FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-28 14:09:37 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
0e254b4a-1f37-11ee-a475-080027f5fec9redis -- Heap overflow in the cjson and cmsgpack libraries

Redis core team reports:

A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution.


Discovery 2023-07-10
Entry 2023-07-10
redis
< 7.0.12

redis-devel
< 7.0.12.20230710

redis62
< 6.2.13

redis60
< 6.0.20

CVE-2022-24834
https://groups.google.com/g/redis-db/c/JDjKS0GubsQ
6c72b13f-4d1d-11ee-a7f1-080027f5fec9redis -- Possible bypassing ACL configuration

yangbodong22011 reports:

Redis does not correctly identify keys accessed by SORT_RO and, as a result, may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration.


Discovery 2023-09-06
Entry 2023-09-07
redis
ge 7.0.0 lt 7.0.13

ge 7.2.0 lt 7.2.1

redis-devel
< 7.2.0.20230831

redis70
ge 7.0.0 lt 7.0.13

CVE-2023-41053
https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwc
8706e097-6db7-11ee-8744-080027f5fec9redis -- Possible bypassing Unix socket permissions

Redis core team reports:

The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup.


Discovery 2023-10-18
Entry 2023-10-18
redis
< 7.2.2

redis-devel
< 7.2.2.20231018

redis70
< 7.0.14

redis62
< 6.2.14

CVE-2023-45145
https://groups.google.com/g/redis-db/c/r81pHa-dcI8
6fae2d6c-1f38-11ee-a475-080027f5fec9redis -- heap overflow in COMMAND GETKEYS and ACL evaluation

Redis core team reports:

Extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Specifically: using COMMAND GETKEYS* and validation of key names in ACL rules.


Discovery 2023-07-10
Entry 2023-07-10
redis
< 7.0.12

redis-devel
< 7.0.12.20230710

CVE-2023-36824
https://groups.google.com/g/redis-db/c/JDjKS0GubsQ
https://github.com/redis/redis/security/advisories/GHSA-4cfx-h9gq-xpx3