2. Security Advisories

Problems described in the following security advisories have been fixed in 9.3-RELEASE. For more information, consult the individual advisories available from http://security.FreeBSD.org/.

AdvisoryDateTopic
FreeBSD-SA-14:18.openssl9 September 2014

Multiple vulnerabilities

FreeBSD-SA-14:19.tcp16 September 2014

Denial of Service in TCP packet processing.

FreeBSD-SA-14:20.rtsold21 October 2014

Remote buffer overflow vulnerability.

FreeBSD-SA-14:21.routed21 October 2014

Remote denial of service vulnerability.

FreeBSD-SA-14:22.namei21 October 2014

Memory leak in sandboxed namei lookup.

FreeBSD-SA-14:23.openssl21 October 2014

Multiple vulerabilities.

FreeBSD-SA-14:25.setlogin04 November 2014

Kernel stack disclosure.

FreeBSD-SA-14:26.ftp04 November 2014

Remote code execution.

FreeBSD-SA-14:28.file10 December 2014

Multiple vulnerabilities in file(1) and libmagic(3)

FreeBSD-SA-14:29.bind10 December 2014

Remote denial of service vulnerability

FreeBSD-SA-14:31.ntp23 December 2014

Multiple vulnerabilities

FreeBSD-SA-15:01.openssl14 January 2015

Multiple vulnerabilities

FreeBSD-SA-15:02.kmem27 January 2015

SCTP kernel memory corruption and disclosure vulnerability

FreeBSD-SA-15:03.sctp27 January 2015

SCTP stream reset vulnerability

FreeBSD-SA-15:04.igmp25 February 2015

Integer overflow in IGMP protocol

FreeBSD-SA-15:05.igmp25 February 2015

Remote denial of service vulnerability

FreeBSD-SA-15:06.openssl19 March 2015

Multiple vulnerabilities

FreeBSD-SA-15:07.ntp7 April 2015

Multiple vulnerabilities

FreeBSD-SA-15:09.ipv67 April 2015

Router advertisement Denial of Service

FreeBSD-SA-15:10.openssl16 June 2015

Multiple vulnerabilities

FreeBSD-SA-15:11.bind7 July 2015

Resolver remote denial of service

FreeBSD-SA-15:13.tcp21 July 2015

resource exhaustion due to sessions stuck in LAST_ACK state.

FreeBSD-SA-15:15.tcp28 July 2015

resource exhaustion in TCP reassembly

FreeBSD-SA-15:16.openssh28 July 2015

Multiple vulnerabilities

FreeBSD-SA-15:17.bind28 July 2015

Remote denial of service vulnerability

FreeBSD-SA-15:19.routed5 August 2015

Remote denial of service vulnerability

FreeBSD-SA-15:20.expat18 August 2015

Fix multiple integer overflows in libbsdxml(3).

FreeBSD-SA-15:21.amd6425 August 2015

Fix local privilege escalation in IRET handler.

FreeBSD-SA-15:22.openssh25 August 2015

Multiple vulnerabilities

FreeBSD-SA-15:23.bind2 September 2015

Remote denial of service vulnerability

FreeBSD-SA-15:24.rpcbind29 September 2015

Remote denial of service

FreeBSD-SA-15:25.ntp26 October 2015

Multiple vulnerabilities

FreeBSD-SA-15:26.openssl5 December 2015

Multiple vulnerabilities

FreeBSD-SA-15:27.bind16 December 2015

Remote denial of service

FreeBSD-SA-16:01.sctp14 January 2016

ICMPv6 error message vulnerability

FreeBSD-SA-16:02.ntp14 January 2016

Panic threshold bypass vulnerability

FreeBSD-SA-16:03.linux14 January 2016

Incorrect futex handling

FreeBSD-SA-16:04.linux14 January 2016

setgroups(2) system call vulnerability

FreeBSD-SA-16:05.tcp14 January 2016

MD5 signature denial of service

FreeBSD-SA-16:06.bsnmpd14 January 2016

Insecure default configuration file permissions

FreeBSD-SA-16:07.openssh14 January 2016

OpenSSH client information leak

FreeBSD-SA-16:08.bind27 January 2016

Remote denial of service vulnerability.

FreeBSD-SA-16:09.ntp27 January 2016

Multiple vulnerabilities.

FreeBSD-SA-16:10.linux27 January 2016

issetugid(2) system call vulnerability.

FreeBSD-SA-16:11.openssl30 January 2016

SSLv2 cipher suite downgrade vulnerability.

FreeBSD-SA-16:12.openssl7 March 2016

Multiple vulnerabilities

FreeBSD-SA-16:13.bind10 March 2016

Multiple vulnerabilities

FreeBSD-SA-16:14.openssh-xauth16 March 2016

OpenSSH xauth injection vulnerability

FreeBSD-SA-16:15.sysarch16 March 2016

Incorrect argument validation in sysarch(2)

FreeBSD-SA-16:09.ntp29 April 2016

Multiple ntp vulnerabilities.

FreeBSD-SA-16:17.openssl29 April 2016

Multiple OpenSSL vulnerabilities.

FreeBSD-SA-16:18.atkbd17 May 2016

Keyboard driver buffer overflow

FreeBSD-SA-16:19.sendmsg17 May 2016

Incorrect argument handling in sendmsg(2)

FreeBSD-SA-16:20.linux31 May 2016

Kernel stack disclosure in Linux compatibility layer

FreeBSD-SA-16:21.43bsd31 May 2016

Kernel stack disclosure in 4.3BSD compatibility layer

FreeBSD-SA-16:22.libarchive31 May 2016

Absolute path traversal vulnerability

FreeBSD-SA-16:23.libarchive31 May 2016

Absolute path traversal vulnerability

FreeBSD-SA-16:24.ntp3 June 2016

Multiple ntp vulnerabilties

FreeBSD-SA-16:25.bspatch25 July 2016

heap overflow vulnerability

FreeBSD-SA-16:26.openssl23 September 2016

Multiple vulnerabilities

FreeBSD-SA-16:27.openssl26 September 2016

Regression in OpenSSL suite

FreeBSD-SA-16:28.bind10 October 2016

BIND denial of service

FreeBSD-SA-16:29.bspatch10 October 2016

Heap overflow vulnerability

FreeBSD-SA-16:30.portsnap10 October 2016

Multiple vulnerabilities

FreeBSD-SA-16:31.libarchive10 October 2016

Multiple vulnerabilities

FreeBSD-SA-16:34.bind2 November 2016

Remote Denial of Service vulnerability

FreeBSD-SA-16:35.openssl2 November 2016

Remote Denial of Service vulnerability

All FreeBSD documents are available for download at http://ftp.FreeBSD.org/pub/FreeBSD/doc/

Questions that are not answered by the documentation may be sent to <freebsd-questions@FreeBSD.org>.
Send questions about this document to <freebsd-doc@FreeBSD.org>.