freebsd

The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable na…

The command ctl_persistent_reserve_out allows the caller to specify an arbitrary size which will be passed to the kernel's memory allocator.

The NVMe driver queue processing is vulernable to guest-induced infinite loops.

The hda driver is vulnerable to a buffer over-read from a guest-controlled value.

A guest can trigger an infinite loop in the hda audio driver.

The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition.

The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value.

An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary wri…

Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the r…

An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. A maliciou…