlier, update to a version later than 3.8.1 to resolve the issue.