{"id":181665,"date":"2026-05-22T18:24:54","date_gmt":"2026-05-22T16:24:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vo-freebsd-ustraneno-4-uyazvimosti-pozvolyayushhie-podnyat-privilegii-i-odna-udalyonnaya-root-uyazvimost"},"modified":"2026-05-22T18:24:54","modified_gmt":"2026-05-22T16:24:54","slug":"vo-freebsd-ustraneno-4-uyazvimosti-pozvolyayushhie-podnyat-privilegii-i-odna-udalyonnaya-root-uyazvimost","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vo-freebsd-ustraneno-4-uyazvimosti-pozvolyayushhie-podnyat-privilegii-i-odna-udalyonnaya-root-uyazvimost","title":{"rendered":"FreeBSD has addressed 4 vulnerabilities that allow privilege escalation, along with one remote root vulnerability.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
FreeBSD has fixed 7 vulnerabilities, one of which allows remote code execution with root privileges, while four allow privilege escalation in the system. These vulnerabilities have been resolved in FreeBSD updates 15.0-RELEASE-p9, 14.4-RELEASE-p5, and 14.3-RELEASE-p14. <\/p>\n
\n
CVE-2026-45255 \u2014 in the bsdinstall installer and bsdconfig configurator, there was a lack of escaping for special characters in the shell script that displayed to the user a list of available wireless networks identified through scanning. An attacker could create a rogue access point and assign a specially crafted network identifier (SSID) containing executable shell constructs (e.g., \"test`id`\"). When the user initiates a wireless network search, the inserted shell commands would be executed on the user's system with root privileges (selection or connection to the attacker's network is not required; simply initiating a scan is enough).\n
CVE-2026-45250 \u2014 stack overflow in the setcred system call, allowing a local unprivileged user to achieve code execution at the kernel level. The issue is caused by an incorrect check of the size of data being placed in the buffer \u2014 instead of \"sizeof(gid_t)\" it was set to \"sizeof(*groups)\". Elevated privileges are needed to access the setcred system call, but the vulnerability resides in the initial copying of the user-supplied group list into a separate buffer, executed before privilege checks.\n
CVE-2026-45251 \u2014 use-after-free access to already freed memory in the select and poll system calls, occurring when the provided file descriptor is closed before the thread waiting for file descriptors from the select and poll system calls is released. Successful exploitation allows an unprivileged user to execute code at the kernel level.\n
CVE-2026-45253 \u2014 absence of proper checks for parameters passed in the ptrace system call during the PT_SC_REMOTE operation. The vulnerability allows an unprivileged user to orchestrate the execution of arbitrary code in the kernel, even if the target debugged process does not have special privileges.\n
CVE-2026-39461 \u2014 Stack buffer overflow in the libcasper library, which provides applications isolated through the Capsicum mechanism access to system interfaces. When interacting with the handler via UNIX sockets, the library uses the select system call to wait for incoming data but does not verify that the socket descriptor meets the FD_SETSIZE (1024) limit in select. An attacker can initiate the allocation of large file descriptors in an application based on libcasper and trigger a stack overflow. Such manipulations with setuid root programs can lead to code execution with root privileges.\n
CVE-2026-45254 \u2014 Capability net limits bypass in an application due to a missing key being interpreted as 'allow any' instead of blocking.\n
CVE-2026-45252 \u2014 Buffer overflow in the fusefs module when processing FUSE_LISTXATTR messages, allowing reading of up to 253 bytes from the kernel memory outside of the buffer or writing up to 250 bytes to an unused area of the heap.\n<\/ul>\n