CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

net-mgmt/nagios3.5.1_12

Powerful network monitoring system

11
unaddressed
0
VuXML only, still affected
7
fixed
Maintainer
ports@FreeBSD.org
Packages
nagios 3.5.1_12, nagios-monplugins 3.5.1_12
Upstream
up to date
CPE
nagios:nagios from the port
WWW
https://www.nagios.org/
Links
cgit · VuXML

Unaddressed (11) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2008-73139.8published 2017-03-31

The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796.

CVE-2014-50099.8published 2017-03-31

Snoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008.

CVE-2016-95659.8published 2016-12-15

MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796.

CVE-2016-100897.8published 2017-02-15

Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.

CVE-2016-95667.8published 2016-12-15

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.

CVE-2013-72056.4published 2014-01-15

Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.

CVE-2017-128476.3published 2017-08-23

Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command.

CVE-2013-42146.3published 2013-11-23

rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE_CACHE_ON is set to 1, allows local users to overwrite arbitrary files via a symlink attack on /tmp/magpie_cache.

CVE-2018-134415.5published 2018-07-12

qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.

CVE-2013-71085.5published 2014-01-15

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) av…

CVE-2014-18785.0published 2014-02-28

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Possibly backported (1) · The CVE record gives a range ending in a newer branch, check the branch changelog

This port tracks an older, still maintained branch. The CVE record only says “before X” with X in a newer branch, so it cannot tell whether this branch received the fix. This is an estimate, not a confirmation. These CVEs are not counted as unaddressed.
CVE-2008-479610.0published 2008-10-30

The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.

Fixed (7)

VuXML entries whose affected range this version has left, plus CVEs whose record still lists this version although VuXML considers them fixed (usually a backported fix).
CVE-2013-72056.4published 2014-01-15VuXML entry

Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.

CVE-2013-71085.5published 2014-01-15VuXML entry

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) av…

Commits (161)

Michael Haro (mharo) · 0.0.7b3
- update to netsaint 0.0.7b3 - install configuration files with .dist suffix so that users configuration   files are not deleted on package removal - create ${PREFIX}/var/netsaint/rw directory needed for correct operation   of CGI script - fix netsaint.log file permission problem - depend on netsaint-plugins port

PR:		26328
Submitted by:	    maintainer
05b2ac3b5b
Dirk Froemberg (dirk) · 0.0.7b2
Blaz Zupan <blaz@amis.net> wants to maintain this port in addition to netsaint-plugins.
feb81296a6
FUJISHIMA Satsuki (sf) · 0.0.7b2
update to 0.0.7b2.

PR:		25482
Submitted by:	George Reid <greid@ukug.uk.freebsd.org>
c8091bb624
Peter Pentchev (roam) · 0.0.6_1
Create the fake user with /sbin/nologin as the login shell, not /bin/sh.

PR:		25094
Submitted by:	Phil Regnauld <regnauld@td.rh.dk>
3a758383e7
Akinori MUSHA (knu) · 0.0.6_1
Chase graphics/gd's shlib version bump.
9e04885221
Michael Haro (mharo) · 0.0.6
update to 0.0.6
6112134f22
Will Andrews (will) · 0.0.5.2
Release to the world all of my ports that I don't use, excluding KDE 1, which I'm holding for various reasons, so some kind soul can take the time to fix them without having to wait for me.
052cf380ee
FUJISHIMA Satsuki (sf) · 0.0.5.2
remove empty directory.

PR:		23845
Submitted by:	David W. Chapman Jr.
369ec4e6f6
Will Andrews (will) · 0.0.5.2
Oops, revert last commit.  In my rush to fix a "problem", I forgot to actually check to see that this /bin/echo wasn't accounted for.  8)
d1663d0b2e
Will Andrews (will) · 0.0.5.2
Fix /bin/echo -> echo problem that is caused due to the lack of -e option in the base system.

Submitted by:	Dan Larsson <dl@tyfon.net>
5455031a0c
Will Andrews (will) · 0.0.5.2
Add NetSaint 0.0.5-2, an extremely powerful network monitoring system.

Patches submitted by:	Jim Sloan <odinn@atlantabiker.net>, to whom I am
			extremely grateful!  Thanks!
24138afdff
« newest← newerpage 4 of 4