FreeBSD Security Advisory – Various user defined input such as mount points, devices, and mount options are prepared and passed as arguments to nmount(2) into the kernel. Under certain error conditions, user defined data will be copied into a stack allocated buffer stored in the kernel without sufficient bounds checking. If the system is configured to allow unprivileged users to mount file systems, it is possible for a local adversary to exploit this vulnerability and execute code in the context of the kernel.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/69618/FreeBSD-SA-08-08.nmount.txt
Source: https://packetstormsecurity.com/files/69618/FreeBSD-SA-08-08.nmount.txt.html