7.5
CVSS
In NetBSD through 9.2, the IPv6 Flow Label generation algorithm employs a weak cryptographic PRNG.
Severity: HIGH
📦
netbsd
Vendor: netbsd
Actively Exploited
0
CISA KEV List
PoC / Exploits
24
Code Available
Total RCEs
9
Remote Access
Total CVEs
492
Total Indexed
Avg. EPSS
3.43%
Exploit Prob.
Security Vulnerability Index
Page 1 / 50
7.5
CVSS
In NetBSD through 9.2, there is an information leak in the TCP ISN (ISS) generation algorithm.
Severity: HIGH
7.5
CVSS
In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures.
Severity: HIGH
7.5
CVSS
In NetBSD through 9.2, the IPv6 fragment ID generation algorithm employs a weak cryptographic PRNG.
Severity: HIGH
7.5
CVSS
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
Severity: HIGH
7.5
CVSS
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different vulnerability than CVE-2011-2393.
Severity: HIGH
7.5
CVSS
Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error in the IEEE80211_IOC_CHANINFO ioctl allows a local unprivileged user to cause the kernel to copy large amounts of kernel memory back to the user, disclosing potentially sensitive information.
Severity: HIGH
9.8
CVSS
The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects NetBSD 7.1 and possibly earlier versions.
Severity: CRITICAL
9.8
CVSS
CVE-2017-1000375
Exploit Found
NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate memory leading to arbitrary code execution. This affects NetBSD 7.1 and possibly earlier versions.
Severity: CRITICAL
9.8
CVSS
A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions.
Severity: CRITICAL