From de60c20fa79bd41465dd373f777c0e37df0cf7ca Mon Sep 17 00:00:00 2001 From: Philip Paeps Date: Wed, 17 Dec 2025 09:43:45 +0800 Subject: [PATCH] security/vuxml: add FreeBSD SAs issued on 2025-12-17 FreeBSD-SA-25:11.ipfw affects FreeBSD 13.5 and FreeBSD 14.3 FreeBSD-SA-25:12.rtsold affects all supported versions of FreeBSD --- security/vuxml/vuln/2025.xml | 70 ++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index a93382a51d76..5e142e5d9e79 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,3 +1,73 @@ + + FreeBSD -- Remote code execution via ND6 Router Advertisements + + + FreeBSD + 15.015.0_1 + 14.314.3_7 + 13.513.5_8 + + + + +

Problem Description:

+

The rtsol(8) and rtsold(8) programs do not validate the domain + search list options provided in router advertisement messages; the + option body is passed to resolvconf(8) unmodified.

+

resolvconf(8) is a shell script which does not validate its input. + A lack of quoting meant that shell commands pass as input to + resolvconf(8) may be executed.

+

Impact:

+

Systems running rtsol(8) or rtsold(8) are vulnerable to remote + code execution from systems on the same network segment. In + particular, router advertisement messages are not routable and + should be dropped by routers, so the attack does not cross network + boundaries.

+ + + + CVE-2025-14558 + SA-25:12.rtsold + + + 2025-12-16 + 2025-12-17 + + + + + FreeBSD -- ipfw denial of service + + + FreeBSD-kernel + 15.015.0_1 + 14.314.3_7 + 13.513.5_8 + + + + +

Problem Description:

+

In some cases, the `tcp-setmss` handler may free the packet + data and throw an error without halting the rule processing engine. + A subsequent rule can then allow the traffic after the packet data + is gone, resulting in a NULL pointer dereference.

+

Impact:

+

Maliciously crafted packets sent from a remote host may result + in a Denial of Service (DoS) if the `tcp-setmss` directive is used + and a subsequent rule would allow the traffic to pass.

+ + + + CVE-2025-14769 + SA-25:11.ipfw + + + 2025-12-16 + 2025-12-17 + + + Roundcube -- Multiple vulnerabilities