Out-of-bounds write in FreeBSD
Priority MEDIUM 45CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-787, CWE-863 and the CVSS impact.
Summary
In FreeBSD 12.0-STABLE before r349628, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349629, 11.3-RC3 before 11.3-RC3-p1, and 11.2-RELEASE before 11.2-RELEASE-p11, a bug in the cdrom driver allows users with read access to the cdrom device to arbitrarily overwrite kernel memory when media is present thereby allowing a malicious user in the operator group to gain root privileges.
Why it matters now
EPSS 0.04015 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FreeBSD | FreeBSD | FreeBSD 12.0 before 12.0-RELEASE-p7 and 11.2 before 11.2-RELEASE-p11 | — | No fix listed | CNA |
- FreeBSD VendorFreeBSD Affected FreeBSD 12.0 before 12.0-RELEASE-p7 and 11.2 before 11.2-RELEASE-p11 Fixed in — No fix listed CNA
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:freebsd:freebsd:11.2:-:*:*:*:*:*:* | 11.2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:11.2:p10:*:*:*:*:*:* | 11.2 p10 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:11.2:p2:*:*:*:*:*:* | 11.2 p2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:11.2:p3:*:*:*:*:*:* | 11.2 p3 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:11.2:p4:*:*:*:*:*:* | 11.2 p4 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:11.2:p5:*:*:*:*:*:* | 11.2 p5 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:11.2:p6:*:*:*:*:*:* | 11.2 p6 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:11.2:p7:*:*:*:*:*:* | 11.2 p7 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:11.2:p9:*:*:*:*:*:* | 11.2 p9 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:11.2:rc3:*:*:*:*:*:* | 11.2 rc3 | Vulnerable | FreeBSD |
- cpe:2.3:o:freebsd:freebsd:11.2:-:*:*:*:*:*:* Versions 11.2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:11.2:p10:*:*:*:*:*:* Versions 11.2 p10 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:11.2:p2:*:*:*:*:*:* Versions 11.2 p2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:11.2:p3:*:*:*:*:*:* Versions 11.2 p3 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:11.2:p4:*:*:*:*:*:* Versions 11.2 p4 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:11.2:p5:*:*:*:*:*:* Versions 11.2 p5 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:11.2:p6:*:*:*:*:*:* Versions 11.2 p6 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:11.2:p7:*:*:*:*:*:* Versions 11.2 p7 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:11.2:p9:*:*:*:*:*:* Versions 11.2 p9 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:11.2:rc3:*:*:*:*:*:* Versions 11.2 rc3 Vulnerable ·FreeBSD
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:freebsd:freebsd:11.3:rc3:*:*:*:*:*:* | 11.3 rc3 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.0:-:*:*:*:*:*:* | 12.0 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.0:p1:*:*:*:*:*:* | 12.0 p1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.0:p2:*:*:*:*:*:* | 12.0 p2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.0:p3:*:*:*:*:*:* | 12.0 p3 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.0:p4:*:*:*:*:*:* | 12.0 p4 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.0:p5:*:*:*:*:*:* | 12.0 p5 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:12.0:p6:*:*:*:*:*:* | 12.0 p6 | Vulnerable | FreeBSD |
- cpe:2.3:o:freebsd:freebsd:11.3:rc3:*:*:*:*:*:* Versions 11.3 rc3 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.0:-:*:*:*:*:*:* Versions 12.0 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.0:p1:*:*:*:*:*:* Versions 12.0 p1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.0:p2:*:*:*:*:*:* Versions 12.0 p2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.0:p3:*:*:*:*:*:* Versions 12.0 p3 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.0:p4:*:*:*:*:*:* Versions 12.0 p4 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.0:p5:*:*:*:*:*:* Versions 12.0 p5 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:12.0:p6:*:*:*:*:*:* Versions 12.0 p6 Vulnerable ·FreeBSD
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5602
- 2026-10-03 Alias added: GHSA-f993-7vhh-q9rj
References
More Freebsd vulnerabilities
- TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
- TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
- TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
- TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
- TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
- TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
Sources
- CVE-2019-5602 · CVE Program
- CVE-2019-5602 · NVD
- FIRST EPSS
- GHSA-f993-7vhh-q9rj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences