pkgsrc-Bugs archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
pkg/60610: doc/pkg-vulnerabilities: add missing upper bounds to open-ended entries
>Number: 60610
>Category: pkg
>Synopsis: doc/pkg-vulnerabilities: add missing upper bounds to open-ended entries
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: pkg-manager
>State: open
>Class: doc-bug
>Submitter-Id: net
>Arrival-Date: Mon Aug 17 08:25:00 +0000 2026
>Originator: Showta Ishizaki
>Release: NetBSD 10.1 / pkgsrc doc/pkg-vulnerabilities rev 1.779
>Organization:
>Environment:
System: NetBSD bambi.snowrabbit.org 10.1 NetBSD 10.1 (GENERIC) #0: Mon Dec 16 13:08:11 UTC 2024 mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/i386/compile/GENERIC i386
Architecture: i386
Machine: i386
>Description:
Some entries were added with only a lower bound while the fix
was not yet released -- correct at the time, but the upper
bound was never added after upstream fixed the issue, so
"pkg_admin audit" keeps flagging current packages forever.
An audit against rev 1.779 found 13 such entries, plus one
with an inverted range. The patch corrects them in place;
each bound comes from the upstream fix:
- kdegraphics>=4.3.0<4.5.1: CVE-2010-2575 (SA40952) fixed in
KDE SC 4.5.1 per KDE advisory 20100825-1.
- fuse>=2.0<2.8.6: SA42961 = CVE-2010-3879/CVE-2011-0541..0543,
"2.8.5 and earlier", fixed in fuse 2.8.6.
- libvirt>1.0.0<1.0.6: SA53440 = CVE-2013-1962, fixed in 1.0.6.
- libbpg>=0.9.5<0.9.8: CVE-2016-5637 affects "0.9.5 through
0.9.7". (pkgsrc libbpg has been 0.9.2 since its 2014 import,
so this entry has never matched anything; bounded for
correctness.)
- pam-yubico>=2.18<2.26: CVE-2018-9275 affects "2.18 through
2.25"; 2.26 NEWS: "Make sure to close authfile
(CVE-2018-9275)".
- libvirt>=4.8.0<5.3.0: CVE-2019-3886 fixed by commit
2a07c990bd, contained in 5.3.0.
- libvirt>=0.9.4<5.4.1: CVE-2019-10161 fixed "before versions
4.10.1 and 5.4.1" (LSN-2019-0004).
- virt-manager>=2.2.0<2.2.1: CVE-2019-10183 introduced in
2.2.0, fixed in 2.2.1 (named in upstream NEWS).
- lilo>=23.1<23.2: CVE-2011-1934 affects exactly 23.1, fixed
in 23.2 (Debian #615103). (pkgsrc lilo is 22.8, so the open
range never matched it either way.)
- pppd>=2.4.2<2.4.9: CVE-2020-8597 fixed upstream by commit
8d7970b8, contained in ppp 2.4.9. Note this is
behavior-neutral today: pkgsrc net/pppd is 2.4.3nb2 with no
patch for eap.c, so it remains (correctly) flagged.
- opendmarc>=1.3.2<1.4.0: CVE-2020-12460 affects "through
1.3.2 and 1.4.x through 1.4.0-Beta1"; 1.4.0 RELEASE_NOTES
name the fix (GitHub issue #64).
- qemu>=10.0.0<10.1.0 (2 entries): CVE-2025-54566/54567 fixed
by commit cad9aa6fbd ("pcie_sriov: Fix configuration and
state synchronization", names both CVEs), contained in
QEMU 10.1.0.
- pptp<=1.7.2 (was pptp>1.7.2): RHBZ#492090 affects pptpsetup
in 1.7.2 and earlier -- the range direction was inverted,
flagging exactly the unaffected versions.
Thanks as always for the prompt handling of these reports.
>How-To-Repeat:
pkg_admin audit on a current system with e.g. libvirt or
virt-manager installed reports the CVEs above although the
installed versions contain the fixes.
>Fix:
Apply the following patch (against rev 1.779):
--- pkg-vulnerabilities.cvshead 2026-08-17 16:35:32
+++ pkg-vulnerabilities.1779.bounds 2026-08-17 17:20:39
@@ -3829,7 +3829,7 @@
ap{2,22}-perl<2.0.4nb5 cross-site-scripting https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0796
unrealircd<3.2.7nb2 denial-of-service http://forums.unrealircd.com/viewtopic.php?t=6204
ntp<4.2.4p7 arbitrary-code-execution https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0159
-pptp>1.7.2 information-disclosure https://bugzilla.redhat.com/show_bug.cgi?id=492090
+pptp<=1.7.2 information-disclosure https://bugzilla.redhat.com/show_bug.cgi?id=492090
geeklog<1.5.2.2 sql-injection http://www.geeklog.net/article.php/geeklog-1.5.2sr2
geeklog<1.5.2.3 sql-injection http://www.geeklog.net/article.php/webservices-exploit
ghostscript<8.64 arbitrary-code-execution https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6679
@@ -4850,7 +4850,7 @@
libgdiplus<2.6nb1 remote-system-access http://secunia.com/advisories/40792/
quagga<0.99.17 remote-system-access http://secunia.com/advisories/41038/
squid>=3.1.5.1<3.1.7 denial-of-service http://bugs.squid-cache.org/show_bug.cgi?id=3021
-kdegraphics>=4.3.0 remote-system-access http://secunia.com/advisories/40952/
+kdegraphics>=4.3.0<4.5.1 remote-system-access http://secunia.com/advisories/40952/
fuse-encfs<1.7 multiple-vulnerabilities http://secunia.com/advisories/41158/
qt4-libs<4.7.0rc1 ssl-certificate-spoofing http://secunia.com/advisories/41236/
nss<3.12.8 ssl-certificate-spoofing http://secunia.com/advisories/41237/
@@ -5054,7 +5054,7 @@
asterisk>=1.8<1.8.2.2 buffer-overflow http://downloads.digium.com/pub/security/AST-2011-001.html
p5-Convert-UUlib<1.4 denial-of-service http://secunia.com/advisories/42998/
pango<1.28.3nb2 denial-of-service http://secunia.com/advisories/42934/
-fuse>=2.0 denial-of-service http://secunia.com/advisories/42961/
+fuse>=2.0<2.8.6 denial-of-service http://secunia.com/advisories/42961/
maradns<1.4.06 remote-system-access https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0520
dpkg<1.14.31 remote-system-access https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0402
suse{,32}_openssl<11.3nb2 remote-security-bypass https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4180
@@ -6832,7 +6832,7 @@
php{53,54}-owncloud<5.0.6 multiple-vulnerabilities http://secunia.com/advisories/53392/
ruby193-base<1.9.3p429 local-security-bypass http://secunia.com/advisories/53432/
acroread9<9.5.5 multiple-vulnerabilities https://www.adobe.com/support/security/bulletins/apsb13-15.html
-libvirt>1.0.0 denial-of-service http://secunia.com/advisories/53440/
+libvirt>1.0.0<1.0.6 denial-of-service http://secunia.com/advisories/53440/
wireshark<1.8.7 denial-of-service https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2486
wireshark<1.8.7 denial-of-service https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2487
wireshark<1.8.7 denial-of-service https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2488
@@ -10307,7 +10307,7 @@
php{55,56,70}-contao35<3.5.15 arbitrary-code-execution https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4567
php{55,56,70}-contao41-[0-9]* arbitrary-code-execution https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4567
php{55,56,70}-contao42<4.2.1 arbitrary-code-execution https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4567
-libbpg>=0.9.5 out-of-bounds-write https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5637
+libbpg>=0.9.5<0.9.8 out-of-bounds-write https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5637
adobe-flash-plugin<11.2.202.632 multiple-vulnerabilities https://helpx.adobe.com/security/products/flash-player/apsb16-25.html
go>=1.6<1.6.3 input-validation https://golang.org/issue/16405
thunderbird>=45<45.2.0 multiple-vulnerabilities https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird45.2
@@ -14759,7 +14759,7 @@
ncmpc<0.30 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2018-9240
jasper<2.0.19 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2018-9252
libxml2>=2.9.6<2.9.8nb1 infinite-loop https://nvd.nist.gov/vuln/detail/CVE-2018-9251
-pam-yubico>=2.18 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2018-9275
+pam-yubico>=2.18<2.26 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2018-9275
moodle<3.4.2 verification-bypass https://nvd.nist.gov/vuln/detail/CVE-2018-1081
moodle<3.4.2 verification-bypass https://nvd.nist.gov/vuln/detail/CVE-2018-1082
exiv2<0.27 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2018-9303
@@ -17138,7 +17138,7 @@
cups<2.2.10 insufficiently-random-numbers https://nvd.nist.gov/vuln/detail/CVE-2018-4300
podofo<0.9.7 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-10723
py{27,34,35,36,37,38}-notebook<5.7.8 open-redirect https://nvd.nist.gov/vuln/detail/CVE-2019-10856
-libvirt>=4.8.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-3886
+libvirt>=4.8.0<5.3.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-3886
py27-trytond<4.2.21 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-10868
poppler<0.81.0 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-10871
poppler<0.77.0 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-10872
@@ -17497,7 +17497,7 @@
apache-tomcat>=9.0.0.M1<9.0.20 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-10072
postgresql10-server<10.9 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-10164
postgresql11-server<11.4 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-10164
-libvirt>=0.9.4 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-10161
+libvirt>=0.9.4<5.4.1 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-10161
libvirt-[0-9]* arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-10166
libvirt-[0-9]* arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-10167
libvirt-[0-9]* arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-10168
@@ -17570,7 +17570,7 @@
ImageMagick<7.0.8.50 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-13136
ImageMagick<7.0.8.50 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-13137
ImageMagick6<6.9.10.50 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-13137
-virt-manager>=2.2.0 information-leak https://nvd.nist.gov/vuln/detail/CVE-2019-10183
+virt-manager>=2.2.0<2.2.1 information-leak https://nvd.nist.gov/vuln/detail/CVE-2019-10183
qemu<4.1.0 acl-bypass https://nvd.nist.gov/vuln/detail/CVE-2019-13164
SDL2_image<2.0.5 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-5052
SDL2_image<2.0.5 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-5051
@@ -18443,7 +18443,7 @@
gnupg<1.4.19 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2015-1607
gnupg2<2.1.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2015-1607
ikiwiki<3.20150329 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2015-2793
-lilo>=23.1 unspecified https://nvd.nist.gov/vuln/detail/CVE-2011-1934
+lilo>=23.1<23.2 unspecified https://nvd.nist.gov/vuln/detail/CVE-2011-1934
mediawiki<1.20.3 remote-denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2013-1816
mediawiki<1.20.3 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2013-1817
moodle<2.2.2 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2012-1155
@@ -18885,7 +18885,7 @@
py{27,34,35,36,37,38}-django>=1.11<1.11.28 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2020-7471
py{34,35,36,37,38}-django>=2.2<2.2.10 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2020-7471
py{27,36,37,38}-waitress>=1.4.2<1.4.3 remote-denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2020-5236
-pppd>=2.4.2 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2020-8597
+pppd>=2.4.2<2.4.9 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2020-8597
qt5-qtbase<5.14.0 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2020-0569
qt5-qtbase<5.14.0 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2020-0570
mariadb-server>=10.4.7<10.4.12 privilege-escalation https://nvd.nist.gov/vuln/detail/CVE-2020-7221
@@ -19717,7 +19717,7 @@
mozjs78<78.1 multiple-vulnerabilities https://www.mozilla.org/en-US/security/advisories/mfsa2020-32/
thunderbird<78.1 multiple-vulnerabilities https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/
webkit-gtk<2.28.4 multiple-vulnerabilities https://webkitgtk.org/security/WSA-2020-0007.html
-opendmarc>=1.3.2 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2020-12460
+opendmarc>=1.3.2<1.4.0 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2020-12460
cherokee>=0.4.27<1.2.104 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2020-12845
freerdp<2.2.0 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2020-15103
ghostscript-agpl<9.53.0 memory-corruption https://nvd.nist.gov/vuln/detail/CVE-2020-15900
@@ -27284,8 +27284,8 @@
php{56,74,81,82,83,84}-piwigo<15.0.0 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2024-43018
# https://github.com/jpadilla/pyjwt/issues/1080
#py{27,39,310,311,312,313}-JWT-[0-9]* weak-encryption https://nvd.nist.gov/vuln/detail/CVE-2025-45768
-qemu>=10.0.0 unspecified https://nvd.nist.gov/vuln/detail/CVE-2025-54566
-qemu>=10.0.0 unspecified https://nvd.nist.gov/vuln/detail/CVE-2025-54567
+qemu>=10.0.0<10.1.0 unspecified https://nvd.nist.gov/vuln/detail/CVE-2025-54566
+qemu>=10.0.0<10.1.0 unspecified https://nvd.nist.gov/vuln/detail/CVE-2025-54567
sqlite3<3.42.0 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-7458
squid<6.4 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-54574
tiff<4.7.0nb2 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2024-13978
Home |
Main Index |
Thread Index |
Old Index