CVE-2017-1087
HighSummary
In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24 named paths are globally scoped, allowing processes in one jail to read and modify the content of POSIX shared memory objects created by processes in another jail or the host system.
Risk Assessment
A malicious user with access to a jailed system can abuse shared memory, potentially leading to Denial of Service or local privilege escalation.
Recommendation
It is recommended to update the system to versions 10.4-STABLE, 10.4-RELEASE-p3, or 10.3-RELEASE-p24 to mitigate this vulnerability.
Other vulnerabilities in FreeBSD 10.x
See all- CVE-2016-1882High
FreeBSD versions 9.3 before p33, 10.1 before p26, and 10.2 before p9 allow remote attackers to cause a denial of service (kernel crash) via vectors related to creating a TCP connection with the TCP_MD5SIG and TCP_NOOPT socket options.
- CVE-2015-1414High
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10, 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
- CVE-2026-49419High
Vulnerability in FreeBSD's kern_jail_set() and kern_jail_get() when the JAIL_AT_DESC flag is used. Double release of the caller's current prison reference can lead to a reference count underflow and use-after-free.
- CVE-2026-49418High
Vulnerability in FreeBSD kernel when msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object. Physical pages are marked invalid but remain in the pager's list, leading to a double free on object destruction.
- CVE-2026-49415High
Vulnerability in FreeBSD during execve(2) of SUID binaries. The new virtual address space is installed before credentials are updated, allowing another process of the same user to access memory via procfs or linprocfs.
- CVE-2026-45259Medium
A vulnerability in the sigqueue(2) implementation in FreeBSD allows a process in capability mode to send signals to any process, bypassing Capsicum sandbox restrictions. The missing check for the target PID being the calling process's own enables an attacker to interfere with other processes.
- CVE-2026-45255High
When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build a list of network names and use bsddialog(1) to prompt the user to select a network. The shell script implementation did not prevent shell expansion. As a result, a suitably crafted network name can be used to execute commands via a subshell. The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker needs to create an access point with a specially crafted name and be within range of a Wi-Fi scan. bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan, without needing to select the malicious network.
- CVE-1999-0963High
The mount_union command in FreeBSD allows local users to gain root privileges via a symlink attack.
- CVE-1999-0052High
CVE-1999-0052 concerns IP fragmentation in FreeBSD that can lead to system crashes. A remote attacker can exploit this vulnerability to cause unexpected system downtime.
- CVE-1999-0053Medium
CVE-1999-0053 is a denial of service (DoS) vulnerability in FreeBSD that exploits TCP RST packets. An attacker can remotely initiate a connection reset, leading to service disruption.
Original NVD description (English source)
In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24 named paths are globally scoped, meaning a process located in one jail can read and modify the content of POSIX shared memory objects created by a process in another jail or the host system. As a result, a malicious user that has access to a jailed system is able to abuse shared memory by injecting malicious content in the shared memory region. This memory region might be executed by applications trusting the shared memory, like Squid. This issue could lead to a Denial of Service or local privilege escalation.