Rashin lahani a cikin libc da FreeBSD IPV6 tari

FreeBSD ya gyara lahani da yawa wanda zai iya ba da damar mai amfani na gida ya haɓaka gatansu akan tsarin:

• CVE-2020-7458 - rauni a cikin tsarin posix_spawnp da aka bayar a cikin libc don ƙirƙirar matakai, ana amfani da su ta hanyar ƙididdige ƙima mai girma sosai a cikin canjin yanayi na PATH. Rashin lahani na iya haifar da rubuta bayanai fiye da wurin ƙwaƙwalwar ajiya da aka ware don tarin, kuma yana ba da damar sake rubuta abubuwan da ke cikin buffer na gaba tare da ƙima mai sarrafawa.
• CVE-2020-7457 - rauni a cikin tarin IPv6 wanda ke bawa mai amfani da gida damar tsara aiwatar da lambar su a matakin kwaya ta hanyar magudi ta amfani da zaɓin IPV6_2292PKTOPTIONS don soket na cibiyar sadarwa.
• An kawar biyu vulnerabilities (CVE-2020-12662, CVE-2020-12663) a cikin sabar DNS da aka haɗa. Sakakken, ba ka damar haifar da ƙin sabis na nesa lokacin samun dama ga uwar garken da mai hari ke sarrafawa ko amfani da sabar DNS azaman ƙararrawar zirga-zirga lokacin kai hare-haren DDoS.

Bugu da kari, an warware batutuwan da ba na tsaro guda uku (erratas) da za su iya sa kwaya ta fadi yayin amfani da direban. mps (lokacin aiwatar da umarnin sas2ircu), subsystems LinuxKPI (tare da juyawa X11) da hypervisor bhyve (lokacin tura na'urorin PCI).

source: budenet.ru