CVE-2018-6920

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In FreeBSD before 11.1-STABLE(r332303), 11.1-RELEASE-p10, 10.4-STABLE(r332321), and 10.4-RELEASE-p9, due to insufficient initialization of memory copied to userland in the Linux subsystem and Atheros wireless driver, small amounts of kernel memory may be disclosed to userland processes. Unprivileged authenticated local users may be able to access small amounts of privileged kernel data.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
FreeBSD	FreeBSD	All supported versions of FreeBSD.

References

http://www.securityfocus.com/bid/104114Third Party Advisory, VDB Entry
https://security.FreeBSD.org/advisories/FreeBSD-EN-18:05.mem.ascVendor Advisory
http://www.securityfocus.com/bid/104114Third Party Advisory, VDB Entry
https://security.FreeBSD.org/advisories/FreeBSD-EN-18:05.mem.ascVendor Advisory

Timeline

Published: May 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-69215.5In FreeBSD before 11.1-STABLE(r332066) and 11.1-RELEASE-p10, due to insufficient initialization of memory copied to userland in the network CVE-2018-69225.3One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-p CVE-2018-69237.5In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is vulnerable to a denial of service due to ex CVE-2018-69247.1In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p3, 11.1-RELEASE-p14, 10.4-STABLE, and 10.4-RELEASE-p12, insufficient validation in the ELF head CVE-2018-69255.5In FreeBSD before 11.2-STABLE(r338986), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338985), and 10.4-RELEASE-p13, due to improper maint CVE-2018-69267.2In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterp CVE-2018-69277.8The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer CVE-2018-69289.8PHP Scripts Mall News Website Script 2.0.4 has SQL Injection via a search term.CVE-2018-69306.5A stack-based buffer over-read in the ComputeResizeImage function in the MagickCore/accelerate.c file of ImageMagick 7.0.7-22 allows a remot CVE-2018-69348.8CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3.CVE-2018-69355.4PHP Scripts Mall Student Profile Management System Script v2.0.6 has XSS via the Name field to list_student.php.CVE-2018-69365.4Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.