Remote vulnerability in the NetBSD kernel, exploited from a local network.

In NetBSD has been closed vulnerability, caused by the lack of boundary checking in the handling of jumbo frames in drivers for USB-connected network adapters. The issue leads to copying part of a packet beyond the buffer allocated in a mbuf cluster, which could potentially be exploited to execute an attacker's code at the kernel level by sending specific frames from the local network. A fix to block the vulnerability was introduced on August 28, but details of the problem have only been disclosed now. The issue affects the atu, axe, axen, otus, run, and ure drivers.

Meanwhile, in the TCP/IP stack of Windows identified critical vulnerability, allowing remote execution of the attacker's code by sending an ICMPv6 packet with an IPv6 Router Advertisement (RA).
The vulnerability manifests Starting with the 1709 update for Windows 10/Windows Server 2019, which introduced support for DNS configuration transmission via ICMPv6 RA packets, as specified in RFC 6106. The problem is caused by improper buffer allocation for the content of the RDNSS field when transmitting non-standard sizes of values (the size of the fields was interpreted as a multiple of 16, leading to parsing issues and allocating 8 bytes less memory, as the extra 8 bytes were perceived as belonging to the next field).

Source: opennet.ru