{"id":182553,"date":"2026-07-08T22:53:54","date_gmt":"2026-07-08T20:53:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novye-uyazvimosti-freebsd"},"modified":"2026-07-08T22:53:54","modified_gmt":"2026-07-08T20:53:54","slug":"novye-uyazvimosti-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/novye-uyazvimosti-freebsd","title":{"rendered":"Nove ranjivosti FreeBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>          <a rel=\"nofollow\" id=\"memories_button\" href=\"#\" title=\"Pratiti\"><i class=\"icon-bell\"><\/i><\/a><br \/>2                            <\/p>\n<p>30. lipnja 2026. objavljena su obavje\u0161tenja o ispravci 13 novih ranjivosti u operativnom sustavu FreeBSD.<\/p>\n<ul>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:37.vm.asc\">CVE-2026-49418<\/a>. Kori\u0161tenik s pristupom ure\u0111aju koji ima memory-mapped su\u010delje mo\u017ee prouzro\u010diti double-free\/use-after-free u kernelu. To bi moglo dovesti do pove\u0107anja privilegija. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:38.jail.asc\">CVE-2026-49419<\/a>. (samo FreeBSD 15+) Dvostruko smanjenje refcounta trenutnog jail-a tijekom obrade gre\u0161ke pristupanja drugom jail-u putem jail descriptor-a (odvijaju se u FreeBSD 15), \u0161to na kraju dovodi do neplaniranog osloba\u0111anja upravlja\u010dke strukture jail-a i naknadnih use-after-free u svemu \u0161to je koristi. Teoretski bi moglo dovesti do pove\u0107anja privilegija. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:39.execve.asc\">CVE-2026-49415<\/a>. Tijekom izvo\u0111enja setuid programa, prava pristupa njegovoj memoriji postavljaju se malo kasnije nego \u0161to se ta memorija inicijalizira, \u0161to omogu\u0107ava pristup i ure\u0111ivanje u kratkom vremenskom intervalu bez potrebnih privilegija, putem procfs ili linprocfs. U ve\u0107ini sustava procfs, a posebno libprocfs, nije montiran, tako da problem vjerojatno malo koga poga\u0111a. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:40.zfs.asc\">CVE-2026-49429, CVE-2026-49430, CVE-2026-49431<\/a>. (samo za sustave s ZFS) Prve dvije pogre\u0161ke povezane su s alokacijom memorije pogre\u0161ne veli\u010dine: alocira se memorijski prostor veli\u010dine predane 32-bitne brojke, a zatim se u njega upisuju podaci stvarne veli\u010dine, \u0161to mo\u017ee dovesti do preljeva ako je stvarna veli\u010dina memorijskog prostora ve\u0107a od 4 GB. Obje mogu biti izazvane samo od strane root-a ili korisnika s izri\u010dito dodijeljenim privilegijama za ranjive operacije. Tre\u0107a pogre\u0161ka dostupna je za iskori\u0161tavanje svima i omogu\u0107uje bilo kome da na dataset postavi oznaku $hasrecvd pomo\u0107u ZFS_IOC_SET_PROP (koliko je to opasno, nije jasno iz najave). <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:41.libalias.asc\">CVE-2026-49420<\/a>. Nedostatak odgovaraju\u0107e provjere veli\u010dine paketa prije zapisivanja u memorijski prostor fiksne veli\u010dine na stogu u libalias modulu za podr\u0161ku RTSP dovodi do mogu\u0107nosti daljinskog preljeva stoga ili jezgre (za ipfw nat) ili procesa natd (koji obi\u010dno radi pod root). Potencijalno mo\u017ee dovesti do RCE. Iskori\u0161tavanje ranjivosti mo\u017ee izazvati zlonamjerni doma\u0107in unutar lokalne mre\u017ee za NAT, implementiran preko libalias, koji proslje\u0111uje zlonamjerne RTSP pakete. Na taj na\u010din, ranjivost ne poga\u0111a doma\u0107ine na kojima nije pokrenut NAT u bilo kojem obliku. Tako\u0111er, natd prestaje biti ranjiv ako se ukloni linija libalias_smedia.so iz \/etc\/libalias.conf i ponovo pokrene natd, dok ipfw nat ne\u0107e biti ranjiv bez u\u010ditavanja modula alias_smedia.ko (nije navedeno mo\u017ee li ga automatski u\u010ditati). Osim toga, ranjivi procesor gleda samo TCP\/UDP pakete koji idu van, s jednim od portova 554 ili 7070 \u2014 ako se takvi paketi blokiraju prije nego \u0161to do\u0111u do NAT-a, ranjivost tako\u0111er nestaje. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:42.unlinkat.asc\">CVE-2026-49421<\/a>. unlinkat() i funlinkat() nisu uzimali u obzir vlag AT_RESOLVE_BENEATH, koji je trebao sprije\u010diti izlazak izvan direktorija navedenog argumentom dirfd. Na taj na\u010din omogu\u0107eno je brisanje datoteka izvan direktorija kada je pozivaju\u0107i kod \u017eelio uvesti ovo ograni\u010denje. <\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:43.tcp.asc\">CVE-2026-49422<\/a>. Utrka u tcp_rack.ko modulu (po defaultu nije u\u010ditan). Svakom tcp soketu mo\u017ee se pojedina\u010dno odabrati tcp stog preko kojeg \u0107e raditi, uklju\u010duju\u0107i prebacivanje na letu. Ako u\u010dinite sljede\u0107e: 1) na soketu s tcp_rack pozivamo rack-specifi\u010dni setsockopt(), 2) u drugom threadu brzo prebacimo tcp stog s rack na drugi i ponovno se prebacimo nazad na rack u pravom trenutku, tada rack handler setsockopt() \u0107e raditi sa starom (prije prebacivanja) adresom strukture stanja soketa, \u0161to dovodi do o\u0161te\u0107enja memorije i potencijalnog pove\u0107anja privilegija. Ranjivi su samo sustavi gdje je tcp_rack.ko o\u010digledno u\u010ditan, to nije default.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:44.posixshm.asc\">CVE-2026-49427, CVE-2026-49428<\/a>. POSIX largepages (shm_create_largepage) prilikom alokacije nisu dovoljno pa\u017eljivo ozna\u010deni kao kori\u0161teni, \u0161to mo\u017ee dovesti do njihovog pogre\u0161nog osloba\u0111anja u razli\u010ditim okolnostima (spomenuti pozivi sendfile s vlagom SF_NOCACHE, open s vlagom O_TRUNC i fspacectl) i kasnijeg use-after-free s uobi\u010dajenim posljedicama.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:45.audit.asc\">CVE-2026-49426<\/a>. Neispravni audit(4) logovi o udaljenim sistemskim pozivima preko ptrace(PT_SC_REMOTE). Mogu zbuniti sustave za analizu sumnjivih situacija, ukoliko se koriste.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:46.ktls.asc\">CVE-2026-49423<\/a>. Mogu\u0107i kernel-panic prilikom primanja podataka preko kTLS s uklju\u010denim TLS 1.2 CBC zapisima. Da biste izbegli problem, mo\u017eete postaviti kern.ipc.tls.enable=0 ili kern.ipc.tls.cbc_enable=0.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:47.linux.asc\">CVE-2026-49424<\/a>. Curjenje podataka (104 bajta) iz steka jezgra prilikom pozivanja linux-compat waitid(), koji zaboravlja nulti neiskori\u0161\u0107eni deo linux-strukture siginfo_t prilikom prebacivanja podataka iz freebsd-ove strukture. U obi\u010dnim GENERIC jezgrama, linux-emulator je po defaultu isklju\u010den i uklju\u010duje se samo ru\u010dnim u\u010ditavanjem modula.<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:48.compat32.asc\">CVE-2026-49425<\/a>. Sli\u010dno prethodnom, 32-bitni kevent zaboravlja nulti 32-bitnu strukturu pre prebacivanja podataka iz nativne 64-bitne, \u0161to dovodi do curenja podataka iz steka. Po defaultu, 32-bitna kompatibilnost u jezgru je uklju\u010dena (nije modul).<\/li>\n<li> <a rel=\"nofollow\" href=\"https:\/\/www.freebsd.org\/security\/advisories\/FreeBSD-SA-26:49.iconv.asc\">CVE-2026-58081, CVE-2026-58082<\/a>. Ranljivosti u iconv. Prva: mnogi njegovi moduli ne proveravaju veli\u010dinu ponu\u0111enog izlaznog bafera pre nego \u0161to zapisuju rezultat (pomenuti HZ, UTF-7, VIQR, ZW). Druga: modul ISO-2022 koristi 6-bajtni bafer u steku za interne operacije, ali u njega mo\u017ee biti zapisano do 10 bajtova, kvare\u0107i stek. Na kraju, pokretanje iconv za konverziju u ili iz jednog od ovih navedenih kodiranja s neproverenim ulaznim podacima mo\u017ee biti podlo\u017eno prepunjenju bafera. <\/li>\n<\/ul>\n<p>Izvor: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18335229\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>2 30 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 13 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041e\u0421 FreeBSD. CVE-2026-49418. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443, \u0438\u043c\u0435\u044e\u0449\u0435\u043c\u0443 memory-mapped \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u043c\u043e\u0436\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c double-free\/use-after-free \u0432 \u044f\u0434\u0440\u0435. \u0412\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u044d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. CVE-2026-49419. (\u0442\u043e\u043b\u044c\u043a\u043e FreeBSD 15+) \u0414\u0432\u043e\u0439\u043d\u043e\u0435 \u0443\u043c\u0435\u043d\u044c\u0448\u0435\u043d\u0438\u0435 refcount \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e jail-\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0434\u0440\u0443\u0433\u043e\u043c\u0443 jail \u043f\u043e jail [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182553","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"2 30 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 13 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041e\u0421.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Emin Berklin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/novye-uyazvimosti-freebsd\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 FreeBSD | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"2 30 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 13 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041e\u0421.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/novye-uyazvimosti-freebsd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-08T20:53:54+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-08T20:53:54+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nove ranjivosti FreeBSD | ProHoster","description":"2 30. lipnja 2026. godine objavljena su obave\u0161tenja o ispravci 13 novih ranjivosti u operativnom sistemu.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/novye-uyazvimosti-freebsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 FreeBSD | ProHoster","og:description":"2 30 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 13 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u041e\u0421.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/novye-uyazvimosti-freebsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-07-08T20:53:54+00:00","article:modified_time":"2026-07-08T20:53:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182553","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:06","updated":"2026-08-05 12:22:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/182553","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=182553"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/182553\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=182553"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=182553"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=182553"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}