PT-2014-5631 · Freebsd · Freebsd

Published 2014-07-15 · Updated 2017-08-29 · CVE-2014-3952

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeBSD versions 8.4 before p14 FreeBSD versions 9.1 before p17 FreeBSD versions 9.2 before p10 FreeBSD versions 10.0 before p7

Description The issue allows local users to obtain sensitive information from kernel memory due to improper initialization of the buffer between the header and data of a control message.

Recommendations For FreeBSD version 8.4, update to p14 or later. For FreeBSD version 9.1, update to p17 or later. For FreeBSD version 9.2, update to p10 or later. For FreeBSD version 10.0, update to p7 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-3952

DSA-3070-1

Affected Products

Freebsd

References · 7

• http://freebsd.org/security/advisories/FreeBSD-SA-14:17.kmem.asc · Vendor Advisory
• http://debian.org/security/2014/dsa-3070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3952 · Security Note
• http://securityfocus.com/bid/68466 · Note
• http://secunia.com/advisories/62218 · Note
• http://securitytracker.com/id/1030539 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94448 · Note