7.5Hoch

CVE-1999-0052

bsdi bsd_os; freebsd freebsd; openbsd openbsd Veröffentlicht: 1999-09-29 07:00 (vor 27 Jahren)

Beschreibung

IP fragmentation denial of service in FreeBSD allows a remote attacker to cause a crash.

Schwachstellentyp (CWE): CWE-476

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
bsdi	bsd_os	4.0
freebsd	freebsd	1.1.5.1
openbsd	openbsd	2.2

Referenzen und Patches

freebsd-ip-frag-dos(1389) vdb-entry
908 vdb-entry

CVSS-Score

7.5Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Keine
Integrität: Keine
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

2.14%

höher als 82 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: yes
Technische Auswirkung: partial

Zeitverlauf

ID reserviert1999-06-07
Veröffentlicht1999-09-29 07:00
Bei IP-DB eingegangen2026-10-24 23:57
Zuletzt aktualisiert2024-08-01 23:32

Vergeben von (CNA): mitre

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — FreeBSD

7.0Hoch

CVE-2026-101311 vor 24 Tagen

Multiple vulnerabilities in bhyve device models

FreeBSD FreeBSD

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and th…

7.0Hoch

CVE-2026-101310 vor 24 Tagen

Multiple vulnerabilities in bhyve device models

FreeBSD FreeBSD

The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by t…

7.0Hoch

CVE-2026-101309 vor 24 Tagen

Multiple vulnerabilities in bhyve device models

FreeBSD FreeBSD

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by th…

5.5Mittel

CVE-2026-101308 vor 24 Tagen

TOCTOU race between sound(4) buffer resizing and mmap

FreeBSD FreeBSD

When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the r…

8.2Hoch

CVE-2026-101307 vor 24 Tagen

Remotely triggerable buffer overflow in tcp_rack

FreeBSD FreeBSD

When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buff…

7.5Hoch

CVE-2026-101303 vor 24 Tagen

IPv6 UDP sendto(2) bypasses jail loopback restriction

FreeBSD FreeBSD

The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv…