Vulnerability in kfreebsd-9 package
Summary
DSA-2769-1: kfreebsd-9 - several. Affects kfreebsd-9 versions < 9.0-10+deb70.4. Fixed in 9.0-10+deb70.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kfreebsd-9 package is a part of the Debian 7 ecosystem. It is a kernel package based on the FreeBSD kernel. The package provides the core functionality of the operating system, including device drivers, file systems, and networking. The kfreebsd-9 package is vulnerable to multiple security issues that can lead to denial of service or privilege escalation.
Vulnerability Detail
The vulnerability identified as CVE-2013-5691 allows an unprivileged user to run arbitrary code and perform actions associated with certain ioctl requests on any network interface. This can lead to a denial of service or trigger a kernel panic by passing a specially crafted address structure. The vulnerability identified as CVE-2013-5710 allows a user to create a hardlink from one location in a nullfs instance to a file in another nullfs instance, potentially gaining write access to files on a read-only filesystem.
How To Fix
Minimum fixed version
9.0-10+deb70.4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kfreebsd-9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
The kfreebsd-9 package in the Debian 7 ecosystem is vulnerable to multiple security issues. Upgrading to version 9.0-10+deb70.4 or later is recommended to fix these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for kfreebsd-9 →
FAQ
CVE-2013-5691 can allow an unprivileged user to execute arbitrary code and perform actions on network interfaces, potentially leading to a denial of service or kernel panic.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
No specific workaround has been mentioned for CVE-2013-5710. It is recommended to upgrade the kfreebsd-9 package to the fixed version.
The details provided do not mention any specific remote exploitation vectors. However, it is always recommended to keep software up to date to mitigate potential security risks.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-2769-1 at https://security-tracker.debian.org/tracker/DSA-2769-1.
Related vulnerabilities
Recent vulnerabilities recorded for kfreebsd-9.
