CVE-2019-15878

HIGH

FreeBSD <12.1-STABLE r352509, <11.3-STABLE r352509, <11.3-RELEASE p...

Title source: llm
STIX 2.1

Description

In FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an unprivileged local user can trigger a use-after-free situation due to improper checking in SCTP when an application tries to update an SCTP-AUTH shared key.

References (2)

Core 2
Core References
Vendor Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20200518-0007/

Scores

CVSS v3 7.8
EPSS 0.0005
EPSS Percentile 16.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (2)
freebsd/freebsd 11.3 (9 CPE variants)
freebsd/freebsd 12.1
Published May 13, 2020
Tracked Since Feb 18, 2026