CVE-2014-8476

EUVD-2014-8313
The setlogin function in FreeBSD 8.4 through 10.1-RC4 does not initialize the buffer used to store the login name, which allows local users to obtain sensitive information from kernel memory via a call to getlogin, which returns the entire buffer.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.1 UNKNOWN
LOCAL
LOW
AV:L/AC:L/Au:N/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 20%
Affected Products (NVD)
VendorProductVersion
freebsdfreebsd
8.4
freebsdfreebsd
9.0
freebsdfreebsd
9.0:beta1
freebsdfreebsd
9.0:beta2
freebsdfreebsd
9.1
freebsdfreebsd
9.2
freebsdfreebsd
9.3
freebsdfreebsd
10.0
freebsdfreebsd
10.1
freebsdfreebsd
10.1:rc1
freebsdfreebsd
10.1:rc2
freebsdfreebsd
10.1:rc3
freebsdfreebsd
10.1:rc4
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
kfreebsd-8
lucid
ignored
precise
dne
trusty
dne
utopic
dne
Common Weakness Enumeration
References
http://secunia.com/advisories/61118
http://secunia.com/advisories/62218
http://www.debian.org/security/2014/dsa-3070
https://www.freebsd.org/security/advisories/FreeBSD-SA-14%3A25.setlogin.asc
http://secunia.com/advisories/61118
http://secunia.com/advisories/62218
http://www.debian.org/security/2014/dsa-3070
https://www.freebsd.org/security/advisories/FreeBSD-SA-14%3A25.setlogin.asc