CVE-2014-8476

Published: Nov 13, 2014Modified: May 6, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

The setlogin function in FreeBSD 8.4 through 10.1-RC4 does not initialize the buffer used to store the login name, which allows local users to obtain sensitive information from kernel memory via a call to getlogin, which returns the entire buffer.

Affected (13)

Products: Freebsd: Freebsd

Freebsd

1 product

Freebsd

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 10.0
Freebsd Freebsd	Version 10.1
Freebsd Freebsd	Version 10.1 rc1
Freebsd Freebsd	Version 10.1 rc2
Freebsd Freebsd	Version 10.1 rc3
Freebsd Freebsd	Version 10.1 rc4
Freebsd Freebsd	Version 8.4
Freebsd Freebsd	Version 9.0
Freebsd Freebsd	Version 9.0 beta1
Freebsd Freebsd	Version 9.0 beta2
Freebsd Freebsd	Version 9.1
Freebsd Freebsd	Version 9.2
Freebsd Freebsd	Version 9.3