2.1

CVE-2014-8476

The setlogin function in FreeBSD 8.4 through 10.1-RC4 does not initialize the buffer used to store the login name, which allows local users to obtain sensitive information from kernel memory via a call to getlogin, which returns the entire buffer.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Freebsd ≫ Freebsd Version8.4
Freebsd ≫ Freebsd Version9.0
Freebsd ≫ Freebsd Version9.0 Updatebeta1
Freebsd ≫ Freebsd Version9.0 Updatebeta2
Freebsd ≫ Freebsd Version9.1
Freebsd ≫ Freebsd Version9.2
Freebsd ≫ Freebsd Version9.3
Freebsd ≫ Freebsd Version10.0
Freebsd ≫ Freebsd Version10.1
Freebsd ≫ Freebsd Version10.1 Updaterc1
Freebsd ≫ Freebsd Version10.1 Updaterc2
Freebsd ≫ Freebsd Version10.1 Updaterc3
Freebsd ≫ Freebsd Version10.1 Updaterc4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.07% 0.18
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.