FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-28 14:09:37 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
8706e097-6db7-11ee-8744-080027f5fec9	redis -- Possible bypassing Unix socket permissions Redis core team reports: The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup. Discovery 2023-10-18 Entry 2023-10-18 redis < 7.2.2 redis-devel < 7.2.2.20231018 redis70 < 7.0.14 redis62 < 6.2.14 CVE-2023-45145 https://groups.google.com/g/redis-db/c/r81pHa-dcI8
0e254b4a-1f37-11ee-a475-080027f5fec9	redis -- Heap overflow in the cjson and cmsgpack libraries Redis core team reports: A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. Discovery 2023-07-10 Entry 2023-07-10 redis < 7.0.12 redis-devel < 7.0.12.20230710 redis62 < 6.2.13 redis60 < 6.0.20 CVE-2022-24834 https://groups.google.com/g/redis-db/c/JDjKS0GubsQ
96b2d4db-ddd2-11ed-b6ea-080027f5fec9	redis -- HINCRBYFLOAT can be used to crash a redis-server process Redis core team reports: Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that may later crash Redis on access. Discovery 2023-04-17 Entry 2023-05-08 redis < 7.0.11 redis62 < 6.2.12 redis6 < 6.0.19 CVE-2023-28856 https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6

VuXML ID

Description

8706e097-6db7-11ee-8744-080027f5fec9

redis -- Possible bypassing Unix socket permissions

Redis core team reports:

The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup.

Discovery 2023-10-18
Entry 2023-10-18
redis

< 7.2.2

redis-devel

< 7.2.2.20231018

redis70

< 7.0.14

redis62

< 6.2.14

CVE-2023-45145
https://groups.google.com/g/redis-db/c/r81pHa-dcI8

0e254b4a-1f37-11ee-a475-080027f5fec9

redis -- Heap overflow in the cjson and cmsgpack libraries

Redis core team reports:

A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution.

Discovery 2023-07-10
Entry 2023-07-10
redis