OP
Product
OpenBSD
204
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 11High 24Medium 23Low 1
Watch
Add OpenBSD to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-10934 | 9.8 | Nov 15 | OpenBSD NFS double-free vulnerability Affected: 7.5; 7.4 |
| CVE-2024-29937 | 9.8 | Mar 21 | NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to… Affected: through 7.4 |
| CVE-2023-35784 | 9.8 | Jun 16 | A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3 Affected: 7.2; 7.3 |
| CVE-2021-46880 | 9.8 | Apr 15 | x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes… Affected: before 7.0 |
| CVE-2020-16088 | 9.8 | Jul 28 | iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches Affected: through 6.7 |
| CVE-2012-1577 | 9.8 | Dec 10 | lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0 Affected: All versions, or not specified |
| CVE-2019-19521 | 9.8 | Dec 5 | libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd Affected: 6.6 |
| CVE-2017-1000372 | 9.8 | Jun 19 | A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as… Affected: through 6.1 |
| CVE-2003-0466 | 9.8 | Aug 27 | Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0… Affected: 2.0 through 3.3 |
| CVE-2002-0391 | 9.8 | Aug 12 | Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to… Affected: 3.1 |
| CVE-2026-103547 | 9.2 | Sep 30 | In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and… Affected: 7.8 before errata 057; 7.9 before errata 021 |
| CVE-2026-55706 | 8.3 | Jun 17 | sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths Affected: before 076e2b1c1fc4ac0883a72d3544131ad5cee7adf8 |
| CVE-2026-57589 | 7.8 | Jun 25 | sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root Affected: through 7.9 |
| CVE-2023-29323 | 7.8 | Apr 4 | ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit f748277, can abort upon a connection… Affected: 7.1; 7.2 |
| CVE-2019-19726 | 7.8 | Dec 12 | OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource… Affected: through 6.6 |
| CVE-2019-19522 | 7.8 | Dec 5 | OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group Affected: 6.6 |
| CVE-2019-19520 | 7.8 | Dec 5 | xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, because… Affected: 6.6 |
| CVE-2019-19519 | 7.8 | Dec 5 | In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in su/su.c Affected: 6.6 |
| CVE-2016-6241 | 7.8 | Mar 7 | Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value Affected: 5.8; 5.9 |
| CVE-2016-6240 | 7.8 | Mar 7 | Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value Affected: 5.8; 5.9 |
| CVE-2024-11148 | 7.5 | Dec 5 | OpenBSD httpd(8) null dereference Affected: 7.4 before 7.4 errata 006; 7.3 before 7.3 errata 020 |
| CVE-2023-52558 | 7.5 | Mar 1 | OpenBSD 7.4 and 7.3 m_split() network buffer kernel crash Affected: 7.3 before 7.3 errata 019; 7.4 before 7.4 errata 002 |
| CVE-2023-52557 | 7.5 | Mar 1 | OpenBSD 7.3 invalid l2tp message npppd crash Affected: 7.3 before 7.3 errata 016 |
| CVE-2023-27567 | 7.5 | Mar 3 | In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel Affected: 7.2 |
| CVE-2022-27882 | 7.5 | Mar 25 | slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow triggerable by a crafted IPv6 router advertisement Affected: 6.9; 7.0 |
| CVE-2022-27881 | 7.5 | Mar 25 | engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement with more than seven nameservers Affected: 6.9; 7.0 |
| CVE-2010-4816 | 7.5 | Jun 22 | It was found in FreeBSD 8.0, 6.3 and 4.9, and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of service of the ftpd service Affected: 4.6; 4.9; 6.3; 8.0 |
| CVE-2011-3336 | 7.5 | Feb 12 | regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion Affected: 5.0 |
| CVE-2019-8460 | 7.5 | Aug 26 | OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can… Affected: through 6.5 |
| CVE-2017-5850 | 7.5 | Mar 27 | httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header Affected: 6.0 |
| CVE-2016-6244 | 7.5 | Mar 7 | The sys_thrsigdivert function in kern/kern_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) via a negative "ts.tv_sec" value Affected: 5.9 |
| CVE-2004-0079 | 7.5 | Nov 23 | The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake… Affected: 3.3; 3.4 |
| CVE-1999-0052 | 7.5 | Nov 4 | IP fragmentation denial of service in FreeBSD allows a remote attacker to cause a crash Affected: 2.2; 2.3; 2.4 |
| CVE-2019-14899 | 7.4 | Dec 11 | A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is… Affected: All versions, or not specified |
| CVE-2024-43688 | 7.3 | Aug 20 | cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption Affected: 7.4; 7.5 |
| CVE-2025-30334 | 6.5 | Mar 20 | OpenBSD wg(4) kernel crash Affected: 7.6 before 7.6 errata 006; 7.5 before 7.5 errata 015 |
| CVE-2017-1000373 | 6.5 | Jun 19 | The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse… Affected: through 6.1 |
| CVE-2023-52556 | 6.2 | Mar 1 | OpenBSD 7.4 pf state race condition kernel crash Affected: 7.4 before 7.4 errata 009 |
| CVE-2024-11149 | 5.5 | Dec 6 | OpenBSD vmm GDTR limits Affected: 7.4 before 7.4 errata 014 |
| CVE-2024-10933 | 5.5 | Dec 5 | OpenBSD readdir directory traversal Affected: 7.5 before 7.5 errata 009; 7.4 before 7.4 errata 022 |
| CVE-2021-34999 | 5.5 | May 7 | OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability Affected: 6.9 |
| CVE-2023-40216 | 5.5 | Aug 10 | OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation Affected: 7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +8 more |
| CVE-2018-14775 | 5.5 | Aug 1 | tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3 has a Local Denial of Service (system crash) due to incorrect I/O port access control on the i386 architecture Affected: 6.2; 6.3 |
| CVE-2016-6522 | 5.5 | Mar 7 | Integer overflow in the uvm_map_isavail function in uvm/uvm_map.c in OpenBSD 5.9 allows local users to cause a denial of service (kernel panic) via a crafted mmap call, which… Affected: 5.9 |
| CVE-2016-6350 | 5.5 | Mar 7 | OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) via a sysctl call with a path starting with 10,9 Affected: 5.8; 5.9 |
| CVE-2016-6247 | 5.5 | Mar 7 | OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode on the mnt_vnodelist Affected: 5.8; 5.9 |
| CVE-2016-6245 | 5.5 | Mar 7 | OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a large size in a getdents system call Affected: 5.8; 5.9 |
| CVE-2016-6243 | 5.5 | Mar 7 | thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a crafted value in the tsp parameter of the __thrsleep… Affected: 5.8; 5.9 |
| CVE-2016-6242 | 5.5 | Mar 7 | OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (assertion failure and kernel panic) via a large ident value in a kevent system call Affected: 5.8; 5.9 |
| CVE-2016-6239 | 5.5 | Mar 7 | The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large size value Affected: 5.8; 5.9 |