PatchTheCVEnetbsd vulnerabilities
Recent CVEs affecting netbsd products. 9 tracked.
netbsd has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2023-10-05. Highest priority: CVE-2012-5365 (score 53/100).
- CVE-2023-45198 HIGH 7.5 UPGRADE UPGRADE ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an
- CVE-2021-45489 HIGH 7.5 UPGRADE In NetBSD through 9.2, the IPv6 Flow Label generation algorithm employs a weak cryptographic PRNG.
- CVE-2021-45488 HIGH 7.5 UPGRADE In NetBSD through 9.2, there is an information leak in the TCP ISN (ISS) generation algorithm.
- CVE-2021-45487 HIGH 7.5 UPGRADE In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures.
- CVE-2021-45484 HIGH 7.5 UPGRADE In NetBSD through 9.2, the IPv6 fragment ID generation algorithm employs a weak cryptographic PRNG.
- CVE-2020-26139 MEDIUM 5.3 MITIGATE MITIGATE An issue was discovered in the kernel in NetBSD 7.1
- CVE-2012-5365 HIGH 7.5 UPGRADE UPGRADE The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attacker
- CVE-2012-5363 HIGH 7.5 UPGRADE UPGRADE The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attacker
- CVE-2011-2480 HIGH 7.5 UPGRADE MITIGATE Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using
FAQ
How do I fix netbsd vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is netbsd being exploited right now?
None of the tracked netbsd CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which netbsd CVE should I patch first?
CVE-2012-5365 currently ranks highest (53/100): The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attacker.