6.8

CVE-2019-5605

In FreeBSD 11.3-STABLE before r350217, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, due to insufficient initialization of memory copied to userland in the freebsd32_ioctl interface, small amounts of kernel memory may be disclosed to userland processes. This may allow an attacker to leverage this information to obtain elevated privileges either directly or indirectly.

Data is provided by the National Vulnerability Database (NVD)
Freebsd ≫ Freebsd Version11.0 Update-
Freebsd ≫ Freebsd Version11.2 Update-
Freebsd ≫ Freebsd Version11.2 Updatep10
Freebsd ≫ Freebsd Version11.2 Updatep11
Freebsd ≫ Freebsd Version11.2 Updatep2
Freebsd ≫ Freebsd Version11.2 Updatep3
Freebsd ≫ Freebsd Version11.2 Updatep4
Freebsd ≫ Freebsd Version11.2 Updatep5
Freebsd ≫ Freebsd Version11.2 Updatep6
Freebsd ≫ Freebsd Version11.2 Updatep7
Freebsd ≫ Freebsd Version11.2 Updatep8
Freebsd ≫ Freebsd Version11.2 Updatep9
Freebsd ≫ Freebsd Version11.2 Updaterc3
Freebsd ≫ Freebsd Version11.3 Update-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.07% 0.757
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 6.8 8 6.9
AV:N/AC:L/Au:S/C:C/I:N/A:N
CWE-665 Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.