Netbsd vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-45198 ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command.High 7.5 · Oct 5, 2023
• CVE-2021-45489 In NetBSD through 9.2, the IPv6 Flow Label generation algorithm employs a weak cryptographic PRNG.High 7.5 · Dec 24, 2021
• CVE-2021-45488 In NetBSD through 9.2, there is an information leak in the TCP ISN (ISS) generation algorithm.High 7.5 · Dec 24, 2021
• CVE-2021-45487 In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures.High 7.5 · Dec 24, 2021
• CVE-2021-45484 In NetBSD through 9.2, the IPv6 fragment ID generation algorithm employs a weak cryptographic PRNG.High 7.5 · Dec 24, 2021
• CVE-2017-1000378 The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to determinCritical 9.8 · Jun 19, 2017
• CVE-2017-1000375 NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate memory leadCritical 9.8 · Jun 19, 2017
• CVE-2017-1000374 A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid bCritical 9.8 · Jun 19, 2017
• CVE-2016-6253 mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the tHigh 7.8 · Jan 20, 2017
• CVE-2015-8212 CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via crafted arguments, Critical 9.8 · Jan 19, 2017
• CVE-2008-3584 NetBSD 3.0, 3.1, and 4.0, when a pppoe instance exists, does not properly check the length of a PPPoE packet tag, which allows remote attackers to cause a deniaHigh 9.3 · Sep 11, 2008
• CVE-2008-1335 The ipsec4_get_ulp function in the kernel in NetBSD 2.0 through 3.1 and NetBSD-current before 20071028, when the fast_ipsec subsystem is enabled, allows remote High 9.3 · Mar 13, 2008
• CVE-2007-1523 Heap-based buffer overflow in the kernel in NetBSD 3.0, certain versions of FreeBSD and OpenBSD, and possibly other BSD derived operating systems allows local uHigh 7.5 · Mar 20, 2007
• CVE-2006-6014 The NetBSD-current kernel before 20061028 does not properly perform bounds checking of an unspecified userspace parameter in the ptrace system call during a PT_High 7.2 · Nov 21, 2006
• CVE-2005-4741 NetBSD 1.6, NetBSD 2.0 through 2.1, and NetBSD-current before 20051031 allows local users to gain privileges by attaching a debugger to a setuid/setgid (P_SUGIDHigh 7.5 · Dec 31, 2005
• CVE-2005-4776 Integer overflow in the FreeBSD compatibility code (freebsd_misc.c) in NetBSD-current, NetBSD-3, NetBSD-2.0, and NetBSD-2 before 20050913; and NetBSD-1.6 beforeHigh 7.2 · Dec 31, 2005
• CVE-2004-1374 Multiple buffer overflows in NetBSD kernel may allow local users to execute arbitrary code and gain privileges.High 7.2 · Dec 18, 2004
• CVE-2002-1500 Buffer overflow in (1) mrinfo, (2) mtrace, and (3) pppd in NetBSD 1.4.x through 1.6 allows local users to gain privileges by executing the programs after fillinHigh 7.2 · Apr 2, 2003
• CVE-2002-1194 Buffer overflow in talkd on NetBSD 1.6 and earlier, and possibly other operating systems, may allow remote attackers to execute arbitrary code via a long inbounHigh 7.5 · Oct 28, 2002
• CVE-2001-0734 Hitachi Super-H architecture in NetBSD 1.5 and 1.4.1 allows a local user to gain privileges via modified Status Register contents, which are not properly handleHigh 7.2 · Oct 18, 2001
• CVE-2001-1091 The (1) dump and (2) dump_lfs commands in NetBSD 1.4.x through 1.5.1 do not properly drop privileges, which could allow local users to gain privileges via the RHigh 7.2 · Aug 23, 2001
• CVE-2001-0268 The i386_set_ldt system call in NetBSD 1.5 and earlier, and OpenBSD 2.8 and earlier, when the USER_LDT kernel option is enabled, does not validate a call gate tHigh 7.2 · May 3, 2001
• CVE-2000-0997 Format string vulnerabilities in eeprom program in OpenBSD, NetBSD, and possibly other operating systems allows local attackers to gain root privileges.High 7.2 · Dec 19, 2000
• CVE-2000-0750 Buffer overflow in mopd (Maintenance Operations Protocol loader daemon) allows remote attackers to execute arbitrary commands via a long file name.High 7.5 · Oct 20, 2000
• CVE-2000-0751 mopd (Maintenance Operations Protocol loader daemon) does not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary High 7.5 · Oct 20, 2000