6.5

CVE-2023-5368

On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated data from the underlying disk device, rather than zero bytes.

This may permit a user with write access to files on a msdosfs filesystem to read unintended data (e.g. from a previously deleted file).

Data is provided by the National Vulnerability Database (NVD)
Freebsd ≫ Freebsd Version < 12.4
Freebsd ≫ Freebsd Version >= 13.0 < 13.2
Freebsd ≫ Freebsd Version12.4 Update-
Freebsd ≫ Freebsd Version12.4 Updatep1
Freebsd ≫ Freebsd Version12.4 Updatep2
Freebsd ≫ Freebsd Version12.4 Updatep3
Freebsd ≫ Freebsd Version12.4 Updatep4
Freebsd ≫ Freebsd Version12.4 Updatep5
Freebsd ≫ Freebsd Version13.2 Update-
Freebsd ≫ Freebsd Version13.2 Updatep1
Freebsd ≫ Freebsd Version13.2 Updatep2
Freebsd ≫ Freebsd Version13.2 Updatep3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.13% 0.341
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-1188 Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.