Versions Affected : All verisons prior to FreeNAS 11.3-U4.1
When handling a 32-bit sendmsg(2) call, the compat32 subsystem copies the control message to be transmitted (if any) into kernel memory, and adjusts alignment of control message headers.
Versions Affected : All verisons prior to FreeNAS 11.3-U4.1
A missing length validation code common to these three drivers means that a malicious USB device could write beyond the end of an allocated network packet buffer.
Versions Affected : All verisons prior to FreeNAS 11.3-U3.2
The IPV6_2292PKTOPTIONS set handler was missing synchronization, so racing accesses could modify freed memory.
Versions Affected : All verisons prior to FreeNAS 11.3-U3.2
Malformed answers from upstream name servers can send Unbound into an infinite loop, resulting in denial of service.
Versions Affected : All verisons prior to FreeNAS 11.3-U3.2
mps(4) implements a pass-through interface which allows privileged user processes to submit commands directly to disks behind the controller.
Versions Affected : All verisons prior to FreeNAS 11.3-U3.2
A bug in one of the LinuxKPI subroutines could cause a kernel panic.
Versions Affected : All verisons prior to FreeNAS 11.3-U?
USB Human Interface Device (HID) descriptors may push/pop the current state to allow description of items residing in a so-called union.
Versions Affected : All verisons prior to FreeNAS 11.3-U3.2
A race condition permitted a data structure in the kernel to be used after it was freed by the cryptodev module.
Versions Affected : All verisons prior to 11.3-U3.2
The SCTP layer does improper checking when an application tries to update a shared key.
Versions Affected : All verisons prior to FreeNAS 11.3-U3.2
The FTP packet handler in libalias incorrectly calculates some packet lengths.
Versions Affected : All verisons prior to FreeNAS 11.3-U3.2
libalias(3) packet handlers do not properly validate the packet length before accessing the protocol headers.
Versions Affected : All verisons prior to FreeNAS 11.3-U3.2
The Clang and LLD version detection accepted only versions matching the shell glob pattern [1-9].[0-9]*, which notably does not include 10.0. The build then proceeded as if the compiler or linker version was 0.0.
Versions Affected : All verisons prior to FreeNAS 11.3-U2.1 Description Incomplete packet data validation may result in accessing out-of-bounds memory (CVE-2019-5614) or may access memory after it has been freed (CVE-2019-15874). Workaround No workaround is available. Systems not using the ipfw firewall are not vulnerable. Mitigation Upgrade to FreeNAS 11.3-U3.2 or later Commit FreeBSD Revision : r360149 FreeNAS Commit : 6911f08 Jira Ticket : NAS-105837 Further information FreeBSD Errata Entry
Versions Affected : All verisons prior to FreeNAS 11.3-U2.1
A change in rpc.rquotad made it send RQUOTA v2 requests instead of RQUOTA v1 requests.
Versions Affected : All verisons prior to FreeNAS 11.3-U2
Three NTP vulnerabilities are addressed by this security advisory. NTP Bug 3610, 3596, and 3592.
Versions Affected : All verisons prior to FreeNAS 11.3-U2
A missing NUL-termination check for the jail_set(2) configration option “osrelease” may return more bytes when reading the jail configuration back with jail_get(2) than were originally set.
Versions Affected : All verisons prior to FreeNAS 11.3-U2
Incorrect use of a potentially user-controlled pointer in the kernel allowed vnet jailed users to panic the system and potentially execute aribitrary code in the kernel.
Versions Affected : All verisons prior to FreeNAS 11.3-U2
The driver-specific ioctl(2) command handlers in oce(4) failed to check whether the caller has sufficient privileges to perform the corresponding operation.
Versions Affected : All verisons prior to FreeNAS 11.3-U2
When a TCP server transmits or retransmits a TCP SYN-ACK segment over IPv6, the Traffic Class field is not initialized.
Versions Affected : All verisons prior to FreeNAS 11.3-U2
Pseudo header checksum calculations can be delayed until the IPv6 output routine or offloaded to the NIC.
Versions Affected : All verisons prior to FreeNAS 11.3-U2
pf(4) ioctls frequently take a variable number of elements as argument. This can potentially allow users to request very large allocations.
Versions Affected : All verisons prior to FreeNAS 11.3-U1
VFS option processing related to the nmount(2) system call was missing a length check.
Versions Affected : All verisons prior to FreeNAS 11.3-U1
When a binary is statically linked, constructor invocation order is based on priority and sorted arbitrarily within a priority level across all constructors present in the single statically linked object.