CVE-2009-1935

MediumCVSS 4.9/10Last modified Jun 16, 2026

Description

Integer overflow in the pipe_build_write_buffer function (sys/kern/sys_pipe.c) in the direct write optimization feature in the pipe implementation in FreeBSD 7.1 through 7.2 and 6.3 through 6.4 allows local users to bypass virtual-to-physical address lookups and read sensitive information in memory pages via unspecified vectors.

Metrics

CVSS 2.0 4.9/10AV:L/AC:L/Au:N/C:C/I:N/A:N

Weakness enumeration

CWE-189

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/55044
http://secunia.com/advisories/35398Vendor Advisory
http://security.freebsd.org/advisories/FreeBSD-SA-09:09.pipe.ascPatch, Vendor Advisory
http://security.freebsd.org/patches/SA-09:09/pipe.patchExploit, Vendor Advisory
http://www.securityfocus.com/bid/35279
http://www.securitytracker.com/id?1022365
https://exchange.xforce.ibmcloud.com/vulnerabilities/51109
http://osvdb.org/55044
http://secunia.com/advisories/35398Vendor Advisory
http://security.freebsd.org/advisories/FreeBSD-SA-09:09.pipe.ascPatch, Vendor Advisory
http://security.freebsd.org/patches/SA-09:09/pipe.patchExploit, Vendor Advisory
http://www.securityfocus.com/bid/35279
http://www.securitytracker.com/id?1022365
https://exchange.xforce.ibmcloud.com/vulnerabilities/51109

Timeline

Published: Jun 18, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-19369.8_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows re CVE-2009-19374.3Cross-site scripting (XSS) vulnerability in the comment posting feature in LightNEasy 2.2.1 "no database" (aka flat) and 2.2.2 SQLite allows CVE-2009-19384.3Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via CVE-2009-19394.3Cross-site scripting (XSS) vulnerability in the JA_Purity template for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitr CVE-2009-19404.3Cross-site scripting (XSS) vulnerability in the administrator panel in the com_users core component for Joomla! 1.5.x through 1.5.10 allows CVE-2009-19415.0PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attacker CVE-2009-19423.5Cross-site scripting (XSS) vulnerability in the Quiz module 5.x, 6.x-2.x before 6.x-2.2, and 6.x-3.x before 6.x-3.0, a module for Drupal, al CVE-2009-194310.0Stack-based buffer overflow in the IKE service (ireIke.exe) in SafeNet SoftRemote before 10.8.6 allows remote attackers to execute arbitrary CVE-2009-19449.3Stack-based buffer overflow in AIMP 2.51 build 330 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3 tag.CVE-2009-19457.5SQL injection vulnerability in webCal3_detail.asp in WebCal 3.04 allows remote attackers to execute arbitrary SQL commands via the event_id CVE-2009-19466.8PHP remote file inclusion vulnerability in latestposts.php in AdaptBB 1.0, when register_globals is enabled, allows remote attackers to exec CVE-2009-19477.5SQL injection vulnerability in the UnbDbEncode function in unb_lib/database.lib.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote atta