From nobody Thu Apr 30 01:46:53 2026 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g5cV536B9z6cMkJ for ; Thu, 30 Apr 2026 01:46:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4g5cV51tFyz4PLj for ; Thu, 30 Apr 2026 01:46:53 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777513613; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=oIL7GMkLlFzbZmrkEo5mneCkwDaeTjcNkrBjA/1rJog=; b=XNb77D7Bwf1dp0eOcAahlH7kaYm/cfZM3N6d3zrkqCVBVt2pLT5J8F+qLMJnQdJx6ICXe9 eVYSazlY+uYLgZkmU/OPWFOq3mooao+YnCN9T0cCaEfisNfz4M1UE9ZEdY3tpXuYiApvC0 Dgv87JTBkfbBLzb9F6AJv324Dvq6ABkMvuG+U6ZKmygVkNZ4hrPgjv1NwAfJX1XhDPHZhG zAFdfiuiiuSw88zqTP/wfd9jmBX8uCHly6JHdv+pdHS4KTg3/0t3wYDTGVLwR6TgTa6bPK oMnBXByYy+D7P9LkJEbBR8/utg80UOTen4uM5s8d8woVHLQwGcUySKTxy8lyAQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1777513613; a=rsa-sha256; cv=none; b=GMDhFLiMm+Gkwu7n9PFznYO8s5ieD/RekR7ECJyM5WmQCyCSbb6+fLDPbLUrqQtOcAKTXb Fox1EFayvEs5wk5YLmEoKLjxM+S+xzk0y2/l+ktjuoduZ6RS3NqtOhIXHFedShwY5lsbUc AoPvz9IshbdkcQq9EjXnftM4J6tX3ROIvaNw5xKaUmWHrt6vNi8HBjfAoRlAS8tGSSU930 xAxwx2s2uJjfqfFJdl/L7lx5pj2sRNwvjCPWYFDDkXAvs8lLTNLLtVUR9L90zIMguIgicr QU5ko4WRlxIrXlT0+eO76LD2eR0+Ac8RyyYfL0zUYfaD0YtCIMGWBxu3BhbW+w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777513613; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=oIL7GMkLlFzbZmrkEo5mneCkwDaeTjcNkrBjA/1rJog=; b=OMRKXrDf/62iFrsbK/Lz6PWjKFbV6YYyVpmfh5oZ3AKkGsA8kiR8JBfjYRbCozrQoDCUJ2 onglOJZrM5hAxHUgrXkl2lgsUhniiV14NbfHtsE5IT/FbNsgfBzjNiDaAbTyiQbJYfeSCR YPP3NFim6NceKjAlikkU9WugF1QRloPfeX/nJUqRoVXmp1+Hea5g/FJqLGiLYST0kne3jV QTngtSWoNXfTS2WVmPTUryRfv1QfXyrRgv7tZdffVl64q5GKNNEbZ+2x6RDpDKMstsuqQ5 Brele1OV+P97kCWZrx2mflHGTyvPcpswNGQlYWhYwOHHQX+DccWQ8ZFhRTLIXw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4g5cV51BQlz15gN for ; Thu, 30 Apr 2026 01:46:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3c280 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 30 Apr 2026 01:46:53 +0000 To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Philip Paeps Subject: git: 0821906582e8 - main - security/vuxml: add FreeBSD SAs issued on 2026-04-29 List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-main@freebsd.org Sender: owner-dev-commits-ports-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: philip X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 0821906582e8c600f537b8e6d74c60ac9babdbf4 Auto-Submitted: auto-generated Date: Thu, 30 Apr 2026 01:46:53 +0000 Message-Id: <69f2b48d.3c280.22db5f4@gitrepo.freebsd.org> The branch main has been updated by philip: URL: https://cgit.FreeBSD.org/ports/commit/?id=0821906582e8c600f537b8e6d74c60ac9babdbf4 commit 0821906582e8c600f537b8e6d74c60ac9babdbf4 Author: Philip Paeps AuthorDate: 2026-04-30 01:43:58 +0000 Commit: Philip Paeps CommitDate: 2026-04-30 01:43:58 +0000 security/vuxml: add FreeBSD SAs issued on 2026-04-29 FreeBSD-SA-26:12.dhclient affects all supported releases FreeBSD-SA-26:13.exec affects all supported releases FreeBSD-SA-26:14.pf affects all supported releases FreeBSD-SA-26:15.dhclient affects all supported releases FreeBSD-SA-26:16.libnv affects all supported releases FreeBSD-SA-26:17.libnv affects all supported releases --- security/vuxml/vuln/2026.xml | 204 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 204 insertions(+) diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml index b97db0d362bc..1119621b055b 100644 --- a/security/vuxml/vuln/2026.xml +++ b/security/vuxml/vuln/2026.xml @@ -1,3 +1,207 @@ + + FreeBSD -- Heap overflow in libnv + + + FreeBSD-kernel + 15.015.0_7 + 14.414.4_3 + 14.314.3_12 + 13.513.5_13 + + + + +

Problem Description:

+

When processing the header of an incoming message, libnv failed + to properly validate the message size.

+

Impact:

+

The lack of validation allows a malicious program to write + outside the bounds of a heap allocation. This can trigger a crash + or system panic, and it may be possible for an unprivileged user + to exploit the bug to elevate their privileges.

+ + + + CVE-2026-35547 + SA-26:17.libnv + + + 2026-04-29 + 2026-04-30 + + + + + FreeBSD -- Stack overflow via select() file descriptor set overflow + + + FreeBSD + 15.015.0_7 + 14.414.4_3 + 14.314.3_12 + 13.513.5_13 + + + + +

Problem Description:

+

When exchanging data over a socket, libnv uses select(2) to + wait for data to arrive. However, it does not verify whether the + provided socket descriptor fits in select(2)'s file descriptor set + size limit of FD_SETSIZE (1024).

+

Impact:

+

An attacker who is able to force a libnv application to allocate + large file descriptors, e.g., by opening many descriptors and + executing a program which is not careful to close them upon startup, + can trigger stack corruption. If the target application is + setuid-root, then this could be used to elevate local privileges.

+ + + + CVE-2026-39457 + SA-26:16.libnv + + + 2026-04-29 + 2026-04-30 + + + + + FreeBSD -- Remotely triggerable out-of-bounds heap write in dhclient + + + FreeBSD + 15.015.0_7 + 14.414.4_3 + 14.314.3_12 + 13.513.5_13 + + + + +

Problem Description:

+

As dhclient is building an environment to pass to dhclient-script, + it may need to resize the array of string pointers. The code which + expands the array incorrectly calculates its new size when requesting + memory, resulting in a heap buffer overrun.

+

Impact:

+

A specially crafted packet can cause dhclient to overrun its + buffer of environment entries. This can result in a crash, but it + may be possible to leverage this bug to achieve remote code + execution.

+ + + + CVE-2026-42512 + SA-26:15.dhclient + + + 2026-04-29 + 2026-04-30 + + + + + FreeBSD -- pf can overflow the stack parsing crafted SCTP packets + + + FreeBSD-kernel + 15.015.0_7 + 14.414.4_3 + 14.314.3_12 + 13.513.5_13 + + + + +

Problem Description:

+

Incorrect packet validation allowed unbounded recursion parsing + SCTP chunk parameters. This can eventually result in a stack + overflow and panic.

+

Impact:

+

Remote attackers can craft packets which cause affected systems + to panic. This affects any system where pf is configured to process + traffic, independent of the configured ruleset.

+ + + + CVE-2026-7164 + SA-26:14.pf + + + 2026-04-29 + 2026-04-30 + + + + + FreeBSD -- Local privilege escalation via execve() + + + FreeBSD-kernel + 15.015.0_7 + 14.414.4_3 + 14.314.3_12 + 13.513.5_13 + + + + +

Problem Description:

+

An operator precedence bug in the kernel results in a scenario + where a buffer overflow causes attacker-controlled data to overwrite + adjacent execve(2) argument buffers.

+

Impact:

+

The bug may be exploitable by an unprivileged user to obtain + superuser privileges.

+ + + + CVE-2026-7270 + SA-26:13.exec + + + 2026-04-29 + 2026-04-30 + + + + + FreeBSD -- Remote code execution via malicious DHCP options + + + FreeBSD + 15.015.0_7 + 14.414.4_3 + 14.314.3_12 + 13.513.5_13 + + + + +

Problem Description:

+

The BOOTP file field is written to the lease file without + escaping embedded double-quotes, allowing injection of arbitrary + dhclient.conf directives. When the lease file is subsequently + re-parsed by dhclient, e.g., after a system restart, an attacker-controlled + field from the lease is passed to dhclient-script(8), which evaluates + it.

+

Impact:

+

A rogue DHCP server may be able to execute arbirary code as + root on a system running dhclient.

+ + + + CVE-2026-42511 + SA-26:12.dhclient + + + 2026-04-29 + 2026-04-30 + + + Mozilla -- Sandbox escape