FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-28 14:09:37 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
a60cc0e4-c7aa-11ed-8a4b-080027f5fec9	redis -- specially crafted MSETNX command can lead to denial-of-service Yupeng Yang reports: Authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. Discovery 2023-03-20 Entry 2023-03-21 redis < 7.0.10 redis-devel < 7.0.10.20230320 CVE-2023-28425 https://github.com/redis/redis/security/advisories/GHSA-mvmm-4vq6-vw8c
b17bce48-b7c6-11ed-b304-080027f5fec9	redis -- multiple vulnerabilities The Redis core team reports: CVE-2023-25155 Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. CVE-2022-36021 String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. Discovery 2023-02-28 Entry 2023-03-01 redis < 7.0.9 redis-devel < 7.0.9.20230228 redis62 < 6.2.11 redis6 < 6.0.18 CVE-2023-25155 CVE-2022-36021 https://groups.google.com/g/redis-db/c/3hQ1oTO4hMI
96b2d4db-ddd2-11ed-b6ea-080027f5fec9	redis -- HINCRBYFLOAT can be used to crash a redis-server process Redis core team reports: Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that may later crash Redis on access. Discovery 2023-04-17 Entry 2023-05-08 redis < 7.0.11 redis62 < 6.2.12 redis6 < 6.0.19 CVE-2023-28856 https://github.com/redis/redis/security/advisories/GHSA-hjv8-vjf6-wcr6
6fae2d6c-1f38-11ee-a475-080027f5fec9	redis -- heap overflow in COMMAND GETKEYS and ACL evaluation Redis core team reports: Extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Specifically: using COMMAND GETKEYS* and validation of key names in ACL rules. Discovery 2023-07-10 Entry 2023-07-10 redis < 7.0.12 redis-devel < 7.0.12.20230710 CVE-2023-36824 https://groups.google.com/g/redis-db/c/JDjKS0GubsQ https://github.com/redis/redis/security/advisories/GHSA-4cfx-h9gq-xpx3
0e254b4a-1f37-11ee-a475-080027f5fec9	redis -- Heap overflow in the cjson and cmsgpack libraries Redis core team reports: A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. Discovery 2023-07-10 Entry 2023-07-10 redis < 7.0.12 redis-devel < 7.0.12.20230710 redis62 < 6.2.13 redis60 < 6.0.20 CVE-2022-24834 https://groups.google.com/g/redis-db/c/JDjKS0GubsQ
5fa68bd9-95d9-11ed-811a-080027f5fec9	redis -- multiple vulnerabilities The Redis core team reports: CVE-2022-35977 Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands can drive Redis to OOM panic. CVE-2023-22458 Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands can lead to denial-of-service. Discovery 2023-01-16 Entry 2023-01-16 redis < 7.0.8 redis-devel < 7.0.8.20230116 redis62 < 6.2.9 redis6 < 6.0.17 CVE-2022-35977 CVE-2023-22458 https://github.com/redis/redis/releases/tag/7.0.8
cc42db1c-c65f-11ec-ad96-0800270512f4	redis -- Multiple vulnerabilities Aviv Yahav reports: CVE-2022-24735 By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. CVE-2022-24736 An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. Discovery 2022-04-27 Entry 2022-04-27 redis < 6.2.7 redis-devel < 7.0.0.20220428 redis62 < 6.2.7 CVE-2022-24735 CVE-2022-24736 https://groups.google.com/g/redis-db/c/7iWUlwtoDqU
8706e097-6db7-11ee-8744-080027f5fec9	redis -- Possible bypassing Unix socket permissions Redis core team reports: The wrong order of listen(2) and chmod(2) calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup. Discovery 2023-10-18 Entry 2023-10-18 redis < 7.2.2 redis-devel < 7.2.2.20231018 redis70 < 7.0.14 redis62 < 6.2.14 CVE-2023-45145 https://groups.google.com/g/redis-db/c/r81pHa-dcI8