In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3-RELEASE-p6, URL handling in libfetch with URLs containing username and/or password components is vulnerable to a heap buffer overflow allowing program misbehavior or malicious code execution.

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA110068 advisory.

  - In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before     12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3-RELEASE-p6, URL handling in     libfetch with URLs containing username and/or password components is vulnerable to a heap buffer overflow     allowing program misbehavior or malicious code execution. (CVE-2020-7450)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before
    12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3-RELEASE-p6, URL handling in
    libfetch with URLs containing username and/or password components is vulnerable to a heap buffer overflow
    allowing program misbehavior or malicious code execution. (CVE-2020-7450)

A programming error allows an attacker who can specify a URL with a username and/or password components to overflow libfetch(3) buffers.
Impact : An attacker in control of the URL to be fetched (possibly via HTTP redirect) may cause a heap buffer overflow, resulting in program misbehavior or malicious code execution.

A programming error allows an attacker who can specify a URL with a username and/or password components to overflow libfetch(3) buffers.

ID	Name	Product	Family	Severity
325698	Juniper Junos OS Vulnerability (JSA110068)	Nessus	Junos Local Security Checks	critical
427537	Alpine: multiple xbps packages: security update to 0.58-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
427537	Alpine: multiple xbps packages: security update to 0.58-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
133708	FreeBSD : FreeBSD -- libfetch buffer overflow (22b41bc5-4279-11ea-b184-f8b156ac3ff9)	Nessus	FreeBSD Local Security Checks	critical
133328	FreeBSD : pkg -- vulnerability in libfetch (2af10639-4299-11ea-aab1-98fa9bfec35a)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2020-7450

critical

Tenable Plugins

critical

critical

critical

critical

critical