kp
c674ede188
pf: IPv6 fragments with malformed extension headers could be erroneously passed by pf or cause a panic ...
We mistakenly used the extoff value from the last packet to patch the
next_header field. If a malicious host sends a chain of fragmented packets
where the first packet and the final packet have different lengths or number of
extension headers we'd patch the next_header at the wrong offset.
This can potentially lead to panics or rule bypasses.
Security: CVE-2019-5597
Obtained from: OpenBSD
Reported by: Corentin Bayet, Nicolas Collignon, Luca Moro at Synacktiv
2019-03-01 07:37:45 +00:00
2019-02-20 09:51:13 +00:00
2019-02-27 22:01:39 +00:00
2019-02-28 14:40:43 +00:00
2019-01-17 06:35:45 +00:00
2019-02-27 21:29:21 +00:00
2019-03-01 05:54:13 +00:00
2019-02-23 20:56:41 +00:00
2019-03-01 04:36:55 +00:00
2019-02-26 19:55:03 +00:00
2019-02-04 21:28:25 +00:00
2019-02-09 21:08:19 +00:00
2019-03-01 02:43:30 +00:00
2019-02-06 06:03:44 +00:00
2019-02-21 02:41:57 +00:00
2019-02-26 19:55:03 +00:00
2019-02-23 21:14:00 +00:00
2019-02-28 19:19:02 +00:00
2018-09-26 17:12:14 +00:00
2019-03-01 01:18:39 +00:00
2019-02-21 01:30:37 +00:00
2019-02-20 20:48:10 +00:00
2019-02-26 19:55:03 +00:00
2019-03-01 04:17:43 +00:00
2019-02-15 18:51:43 +00:00
2019-02-10 23:58:56 +00:00
2019-02-09 03:00:00 +00:00
2019-02-27 20:24:23 +00:00
2019-02-19 19:57:55 +00:00
2018-12-11 19:32:16 +00:00
2019-03-01 07:37:45 +00:00
2018-12-11 19:32:16 +00:00
2019-01-09 01:11:19 +00:00
2019-02-25 19:14:16 +00:00
2019-03-01 04:36:55 +00:00
2019-02-20 09:51:13 +00:00
2019-02-19 11:07:02 +00:00
2019-01-17 06:35:45 +00:00
2019-02-20 09:51:13 +00:00
2019-02-28 18:12:14 +00:00
2019-02-20 02:14:41 +00:00
2019-02-04 21:28:25 +00:00
2018-12-14 23:53:28 +00:00
2019-02-26 04:56:10 +00:00
2019-02-27 22:42:29 +00:00
2019-02-20 09:56:23 +00:00
2019-01-30 11:34:52 +00:00
c674ede188