https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:36:24 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-14713 bdu:2026-14713 https://cve.radiocsirt.org/vuln/bdu:2026-14713 https://cve.radiocsirt.org/vuln/euvd-2026-360124 EUVD-2026-360124 https://cve.radiocsirt.org/vuln/euvd-2026-360124 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58092 <p>In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely internal to the kernel and not user-visible.</p> <p>One function, group_is_primary(), was not properly updated as a part of this transition. This function is used by mac_do to determine the primary group ID of the credential after applying a transition rule, used when the rule target does not explicitly specify a group.</p> <p>As a result, with certain mac_do rules, it is possible for a credential switch to incorrectly set the primary group ID to the ID stored in the first element of the original credential&#39;s supplementary group array.</p> <p>If the list of supplementary groups is empty, this value will be 0, corresponding to the &#34;wheel&#34; group. For example, a rule such as &#34;uid=1001&gt;uid=1002&#34; can be abused to set the primary group ID to 0 even if the process did not originally belong to group 0.</p> <p>Certain mac_do rules can be abused to set a process&#39; group ID to 0. Note however, that the rule must apply to the caller in order for the bug to be triggered, e.g., given the ruleset &#34;uid=1001&gt;uid=1002&#34;, the user must have user ID 1001 in order to trigger the bug.</p> <p>Further, logged-in users will in general have a non-empty supplementary group list, in which case the bug can at worst be used to set the cred…</p> <p>In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely internal to the kernel and not user-visible.</p> <p>One function, group_is_primary(), was not properly updated as a part of this transition. This function is used by mac_do to determine the primary group ID of the credential after applying a transition rule, used when the rule target does not explicitly specify a group.</p> <p>As a result, with certain mac_do rules, it is possible for a credential switch to incorrectly set the primary group ID to the ID stored in the first element of the original credential&#39;s supplementary group array.</p> <p>If the list of supplementary groups is empty, this value will be 0, corresponding to the &#34;wheel&#34; group. For example, a rule such as &#34;uid=1001&gt;uid=1002&#34; can be abused to set the primary group ID to 0 even if the process did not originally belong to group 0.</p> <p>Certain mac_do rules can be abused to set a process&#39; group ID to 0. Note however, that the rule must apply to the caller in order for the bug to be triggered, e.g., given the ruleset &#34;uid=1001&gt;uid=1002&#34;, the user must have user ID 1001 in order to trigger the bug.</p> <p>Further, logged-in users will in general have a non-empty supplementary group list, in which case the bug can at worst be used to set the cred…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58092 https://cve.radiocsirt.org/vuln/ghsa-ffp5-8472-58q5 <p>In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely internal to the kernel and not user-visible.</p> <p>One function, group_is_primary(), was not properly updated as a part of this transition. This function is used by mac_do to determine the primary group ID of the credential after applying a transition rule, used when the rule target does not explicitly specify a group.</p> <p>As a result, with certain mac_do rules, it is possible for a credential switch to incorrectly set the primary group ID to the ID stored in the first element of the original credential&#39;s supplementary group array.</p> <p>If the list of supplementary groups is empty, this value will be 0, corresponding to the &#34;wheel&#34; group. For example, a rule such as &#34;uid=1001&gt;uid=1002&#34; can be abused to set the primary group ID to 0 even if the process did not originally belong to group 0.</p> <p>Certain mac_do rules can be abused to set a process&#39; group ID to 0. Note however, that the rule must apply to the caller in order for the bug to be triggered, e.g., given the ruleset &#34;uid=1001&gt;uid=1002&#34;, the user must have user ID 1001 in order to trigger the bug.</p> <p>Further, logged-in users will in general have a non-empty supplementary group list, in which case the bug can at worst be used to set the cred…</p> <p>In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely internal to the kernel and not user-visible.</p> <p>One function, group_is_primary(), was not properly updated as a part of this transition. This function is used by mac_do to determine the primary group ID of the credential after applying a transition rule, used when the rule target does not explicitly specify a group.</p> <p>As a result, with certain mac_do rules, it is possible for a credential switch to incorrectly set the primary group ID to the ID stored in the first element of the original credential&#39;s supplementary group array.</p> <p>If the list of supplementary groups is empty, this value will be 0, corresponding to the &#34;wheel&#34; group. For example, a rule such as &#34;uid=1001&gt;uid=1002&#34; can be abused to set the primary group ID to 0 even if the process did not originally belong to group 0.</p> <p>Certain mac_do rules can be abused to set a process&#39; group ID to 0. Note however, that the rule must apply to the caller in order for the bug to be triggered, e.g., given the ruleset &#34;uid=1001&gt;uid=1002&#34;, the user must have user ID 1001 in order to trigger the bug.</p> <p>Further, logged-in users will in general have a non-empty supplementary group list, in which case the bug can at worst be used to set the cred…</p> https://cve.radiocsirt.org/vuln/ghsa-ffp5-8472-58q5 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3034 <p>Ein Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um Berechtigungen zu erweitern und möglicherweise Root-Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, Daten zu manipulieren oder offenzulegen oder Denial-of-Service-Zustände herbeizuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in FreeBSD Project FreeBSD OS ausnutzen, um Berechtigungen zu erweitern und möglicherweise Root-Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, Daten zu manipulieren oder offenzulegen oder Denial-of-Service-Zustände herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3034