{"id":182553,"date":"2026-07-08T22:53:54","date_gmt":"2026-07-08T20:53:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novye-uyazvimosti-freebsd"},"modified":"2026-07-08T22:53:54","modified_gmt":"2026-07-08T20:53:54","slug":"novye-uyazvimosti-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/novye-uyazvimosti-freebsd","title":{"rendered":"Uued FreeBSD haavatavused","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>          <a rel=\"nofollow\" id=\"memories_button\" href=\"#\" title=\"J\u00e4lgida\"><i class=\"icon-bell\"><\/i><\/a><br \/>2                            <\/p>\n<p>30. juunil 2026 avaldati teated 13 uue haavatavuse parandamisest FreeBSD operatsioonis\u00fcsteemis.<\/p>\n<ul>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:37.vm.asc\">CVE-2026-49418<\/a>. Seade, millel on m\u00e4llu kaardistatud liides, v\u00f5ib korraldada double-free\/use-after-free tuumas. See v\u00f5ib t\u00f5en\u00e4oliselt viia privileegide t\u00f5usuni. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:38.jail.asc\">CVE-2026-49419<\/a>. (ainult FreeBSD 15+) Praeguse jaili refcounti kahekordne v\u00e4hendamine, kui t\u00f6\u00f6deldakse teise jaili juurde p\u00e4\u00e4semise viga jail descriptori kaudu (ilmnes FreeBSD 15-s), mis viib l\u00f5puks jaili juhtimistruktuuri etteplaneerimata vabastamiseni ja j\u00e4rgneva use-after-free'i tekkeni kohtades, kus seda kasutatakse. Teoreetiliselt v\u00f5ib see viia privileegide t\u00f5usuni. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:39.execve.asc\">CVE-2026-49415<\/a>. Setuid-programmi t\u00e4itmisel seadistatakse juurdep\u00e4\u00e4su\u00f5igused selle m\u00e4lu jaoks veidi hiljem, kui see m\u00e4lu initsialiseeritakse, v\u00f5imaldades l\u00fchikese aja jooksul sellele juurdep\u00e4\u00e4su saada ja seda redigeerida, ilma et oleks vajalikud privileegid, procfs v\u00f5i linprocfs kaudu. Enamikus s\u00fcsteemides ei ole procfs ja veel enam libprocfs loodud, nii et probleem puudutab t\u00f5en\u00e4oliselt v\u00e4heseid. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:40.zfs.asc\">CVE-2026-49429, CVE-2026-49430, CVE-2026-49431<\/a>. (ainult ZFS s\u00fcsteemide jaoks) Esimesed kaks viga on seotud vale suurusega m\u00e4lu eraldamisega: eraldatakse puffer, mille suurus on antud 32-bitise numbrina, ja seej\u00e4rel kirjutatakse sinna tegeliku suurusega andmed, mis viib \u00fcleujutamiseni, kui pufferi tegelik suurus oli suurem kui 4GB. M\u00f5lemad v\u00f5ivad esineda vaid root'i v\u00f5i kasutaja poolt, kellel on selgelt antud \u00f5igused haavatavatesse toimingutesse. Kolmas viga on kergesti ekspluateeritav k\u00f5igile, see v\u00f5imaldab igal hakkida datasett'i lippu &#171;$hasrecvd&#187; ZFS_IOC_SET_PROP abil (kui ohtlik see on, ei ole avaldusest selge). <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:41.libalias.asc\">CVE-2026-49420<\/a>. Adekvaatse paketi suuruse kontrolli puudumine, enne selle kirjutamist fikseeritud suurusega pufferisse virnas libalias moodulis RTSP toe puhul, v\u00f5imaldab eemalt ja ilma autoriseerimiseta virna \u00fcleujutamist kas tuumas (ipfw nat) v\u00f5i protsessis natd (mis tavaliselt t\u00f6\u00f6tab root'ilt). See v\u00f5ib potentsiaalselt viia RCE-ni. Haavatavust v\u00f5ib provotseerida pahatahtlik host kohalikus v\u00f5rgus, mis asub NAT-i taga, mis on rakendatud libalias kaudu, edastades kahjulikke RTSP-pakette. Seega ei m\u00f5juta haavatavus host'e, millel ei ole NAT-i mingil kujul. Samuti, natd ei ole enam haavatav, kui eemaldada rida libalias_smedia.so failist \/etc\/libalias.conf ja taask\u00e4ivitada natd, ja ipfw nat ei ole haavatav ilma alias_smedia.ko mooduli laadimiseta (seal ei ole \u00f6eldud, kas see v\u00f5ib automaatselt laadida). Lisaks vaatab haavatav k\u00e4itleja vaid TCP\/UDP pakette, mis suunduvad v\u00e4lja, millel \u00fcks portidest on 554 v\u00f5i 7070 \u2014 kui sellised paketid on tulem\u00fc\u00fcritud, enne kui nad j\u00f5uavad NAT-i, kaob haavatavus samuti. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:42.unlinkat.asc\">CVE-2026-49421<\/a>. unlinkat() ja funlinkat() ei arvestanud AT_RESOLVE_BENEATH lippu, mis peaks takistama selle tee l\u00e4bimise ajal v\u00e4ljuda antud dirfd argumendi m\u00e4\u00e4ratud kaustast. Seega oli lubatud kustutada faile kaustast v\u00e4ljaspool, kui kutsuv kood soovis sellise piirangu kehtestada. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:43.tcp.asc\">CVE-2026-49422<\/a>. T\u00f5uklemine moodulis tcp_rack.ko (vaikimisi ei ole laaditud). Igal tcp-socketil on v\u00f5imalik individuaalselt valida tcp-stack, mille kaudu see t\u00f6\u00f6tab, sealhulgas vahetades neid jooksvalt. Kui teha j\u00e4rgmist: 1) soketis tcp_rack kutsume rack-spetsiifilist setsockopt()d, 2) teises l\u00f5imes j\u00f5uame kiiresti vahetada tcp-staki rack-ist teisele ja seej\u00e4rel vahetada tagasi rack-ile \u00f5igel hetkel, siis rack-t\u00f6\u00f6tleja setsockopt() t\u00f6\u00f6tab vana (enne vahetamist) socketi oleku struktuuri aadressiga, mis viib m\u00e4lu kahjustumiseni ja v\u00f5imalikule privileegide t\u00f5stmisele. Haavatavad on ainult s\u00fcsteemid, kus tcp_rack.ko on selgelt laaditud, see ei ole vaike.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:44.posixshm.asc\">CVE-2026-49427, CVE-2026-49428<\/a>. POSIX suured lehed (shm_create_largepage) ei olnud jaotatud piisavalt hoolikalt kasutatuks, mis v\u00f5is viia nende vale vabastamiseni erinevates asjaoludes (mainitud on sendfile\u2019i kutsed lipuga SF_NOCACHE, open lipuga O_TRUNC ja fspacectl) ja sellele j\u00e4rgnevale use-after-free tavaliste tagaj\u00e4rgedega.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:45.audit.asc\">CVE-2026-49426<\/a>. Vale logid audit(4) eemaldatud syscalls kaudu ptrace(PT_SC_REMOTE). Need v\u00f5ivad segadusse ajada kahtlaste olukordade anal\u00fc\u00fcsi s\u00fcsteeme, kui selliseid kasutatakse.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:46.ktls.asc\">CVE-2026-49423<\/a>. V\u00f5imalik kernel-panic andmete vastuv\u00f5tmisel kTLS kaudu TLS 1.2 CBC-kirjete osalusel. Probleemi v\u00e4ltimiseks saab seadistada kern.ipc.tls.enable=0 v\u00f5i kern.ipc.tls.cbc_enable=0.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:47.linux.asc\">CVE-2026-49424<\/a>. Andmete leke (104 baiti) kernel'i virnast waitid() linux-compat kutse ajal, mis unustab t\u00fchja osa linux-struktuurist siginfo_t nullida, kui andmeid FreeBSD-st edasi kantakse. Tavalistes GENERIC-kernelites on linux-emulaator vaikimisi v\u00e4lja l\u00fclitatud ning aktiveeritakse ainult k\u00e4sitsi mooduli laadimisega.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:48.compat32.asc\">CVE-2026-49425<\/a>. Sarnaselt eelmisele ei unusta 32-bitine kevent nullida 32-bitist struktuuri, enne kui andmed kantakse 64-bitistesse, mis toob kaasa andmete lekke virnast. Vaikimisi on 32-bitine \u00fchilduvus kernelis sisse l\u00fclitatud (mitte mooduli kaudu).<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:49.iconv.asc\">CVE-2026-58081, CVE-2026-58082<\/a>. Tuuled iconv-s. Esimene: paljusid selle mooduleid ei kontrolli kutsuva koodi poolt antud v\u00e4ljundpuhvri suurust, enne kui kirjutatakse tulemus sellesse (mainitud HZ, UTF-7, VIQR, ZW). Teine: ISO-2022 moodul kasutab 6-baidist puhvrit virnas sisemiste toimingute jaoks, kuid sellesse v\u00f5ib kirjutada kuni 10 baiti, rikub virna. Tulemuseks on, et iconv'i k\u00e4ivitamine \u00fche nende kodeeringute konvertimiseks sissetulevate andmete kontrollimata korral v\u00f5ib viia puhvri \u00fcleujutuste tekkimiseni. <\/li>\n<\/ul>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18335229\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>2 30 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 13 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041e\u0421 FreeBSD. CVE-2026-49418. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443, \u0438\u043c\u0435\u044e\u0449\u0435\u043c\u0443 memory-mapped \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u043c\u043e\u0436\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c double-free\/use-after-free \u0432 \u044f\u0434\u0440\u0435. \u0412\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u044d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. CVE-2026-49419. (\u0442\u043e\u043b\u044c\u043a\u043e FreeBSD 15+) \u0414\u0432\u043e\u0439\u043d\u043e\u0435 \u0443\u043c\u0435\u043d\u044c\u0448\u0435\u043d\u0438\u0435 refcount \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e jail-\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0434\u0440\u0443\u0433\u043e\u043c\u0443 jail \u043f\u043e jail [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182553","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"2 30 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 13 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041e\u0421.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Emin Berklin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/novye-uyazvimosti-freebsd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 FreeBSD | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"2 30 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 13 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041e\u0421.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/novye-uyazvimosti-freebsd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-08T20:53:54+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-08T20:53:54+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uued haavatavused FreeBSD-s | ProHoster","description":"30. juunil 2026 avaldati teated 13 uue haavatavuse parandamise kohta operatsioonis\u00fcsteemis.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/novye-uyazvimosti-freebsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 FreeBSD | ProHoster","og:description":"2 30 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 13 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041e\u0421.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/novye-uyazvimosti-freebsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-07-08T20:53:54+00:00","article:modified_time":"2026-07-08T20:53:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182553","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:06","updated":"2026-08-05 12:22:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182553","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=182553"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182553\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=182553"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=182553"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=182553"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}