{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenBSD 6.6 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD 6.5 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-19521",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-19521"
    },
    {
      "name": "CVE-2019-19522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-19522"
    },
    {
      "name": "CVE-2019-19520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-19520"
    },
    {
      "name": "CVE-2019-19519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-19519"
    }
  ],
  "initial_release_date": "2019-12-05T00:00:00",
  "last_revision_date": "2019-12-05T00:00:00",
  "links": [],
  "reference": "CERTFR-2019-AVI-606",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-12-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans OpenBSD. Elles\npermettent \u00e0 un attaquant de provoquer un contournement de la politique\nde s\u00e9curit\u00e9 et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans OpenBSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenBSD 6.6 du 04 d\u00e9cembre 2019",
      "url": "https://www.openbsd.org/errata66.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenBSD 6.5 du 04 d\u00e9cembre 2019",
      "url": "https://www.openbsd.org/errata65.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenBSD 4.4 ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD 4.5",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD 4.3 ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans le pare-feu Packet Filter\nd\u0027OpenBSD. L\u0027exploitation de vuln\u00e9rabilit\u00e9 permet \u00e0 un utilisateur\nmalintentionn\u00e9, via un paquet sp\u00e9cialement construit, de r\u00e9aliser un\nd\u00e9ni de service \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2009-04-14T00:00:00",
  "last_revision_date": "2009-04-14T00:00:00",
  "links": [],
  "reference": "CERTA-2009-AVI-136",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-04-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 permettant de r\u00e9aliser un d\u00e9ni de service a \u00e9t\u00e9\ncorrig\u00e9e dans \u003cspan class=\"textit\"\u003eOpenBSD\u003c/span\u003e.\n",
  "title": "Vuln\u00e9rabilit\u00e9 du pare-feu Packet Filter d\u0027OpenBSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de mise \u00e0 jour OpenBSD du 11 avril 2009",
      "url": "http://openbsd.org/errata43.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenBSD 4.4.",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD 4.3 ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 est pr\u00e9sente dans le service de routage dynamique\nOpenBGP de OpenBSD. Celle-ci est due \u00e0 une mauvaise gestion des pr\u00e9fixes\nde certains chemins d\u0027AS (Autonomous System) qui se trouvent corrompus\ninduisant un arr\u00eat inopin\u00e9 du service.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2009-02-20T00:00:00",
  "last_revision_date": "2009-02-20T00:00:00",
  "links": [
    {
      "title": "Correctifs de s\u00e9curit\u00e9 OpenBSD pour openbgpd du 18 f\u00e9vrier    2009 :",
      "url": "http://openbsd.org/errata44.html#010_bgpd"
    },
    {
      "title": "Correctifs de s\u00e9curit\u00e9 OpenBSD pour openbgpd du 18 f\u00e9vrier    2009 :",
      "url": "http://openbsd.org/errata43.html#010_bgpd"
    }
  ],
  "reference": "CERTA-2009-AVI-074",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-02-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 pr\u00e9sente dans OpenBSD permet \u00e0 un utilisateur distant\nde provoquer un d\u00e9ni de service.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenBSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenBSD du 18 f\u00e9vrier 2009",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ftpd sur OpenBSD ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "ftpd sur NetBSD.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 dans la gestion de requ\u00eates longues dans ftpd permet \u00e0\nune personne malintentionn\u00e9e de r\u00e9aliser des attaques de type cross-site\nrequest forgery. Cette vuln\u00e9rabilit\u00e9 est la m\u00eame que celle d\u00e9crite dans\nl\u0027avis CERTA-2008-AVI-471.\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 des \u00e9diteurs pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-4247",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-4247"
    }
  ],
  "initial_release_date": "2008-10-30T00:00:00",
  "last_revision_date": "2008-10-30T00:00:00",
  "links": [
    {
      "title": "Correction dans le CVS de OpenBSD :",
      "url": "http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftpd/ftpd.c?rev=1.184"
    },
    {
      "title": "Avis CERTA-2008-AVI-471 du 23 septembre 2008 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2008-AVI-471/CERTA-2008-AVI-471.html"
    }
  ],
  "reference": "CERTA-2008-AVI-531",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-10-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans ftpd permet \u00e0 une personne malintentionn\u00e9e\nd\u0027effectuer une attaque de type \u003cspan class=\"textit\"\u003ecross-site request\nforgery\u003c/span\u003e.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans ftpd",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 NetBSD 2008-014",
      "url": "ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-014.txt.asc"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenBSD 3.x ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD 4.0 ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLe syst\u00e8me OpenBSD peut utiliser le protocole IPv6. Le traitement des\nrequ\u00eates ICMP6 echo malform\u00e9es est d\u00e9fectueux. Un utilisateur\nmalveillant peut r\u00e9aliser un d\u00e9ni de service \u00e0 distance en provoquant\nune boucle infinie sur le serveur vuln\u00e9rable.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2007-0343",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0343"
    }
  ],
  "initial_release_date": "2007-01-19T00:00:00",
  "last_revision_date": "2007-01-19T00:00:00",
  "links": [
    {
      "title": "Correctif de s\u00e9curit\u00e9 OpenBSD pour icmp6 du 16 janvier 2007    :",
      "url": "http://openbsd.org/errata.html#icmp6"
    }
  ],
  "reference": "CERTA-2007-AVI-040",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-01-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 d\u0027\u003cspan class=\"textit\"\u003eOpenBSD\u003c/span\u003e permettrait de\nprovoquer un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 IPv6 sur OpenBSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "CVE-2007-0343",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0343"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenBSD version 3.9 ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD version 4.0.",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans le driver vga d\u0027OpenBSD. Un\nutilisateur malintentionn\u00e9 peut exploiter cette vuln\u00e9rabilit\u00e9, pr\u00e9sente\nsi le noyau a \u00e9t\u00e9 compil\u00e9 avec l\u0027option PCIAGP, afin d\u0027obtenir les\nprivil\u00e8ges de l\u0027administrateur (root).\n\nCette vuln\u00e9rabilit\u00e9 n\u0027est pr\u00e9sente que pour les architectures i386, et\nseulement si la carte graphique n\u0027est pas une carte AGP.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2007-01-05T00:00:00",
  "last_revision_date": "2007-01-05T00:00:00",
  "links": [
    {
      "title": "Correctif de s\u00e9curit\u00e9 OpenBSD du 03 janvier 2007 :",
      "url": "http://openbsd.org/errata.html"
    }
  ],
  "reference": "CERTA-2007-AVI-006",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-01-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenBSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de mise \u00e0 jour OpenBSD du 3 Janvier 2007",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenBSD version 3.9 ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD version 4.0.",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans l\u0027\u00e9diteur de liens dynamique\nld.so au format ex\u00e9cutable ELF, pour les versions 3.9 et 4.0 d\u0027OpenBSD.\nIl n\u0027effacerait pas correctement l\u0027environnement dans lequel il\ns\u0027ex\u00e9cute. Une personne locale au syst\u00e8me pourrait exploiter cette\nvuln\u00e9rabilit\u00e9, afin de contourner des mesures de s\u00e9curit\u00e9, et, sous\ncertaines conditions, d\u0027\u00e9lever ses privil\u00e8ges.\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux mises \u00e0 jour de l\u0027\u00e9diteur pour l\u0027obtention des correctifs\n(cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2006-11-22T00:00:00",
  "last_revision_date": "2006-11-22T00:00:00",
  "links": [
    {
      "title": "Correctifs de s\u00e9curit\u00e9 OpenBSD pour ELF ld.so du    19 novembre 2006 :",
      "url": "http://openbsd.org/errata.html#39"
    },
    {
      "title": "Correctifs de s\u00e9curit\u00e9 OpenBSD pour ELF ld.so du    19 novembre 2006 :",
      "url": "http://openbsd.org/errata.html"
    }
  ],
  "reference": "CERTA-2006-AVI-509",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-11-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenBSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Mises \u00e0 jour OpenBSD du 19 novembre 2006",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenBSD 3.9.",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD 3.8 ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans la fonction systrace sous\nOpenBSD. Cette vuln\u00e9rabilit\u00e9, due \u00e0 un d\u00e9bordement de taille d\u0027entier\n(Integer Overflow). Un utilisateur mal intentionn\u00e9 peut exploiter cette\nvuln\u00e9rabilit\u00e9 afin de provoquer un d\u00e9ni de service et/ou d\u0027\u00e9lever ses\nprivil\u00e8ges en local.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2006-10-11T00:00:00",
  "last_revision_date": "2006-10-11T00:00:00",
  "links": [
    {
      "title": "Correctif de s\u00e9curit\u00e9 OpenBSD pour systrace du 07 octobre    2006 :",
      "url": "http://openbsd.org/errata.html#systrace"
    }
  ],
  "reference": "CERTA-2006-AVI-449",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-10-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 de systrace sous OpenBSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenBSD du 07 octobre 2006",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenBSD 3.5.",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD 3.4 ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUn d\u00e9bordement de m\u00e9moire existe dans le code procfs du noyau OpenBSD.\nCette vuln\u00e9rabilit\u00e9 permet \u00e0 un utilisateur local mal intentionn\u00e9 de\nporter atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es ou de r\u00e9aliser un d\u00e9ni\nde service.\n\n## Solution\n\nAppliquer le correctif fourni par OpenBSD puis recompiler le noyau\nOpenBSD.\n\n-   Pour la version OpenBSD 3.4 :\n\n        ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/020_procfs.patch\n\n-   Pour la version OpenBSD 3.5 :\n\n        ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/006_procfs.patch\n",
  "cves": [],
  "initial_release_date": "2004-05-13T00:00:00",
  "last_revision_date": "2004-05-13T00:00:00",
  "links": [],
  "reference": "CERTA-2004-AVI-164",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2004-05-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service local"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans le noyau OpenBSD permet \u00e0 un utilisateur mal\nintentionn\u00e9 d\u0027avoir acc\u00e8s \u00e0 des donn\u00e9es non autoris\u00e9es ou de r\u00e9aliser un\nd\u00e9ni de service local.\n",
  "title": "Vuln\u00e9rabilit\u00e9 du noyau OpenBSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 OpenBSD du 13 mai 2004",
      "url": "http://www.openbsd.org/errata34.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenBSD 3.4 et versions ant\u00e9rieures ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD-current du 17 mars 2004 et versions ant\u00e9rieures.",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nisakmpd est un service de gestion des clefs IKE. isakmpd g\u00e8re notamment\nles associations de s\u00e9curit\u00e9 (SA ou Security Associations) pour du\ntrafic r\u00e9seau chiffr\u00e9 et/ou authentifi\u00e9 (IPSEC).\n\n  \nAu moyen de paquets habilement constitu\u00e9s, un utilisateur mal\nintentionn\u00e9 peut r\u00e9aliser un d\u00e9ni de service par arr\u00eat intempestif du\nservice ou consommation excessive des ressources du syst\u00e8mes (m\u00e9moire,\nCPU).\n\n## Solution\n\nPour OpenBSD version 3.4, appliquer le correctif disponible \u00e0 cette\nadresse :\n\n    ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/015_isakmpd2.patch\n\nPour OpenBSD version 3.3, appliquer le correctif disponible \u00e0 cette\nadresse :\n\n    ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/020_isakmpd2.patch\n",
  "cves": [],
  "initial_release_date": "2004-03-24T00:00:00",
  "last_revision_date": "2004-05-12T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 OpenBSD #015 du 17 mars 2004 :",
      "url": "http://www.openbsd.org/errata.html#isakmpd2"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 FreeBSD du 31 mars 2004 :",
      "url": "http://www.vuxml.org/freebsd/"
    },
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 du paquetage NetBSD isakmpd :",
      "url": "ftp://ftp.netbsd.org/pub/NetBSD/packages/distfiles/vulnerabilities"
    }
  ],
  "reference": "CERTA-2004-AVI-100",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2004-03-24T00:00:00.000000"
    },
    {
      "description": "ajout r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 FreeBSD et NetBSD.",
      "revision_date": "2004-05-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans le service isakmpd peuvent\n\u00eatre exploit\u00e9es par un utilisateur mal intentionn\u00e9 afin de r\u00e9aliser un\nd\u00e9ni de service sur la plate-forme vuln\u00e9rable.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s de isakmpd sous OpenBSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 R7-0018 de Rapid7",
      "url": "http://www.rapid7.com/advisories/R7-0018.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NetBSD 1.6, NetBSD 1.6.1 et NetBSD-current (si les sources sont ant\u00e9rieures au 5 f\u00e9vrier 2004).",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD 3.4 et versions ant\u00e9rieures ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nIPv6 (Internet Protocol Version 6) est le successeur de l\u0027actuel\nprotocole IP (IPv4). Une vuln\u00e9rabilit\u00e9 dans la gestion des MTU (Maximum\nTransmission Unit) IPv6 permet \u00e0 un utilisateur mal intentionn\u00e9 de cr\u00e9er\nun d\u00e9ni de service en provoquant un arr\u00eat brutal du noyau BSD.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2004-02-10T00:00:00",
  "last_revision_date": "2004-02-20T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de NetBSD NetBSD-SA2004-002 :",
      "url": "ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-002.txt.asc"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 d\u0027OpenBSD :",
      "url": "http://www.openbsd.org/errata.html#ip6"
    }
  ],
  "reference": "CERTA-2004-AVI-028",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2004-02-10T00:00:00.000000"
    },
    {
      "description": "ajout du bulletin de s\u00e9curit\u00e9 de NetBSD.",
      "revision_date": "2004-02-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans la pile IPv6 des noyaux BSD permet \u00e0 un\nutilisateur mal intentionn\u00e9 de provoquer un d\u00e9ni de service.\n",
  "title": "Vuln\u00e9rabilit\u00e9 IPv6 dans les noyaux BSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 de Georgi Guninski #66,2004",
      "url": "http://www.guninski.com/obsdmtu.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FreeBSD 5.2 et versions ant\u00e9rieures, FreeBSD 4.9 et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "FreeBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD 3.4 et versions ant\u00e9rieures.",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nshmat() permet d\u0027inclure un segment de m\u00e9moire partag\u00e9e dans l\u0027espace\nd\u0027adressage d\u0027un processus.\n\nUne vuln\u00e9rabilit\u00e9 est pr\u00e9sente dans la fonction shmat() (probl\u00e8me dans\nla gestion des r\u00e9f\u00e9rences \u00e0 un segment de m\u00e9moire partag\u00e9e). Un\nutilisateur local peut exploiter cette vuln\u00e9rabilit\u00e9 pour r\u00e9aliser une\n\u00e9l\u00e9vation de privil\u00e8ges et obtenir les droits du super-utilisateur root\nsur la plate-forme vuln\u00e9rable.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs :\n\n-   Bulletin de s\u00e9curit\u00e9 FreeBSD-SA-04:02.shmat de FreeBSD :\n\n        ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:02.shmat.asc\n\n-   Bulletin de s\u00e9curit\u00e9 d\u0027OpenBSD :\n\n        http://www.openbsd.org/errata.html#sysvshm\n\n-   Bulletin de s\u00e9curit\u00e9 de NetBSD :\n\n        ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-004.txt.asc\n",
  "cves": [],
  "initial_release_date": "2004-02-06T00:00:00",
  "last_revision_date": "2004-02-19T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 PINE-CERT-20040201 de Pine Digital    Security :",
      "url": "http://www.pine.nl/press/pine-cert-20040201.txt"
    }
  ],
  "reference": "CERTA-2004-AVI-023",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2004-02-06T00:00:00.000000"
    },
    {
      "description": "Ajout r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 de NetBSD.",
      "revision_date": "2004-02-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 pr\u00e9sente dans la fonction shmat() pr\u00e9sente dans les\nnoyaux de souche BSD peut \u00eatre exploit\u00e9e par un utilisateur mal\nintentionn\u00e9 pour r\u00e9aliser une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Vuln\u00e9rabilit\u00e9 de shmat sur les noyaux BSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 PINE-CERT-20040201 de Pine Digital Security",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FreeBSD-SA-04:02.shmat de FreeBSD",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Toutes les versions d\u0027OpenBSD ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "NetBSD 1.6, NetBSD 1.6.1, NetBSD-current (si les sources sont ant\u00e9rieures au 17 janvier 2004).",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nisakmpd est un service de gestion des clefs IKE. isakmpd g\u00e8re notamment\nles associations de s\u00e9curit\u00e9 (SA ou Security Associations) pour du\ntrafic r\u00e9seau chiffr\u00e9 et/ou authentifi\u00e9. Plusieurs vuln\u00e9rabilit\u00e9s dans\nla gestion des messages par isakmpd permettent \u00e0 un utilisateur mal\nintentionn\u00e9 d\u0027effacer des associations de s\u00e9curit\u00e9 (SA ou Security\nAssociations) et de r\u00e9aliser un d\u00e9ni de service dans la cadre d\u0027un\ntrafic r\u00e9seau chiffr\u00e9 et/ou authentifi\u00e9.\n\n## Solution\n\n-   Pour OpenBSD version 3.4, mettre \u00e0 jour OpenBSD en appliquant le\n    correctif disponible \u00e0 cette adresse :\n\n        ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.4/common/009_isakmpd.patch\n\n-   Pour NetBSD, mettre \u00e0 jour selon la version de NetBSD (cf. avis de\n    s\u00e9curit\u00e9 NetBSD dans la section Documentation).\n",
  "cves": [],
  "initial_release_date": "2004-01-15T00:00:00",
  "last_revision_date": "2004-02-20T00:00:00",
  "links": [
    {
      "title": "Avis de s\u00e9curit\u00e9 NetBSD SA2004-001 :",
      "url": "ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-001.txt.asc"
    }
  ],
  "reference": "CERTA-2004-AVI-010",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2004-01-15T00:00:00.000000"
    },
    {
      "description": "ajout du bulletin de s\u00e9curit\u00e9 NetBSD.",
      "revision_date": "2004-02-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Manipulation de donn\u00e9es"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s dans la gestion des messages par isakmpd\npermettent \u00e0 un utilisateur mal intentionn\u00e9 d\u0027effacer des associations\nde s\u00e9curit\u00e9 (SA ou Security Associations) et de r\u00e9aliser un d\u00e9ni de\nservice dans la cadre d\u0027un trafic r\u00e9seau chiffr\u00e9 et/ou authentifi\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 de isakmpd",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 OpenBSD 009_isakmpd du 13 janvier 2004",
      "url": "http://www.openbsd.org/errata.html#isakmpd"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FreeBSD 5.0, FreeBSD 4.8 et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "FreeBSD",
          "scada": false
        }
      }
    },
    {
      "description": "Versions de Mac OS X ant\u00e9rieures \u00e0 10.2.6.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "FreeBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD 3.3 et versions ant\u00e9rieures ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "NetBSD 1.6.1 et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire est pr\u00e9sente dans la\nfonction realpath() de la biblioth\u00e8que standard C (libc) sur diff\u00e9rents\nsyst\u00e8mes d\u0027exploitation de souche BSD (FreeBSD, NetBSD, OpenBSD, Mac OS\nX).\n\nCette vuln\u00e9rabilit\u00e9 peut \u00eatre exploit\u00e9e au travers d\u0027applications\nutilisant cette fonction, comme le service ftp (ftpd), pour r\u00e9aliser une\nex\u00e9cution de code arbitraire pouvant entra\u00eener une \u00e9l\u00e9vation de\nprivil\u00e8ges ou un d\u00e9ni de service.\n\n## Solution\n\nAppliquer le correctif de l\u0027\u00e9diteur :\n\n-   Bulletin de s\u00e9curit\u00e9 FreeBSD-SA-03-08 de FreeBSD :\n\n        ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:08.realpath.asc\n\n-   Bulletin de s\u00e9curit\u00e9 NetBSD-SA2003-011 de NetBSD :\n\n        ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-011.txt.asc\n\n-   Bulletin de s\u00e9curit\u00e9 d\u0027OpenBSD :\n\n        http://www.openbsd.org/errata.html#realpath\n\n-   Bulletin de s\u00e9curit\u00e9 d\u0027Apple pour Mac OS X Server :\n\n        http://docs.info.apple.com/article.html?artnum=120238\n\n-   Bulletin de s\u00e9curit\u00e9 d\u0027Apple pour Mac OS X Client :\n\n        http://docs.info.apple.com/article.html?artnum=120239\n",
  "cves": [],
  "initial_release_date": "2003-08-06T00:00:00",
  "last_revision_date": "2003-08-18T00:00:00",
  "links": [],
  "reference": "CERTA-2003-AVI-134",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2003-08-06T00:00:00.000000"
    },
    {
      "description": "ajout r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 d\u0027Apple pour Mac OS X.",
      "revision_date": "2003-08-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 de la fonction realpath pour les syst\u00e8mes BSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 d\u0027OpenBSD",
      "url": null
    },
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 2003-011 de NetBSD",
      "url": null
    },
    {
      "published_at": null,
      "title": "Note VU#743092 du CERT/CC",
      "url": "http://www.kb.cert.org/vuls/id/743092"
    },
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 FreeBSD-SA-03:08 de FreeBSD",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenBSD version 2.0 \u00e0 la version 3.1 incluse ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "FreeBSD jusqu\u0027\u00e0 la version 4.6.1-RELEASE-p3 incluse ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "FreeBSD",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Microsystems Solaris 2.6 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Microsystems Solaris 7 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Microsystems Solaris 2.5.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "FreeBSD",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Microsystems Solaris 8 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "NetBSD version 1.4.* \u00e0 la version 1.6 beta ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetBSD",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Microsystems Solaris 9 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "FreeBSD",
          "scada": false
        }
      }
    },
    {
      "description": "Toutes les versions de MIT Kerberos version 5 jusqu\u0027\u00e0 la version krb5-1.2.5 incluse ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "FreeBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenAFS version 1.0 \u00e0 1.2.5 et version 1.3.0 \u00e0 1.3.2.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "FreeBSD",
          "scada": false
        }
      }
    },
    {
      "description": "Mac OS X ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nSun RPC (Remote Procedure Call) est un protocole de type client/serveur\nutilis\u00e9 pour l\u0027impl\u00e9mentation d\u0027applications r\u00e9parties.\n\nCelui-ci utilise de mani\u00e8re transparente le protocole XDR (eXternal Data\nRepresentation) afin de r\u00e9soudre les probl\u00e8mes de non unicit\u00e9 de\nrepr\u00e9sentation interne des objets entre diff\u00e9rentes machines.\n\nUne vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire \u00e0 \u00e9t\u00e9 d\u00e9couverte dans\nla primitive de filtrage `xdr_array` utilis\u00e9e par de nombreux services\nRPC. Un utilisateur mal intentionn\u00e9 peut exploiter cette vuln\u00e9rabilit\u00e9\nafin d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance avec les privil\u00e8ges de\nl\u0027utilisateur `root`.\n\nCette vuln\u00e9rabilit\u00e9 est \u00e9galement pr\u00e9sente dans de nombreuses\napplications utilisant des librairies d\u00e9riv\u00e9es de la librairie Sun RPC\n(libc, glibc ou dietlibc), notamment dans certains serveurs du syst\u00e8me\nde fichiers distribu\u00e9 AFS (volserver, vlserver, ptserver, buserver) , ou\nbien le syst\u00e8me d\u0027administration de Kerberos 5 (kadmind).\n\n## Contournement provisoire\n\nLe correctif pour `Sun solaris systems` est maintenant disponible. Il\nest toutefois conseill\u00e9 de :\n\n-   filtrer l\u0027acc\u00e8s au RPC Portmapper (111/TCP et UDP) ;\n-   filtrer l\u0027acc\u00e8s \u00e0 la plage des ports hauts utilis\u00e9s par les services\n    RPC ;\n-   d\u0027arr\u00eater les services RPC non utilis\u00e9s.\n\n## Solution\n\nAppliquer le correctif selon l\u0027\u00e9diteur (cf. Documentation).\n",
  "cves": [],
  "initial_release_date": "2002-08-01T00:00:00",
  "last_revision_date": "2002-11-21T00:00:00",
  "links": [
    {
      "title": "Bulletin du CERT/CC :",
      "url": "http://www.cert.org/advisories/CA-2002-25.html"
    }
  ],
  "reference": "CERTA-2002-AVI-163",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2002-08-01T00:00:00.000000"
    },
    {
      "description": "ajout des bulletins de s\u00e9curit\u00e9 SUN, NetBSD, SGI, MIT Kerberos et Apple.",
      "revision_date": "2002-08-05T00:00:00.000000"
    },
    {
      "description": "ajout des bulletins du CERT/CC, OpenAFS et Debian.",
      "revision_date": "2002-08-06T00:00:00.000000"
    },
    {
      "description": "ajout des bulletins Debian, Red Hat et SGI.",
      "revision_date": "2002-08-19T00:00:00.000000"
    },
    {
      "description": "ajout du bulletin de SuSE.",
      "revision_date": "2002-09-03T00:00:00.000000"
    },
    {
      "description": "correction d\u0027un lien.",
      "revision_date": "2002-10-17T00:00:00.000000"
    },
    {
      "description": "correction d\u0027un lien.",
      "revision_date": "2002-11-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans une primitive de filtrage XDR\nutilis\u00e9e dans les Sun RPC.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les Sun RPC",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 ISS",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenBSD 2.8 et inf\u00e9rieures",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "FreeBSD 4.2 et inf\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "FreeBSD",
          "scada": false
        }
      }
    },
    {
      "description": "NetBSD 1.5 et inf\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetBSD",
          "scada": false
        }
      }
    },
    {
      "description": "HP-UX 11.00 et 11.11",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Versions d\u0027Ipfilter 3.4.16 et inf\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLe cache de gestion des fragments a pour objet de laisser passer les\nfragments d\u0027un paquet IP correspondant \u00e0 une session/connexion\npr\u00e9c\u00e9dement accept\u00e9e par le module de filtrage. Hors, ce cache ne se\nbase que sur l\u0027ent\u00eate IP, il est alors possible, apr\u00e8s avoir initi\u00e9 une\nconnexion autoris\u00e9e, d\u0027envoyer des fragments vers des ports arbitraires.\n\n## Solution\n\nMettre \u00e0 jour les sources ou le paquetage, selon les vendeurs :\n\n-   Sources d\u0027Ipfilter :\n\n        ftp://coombs.anu.edu.au/pub/net/ip-filter/\n\n-   HP-UX :\n\n        http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B9901AA\n\n-   FreeBSD :\n\n        ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:32/ipfilter.patch\n\n-   NetBSD : se conformer \u00e0 l\u0027avis cit\u00e9 dans la documentation.\n\n-   OpenBSD 2.8 voir :\n\n        http://www.openbsd.org/errata28.html#ipf_frag\n",
  "cves": [],
  "initial_release_date": "2002-02-01T00:00:00",
  "last_revision_date": "2002-03-06T00:00:00",
  "links": [
    {
      "title": "Avis de s\u00e9curit\u00e9 NetBSD",
      "url": "ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-007.txt.asc"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 FreeBSD",
      "url": "ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:32.ipfilter.v1.1.asc"
    },
    {
      "title": "Base de vuln\u00e9rabilit\u00e9s Bugtraq",
      "url": "http://www.securityfocus.com/bid/2545"
    }
  ],
  "reference": "CERTA-2002-AVI-021",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2002-02-01T00:00:00.000000"
    },
    {
      "description": "correction d\u0027un lien d\u00e9fectueux.",
      "revision_date": "2002-03-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement des r\u00e8gles de filtrage de paquets impl\u00e9ment\u00e9es par ipfilter"
    }
  ],
  "summary": "\u003cspan class=\"textit\"\u003eIpfilter\u003c/span\u003e est une collection d\u0027outils de\nfiltrage de paquets r\u00e9pandue dans le monde \u003cspan\nclass=\"textit\"\u003eUnix\u003c/span\u003e. Une vuln\u00e9rabilit\u00e9 permet d\u0027acc\u00e9der aux ports\nnormalement bloqu\u00e9s des h\u00f4tes prot\u00e9g\u00e9s par le pare-feu.\n",
  "title": "Mise \u00e0 jour de la gestion des fragments dans Ipfilter",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Base de vuln\u00e9rabilit\u00e9s BugTraq",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NetBSD 1.4.x versions 1.4.3 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetBSD",
          "scada": false
        }
      }
    },
    {
      "description": "OpenBSD version 3.0 ;",
      "product": {
        "name": "OpenBSD",
        "vendor": {
          "name": "OpenBSD",
          "scada": false
        }
      }
    },
    {
      "description": "FreeBSD versions 4.4 et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "FreeBSD",
          "scada": false
        }
      }
    },
    {
      "description": "NetBSD 1.5.x versions 1.5.2 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetBSD",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLa commande ptrace est une fonction de d\u00e9buggage qui permet de contr\u00f4ler\nl\u0027ex\u00e9cution d\u0027un processus fils, et d\u0027\u00e9diter son image m\u00e9moire. Il y a\ndes restrictions sur son utilisation avec des processus ayant le drapeau\nSUID ou SGID activ\u00e9.\n\nUne vuln\u00e9rabilit\u00e9 de ces contr\u00f4les dans les noyaux BSD permet \u00e0 un\nutilisateur mal intentionn\u00e9 d\u0027obtenir les droits de l\u0027utilisateur root.\n\n## Solution\n\nAppliquer les correctifs des \u00e9diteurs (cf. Documentation).\n",
  "cves": [],
  "initial_release_date": "2002-01-28T00:00:00",
  "last_revision_date": "2002-01-28T00:00:00",
  "links": [
    {
      "title": "Avis de s\u00e9curit\u00e9 OpenBSD :",
      "url": "http://www.openbsd.org/security.html"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 NetBSD SA-2002-001 :",
      "url": "http://www.netbsd.org/Security/"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 FreeBSD SA-02-08 :",
      "url": "http://www.freebsd.org/security/index.html"
    }
  ],
  "reference": "CERTA-2002-AVI-016",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2002-01-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Un utilisateur mal intentionn\u00e9 peut, en local, obtenir les droits de\nl\u0027utilisateur \u003cspan class=\"textit\"\u003eroot\u003c/span\u003e en utilisant la fonction\n\u003cspan class=\"textit\"\u003eptrace\u003c/span\u003e.\n",
  "title": "Vuln\u00e9rabilit\u00e9 de ptrace dans les syst\u00e8mes BSD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 NetBSD 2002-001",
      "url": null
    }
  ]
}

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-001043.html",
  "dc:date": "2008-11-21T12:19+09:00",
  "dcterms:issued": "2008-06-13T17:11+09:00",
  "dcterms:modified": "2008-11-21T12:19+09:00",
  "description": "X server provided by the X.Org Foundation contains a buffer overflow vulnerability. \r\n\r\nThe X.Org Foundation provides an open source implementation of the X Window System. The X server of this implementation contains a vulnerability in the handling of Portable Compiled Font (PCF) format fonts that can be exploited to cause a buffer overflow. \r\n\r\nX.Org Foundation released the X.Org security advisory on January 17, 2008, and CERT/CC released VU#203220 on March 19, 2008 regarding this vulnerability issue. \r\n\r\nTakuya Shiozaki of CODE blog (codeblog.org) reported this vulnerability to IPA. \r\nJPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-001043.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:fujitsu:pc-x",
      "@product": "FUJITSU PC-X",
      "@vendor": "FUJITSU",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:suse:suse_open_enterprise_server",
      "@product": "Open Enterprise Server",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:suse:suse_sles",
      "@product": "SUSE SLES",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:x.org:x.org_x11",
      "@product": "X.Org X11",
      "@vendor": "X.Org Foundation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:xfree86_project:xfree86",
      "@product": "XFree86",
      "@vendor": "XFree86 Project",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:apple:mac_os_x",
      "@product": "Apple Mac OS X",
      "@vendor": "Apple Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:apple:mac_os_x_server",
      "@product": "Apple Mac OS X Server",
      "@vendor": "Apple Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:canonical:ubuntu_linux",
      "@product": "Ubuntu",
      "@vendor": "Canonical",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:fedoraproject:fedora",
      "@product": "Fedora",
      "@vendor": "Fedora Project",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:gentoo:linux_x11",
      "@product": "Gentoo Linux x11-base/xorg-server",
      "@vendor": "Gentoo Foundation, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:gentoo:linux_x11-libs",
      "@product": "Gentoo Linux x11-libs/libXfont",
      "@vendor": "Gentoo Foundation, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:hp:hp-ux",
      "@product": "HP-UX",
      "@vendor": "Hewlett-Packard Development Company,L.P",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:ibm:aix",
      "@product": "IBM AIX",
      "@vendor": "IBM Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:mandriva:linux-xfree86",
      "@product": "Mandriva Linux XFree86",
      "@vendor": "Mandriva, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:mandriva:linux-xorg",
      "@product": "Mandriva Linux xorg-x11",
      "@vendor": "Mandriva, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:misc:miraclelinux_asianux_server",
      "@product": "Asianux Server",
      "@vendor": "Cybertrust Japan Co., Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:openbsd:openbsd",
      "@product": "OpenBSD",
      "@vendor": "OpenBSD",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:opensuse_project:opensuse",
      "@product": "openSUSE",
      "@vendor": "openSUSE project",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:redhat:enterprise_linux",
      "@product": "Red Hat Enterprise Linux",
      "@vendor": "Red Hat, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:redhat:enterprise_linux_desktop",
      "@product": "Red Hat Enterprise Linux Desktop",
      "@vendor": "Red Hat, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:redhat:linux_advanced_workstation",
      "@product": "Red Hat Linux Advanced Workstation",
      "@vendor": "Red Hat, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:redhat:rhel_desktop_workstation",
      "@product": "RHEL Desktop Workstation",
      "@vendor": "Red Hat, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:sun:solaris",
      "@product": "Sun Solaris",
      "@vendor": "Sun Microsystems, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:suse:linux_desktop",
      "@product": "Novell Linux Desktop",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:suse:linux_enterprise_desktop",
      "@product": "SUSE Linux Enterprise Desktop",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:suse:linux_enterprise_server",
      "@product": "SUSE Linux Enterprise Server",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:suse:linux_pos",
      "@product": "Novell Linux POS",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:suse:suse_linux",
      "@product": "SUSE LINUX",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:suse:suse_sle_sdk",
      "@product": "SLE SDK",
      "@vendor": "SUSE",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "7.4",
    "@severity": "High",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2008-001043",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN88935101/index.html",
      "@id": "JVN#88935101",
      "@source": "JVN"
    },
    {
      "#text": "https://jvn.jp/en/tr/TRTA08-079A/index.html",
      "@id": "TRTA08-079A",
      "@source": "JVNTR"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0006",
      "@id": "CVE-2008-0006",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-0006",
      "@id": "CVE-2008-0006",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/english/vuln/200806_XOrg_press_en.html",
      "@id": "Security Alert for X.Org Foundation X Server Vulnerability",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "http://www.us-cert.gov/cas/alerts/SA08-079A.html",
      "@id": "SA08-079A",
      "@source": "CERT-SA"
    },
    {
      "#text": "http://www.kb.cert.org/vuls/id/203220",
      "@id": "VU#203220",
      "@source": "CERT-VN"
    },
    {
      "#text": "http://www.us-cert.gov/cas/techalerts/TA08-079A.html",
      "@id": "TA08-079A",
      "@source": "CERT-TA"
    },
    {
      "#text": "http://secunia.com/advisories/28532/",
      "@id": "SA28532",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://www.securityfocus.com/bid/27352",
      "@id": "27352",
      "@source": "BID"
    },
    {
      "#text": "http://securitytracker.com/id?1019232",
      "@id": "1019232",
      "@source": "SECTRACK"
    },
    {
      "#text": "http://www.frsirt.com/english/advisories/2008/0179",
      "@id": "FrSIRT/ADV-2008-0179",
      "@source": "FRSIRT"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001043.html",
      "@id": "JVNDB-2008-001043",
      "@source": "JVNDB_Ja"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-119",
      "@title": "Buffer Errors(CWE-119)"
    }
  ],
  "title": "X.Org Foundation X server buffer overflow vulnerability"
}