https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:34:48 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-08252 bdu:2026-08252 https://cve.radiocsirt.org/vuln/bdu:2026-08252 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0716 certfr-2026-avi-0716 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0716 https://cve.radiocsirt.org/vuln/euvd-2026-330855 EUVD-2026-330855 https://cve.radiocsirt.org/vuln/euvd-2026-330855 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45257 <p>The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile(2), which can reference file-backed memory directly through non-anonymous M_EXTPG pages or EXT_SFBUF mbufs. When the sender transmits such data over a loopback connection without enabling KTLS on the transmit side, the file-backed mbufs reach the receiver&#39;s decryption path unchanged. Decrypting a record in place then overwrites the backing file&#39;s page cache instead of a private copy of the data.</p> <p>An unprivileged local user who can read a file can overwrite its contents with data of their choosing by sending the file over a loopback connection on which they have enabled KTLS receive. The write modifies the page cache directly, so it bypasses file flags such as schg and is written back to disk. By overwriting a setuid binary or other trusted file, a local user can escalate privileges, potentially gaining full control of the affected system.</p> <p>The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile(2), which can reference file-backed memory directly through non-anonymous M_EXTPG pages or EXT_SFBUF mbufs. When the sender transmits such data over a loopback connection without enabling KTLS on the transmit side, the file-backed mbufs reach the receiver&#39;s decryption path unchanged. Decrypting a record in place then overwrites the backing file&#39;s page cache instead of a private copy of the data.</p> <p>An unprivileged local user who can read a file can overwrite its contents with data of their choosing by sending the file over a loopback connection on which they have enabled KTLS receive. The write modifies the page cache directly, so it bypasses file flags such as schg and is written back to disk. By overwriting a setuid binary or other trusted file, a local user can escalate privileges, potentially gaining full control of the affected system.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45257 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1871 <p>Ein lokaler Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um erweiterte Rechte zu erlangen – möglicherweise sogar Administratorrechte –, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder andere, nicht näher definierte Angriffe durchzuführen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um erweiterte Rechte zu erlangen – möglicherweise sogar Administratorrechte –, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder andere, nicht näher definierte Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1871