pkgsrc-Bugs archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
pkg/60611: doc/pkg-vulnerabilities: correct wrong upper bounds
>Number: 60611
>Category: pkg
>Synopsis: doc/pkg-vulnerabilities: correct wrong upper bounds
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: pkg-manager
>State: open
>Class: doc-bug
>Submitter-Id: net
>Arrival-Date: Mon Aug 17 08:30:00 +0000 2026
>Originator: Showta Ishizaki
>Release: NetBSD 10.1 / pkgsrc doc/pkg-vulnerabilities rev 1.779
>Organization:
>Environment:
System: NetBSD bambi.snowrabbit.org 10.1 NetBSD 10.1 (GENERIC) #0: Mon Dec 16 13:08:11 UTC 2024 mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/i386/compile/GENERIC i386
Architecture: i386
Machine: i386
>Description:
These entries have an upper bound below (or otherwise different
from) the version that actually fixed the issue, so users of
the boundary versions are not warned although they are
vulnerable. Verified against the upstream advisories:
- php{56,70,71}-owncloud>=9.0<9.0.58 (was <9.058): "9.058" is
a typo for "9.0.58" (the 9.0-branch fix per CVE-2017-0891);
in dewey terms 9.058 parses as 9.58, distorting the range.
The sibling 9.1 entry is also off by one: the fix is 9.1.6,
not 9.1.5 -> >=9.1<9.1.6.
- grafana<7.3.6 (was <8.3.1): CVE-2020-15216 is the goxmldsig
(<1.1.0) signature-validation bypass reached via crewjam/saml;
grafana first shipped the fixed goxmldsig v1.1.0 in v7.3.6.
The 8.3.1 bound had no basis and left 7.3.6-8.3.0 flagged
while they were not affected -- and 7.x users unflagged.
- prometheus<2.50.1 / CVE-2021-3538: commented out. Prometheus
never shipped satori/go.uuid -- it appears only as an unused
"// indirect" go.mod requirement in v2.8.0-v2.11.0, and the
vulnerable code was never compiled in.
- vim<9.0.0947 (was <9.0.0946): CVE-2022-4141 affects "9.0.0946
and below"; the fix is patch 9.0.0947 (commit cc762a48).
- gst-plugins1-bad<1.22.7 (was <1.22.6): GStreamer SA-2023-0010
(CVE-2023-44446, MXF demuxer UAF): "Affected Versions:
gst-plugins-bad < 1.22.7".
- coreutils>=9.2<9.5 (was <9.4): CVE-2024-0684 (split
--line-bytes heap overflow) was introduced in 9.2 and fixed
only in 9.5; 9.4 itself is vulnerable (9.5 NEWS).
- vault<1.21.0 (was <1.20.3): HCSEC-2025-24 (CVE-2025-6203) was
revised after the initial 1.20.3 remediation proved
incomplete; the effective fix is 1.21.0.
- jenkins<2.516.3 (3 entries, were <2.516.2): the Jenkins
2025-09-17 advisory says CVE-2025-59474/59475/59476 affect
"LTS 2.516.2 and earlier", fixed in LTS 2.516.3 -- the old
bound missed the last vulnerable LTS release.
- apache-cassandra>=4<4.0.16 (was ">=4<4.0."): the truncated
bound made the range empty (in dewey "4.0." == "4"), so the
entry never matched anything. CVE-2025-24860 affects
4.0.0-4.0.15, 4.1.0-4.1.7 and 5.0.0-5.0.2; companion entries
for the 4.1 (<4.1.8) and 5.0 (<5.0.3) branches are added at
the end of the file.
- jenkins>=2.426.3<2.541.3 (was <2.426.4): CVE-2026-33002
(Jenkins advisory 2026-03-18, SECURITY-3674) affects
"2.442 through 2.554, LTS 2.426.3 through LTS 2.541.2",
fixed in weekly 2.555 / LTS 2.541.3; the old bound covered
almost none of the affected range.
Thanks as always for the prompt handling of these reports.
>How-To-Repeat:
Compare the bounds with the referenced advisories, e.g.
https://gstreamer.freedesktop.org/security/sa-2023-0010.html
and https://www.jenkins.io/security/advisory/2025-09-17/.
>Fix:
Apply the following patch (against rev 1.779):
--- pkg-vulnerabilities.cvshead 2026-08-17 16:35:32
+++ pkg-vulnerabilities.1779.bounds2 2026-08-17 17:26:30
@@ -12123,8 +12123,8 @@
libreoffice5-bin<5.2.5 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2016-10327
libreoffice<5.2.5 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2017-7870
libreoffice5-bin<5.2.5 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2017-7870
-php{56,70,71}-owncloud>=9.0<9.058 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2017-0891
-php{56,70,71}-owncloud>=9.1<9.1.5 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2017-0891
+php{56,70,71}-owncloud>=9.0<9.0.58 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2017-0891
+php{56,70,71}-owncloud>=9.1<9.1.6 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2017-0891
php{56,70,71}-wordpress<4.7.5 cross-site-scripting https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9061
php{56,70,71}-wordpress<4.7.5 input-validation https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9062
php{56,70,71}-wordpress<4.7.5 cross-site-scripting https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9063
@@ -19984,7 +19984,7 @@
mediawiki<1.34.4 invalid-validation https://nvd.nist.gov/vuln/detail/CVE-2020-26121
py{27,36,37,38}-rpyc>=4.1.0<4.1.2 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-16328
py{27,36,37,38}-djangorestframework<3.12.0 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2020-25626
-grafana<8.3.1 signature-forgery https://nvd.nist.gov/vuln/detail/CVE-2020-15216
+grafana<7.3.6 signature-forgery https://nvd.nist.gov/vuln/detail/CVE-2020-15216
vault>=1.5.0<1.5.4 access-bypass https://nvd.nist.gov/vuln/detail/CVE-2020-25816
vault>=1.4.0<1.4.7 access-bypass https://nvd.nist.gov/vuln/detail/CVE-2020-25816
mantis<2.24.3 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2020-25288
@@ -21516,7 +21516,7 @@
php{56,72,73,74,80}-nextcloud<21.0.3 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2021-32680
php{56,72,73,74,80}-nextcloud<21.0.3 remote-security-bypass https://nvd.nist.gov/vuln/detail/CVE-2021-32678
php{56,72,73,74,80}-nextcloud<21.0.3 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2021-32679
-prometheus<2.50.1 insufficiently-random-numbers https://nvd.nist.gov/vuln/detail/CVE-2021-3538
+#prometheus<2.50.1 insufficiently-random-numbers https://nvd.nist.gov/vuln/detail/CVE-2021-3538 # prometheus never shipped satori/go.uuid (unused indirect go.mod entry only)
grafana<11 insufficiently-random-numbers https://nvd.nist.gov/vuln/detail/CVE-2021-3538
apache-ant<1.9.16 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2021-36373
apache-ant>=1.10<1.10.11 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2021-36373
@@ -23994,7 +23994,7 @@
vim<8.2.4959 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2022-1725
vim<9.0.0614 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2022-3352
vim<9.0.0805 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2022-3705
-vim<9.0.0946 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2022-4141
+vim<9.0.0947 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2022-4141
vim<9.0.0789 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2022-3591
vim<9.0.0765 heap-based-buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2022-3520
vim<9.0.0742 heap-based-buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2022-3491
@@ -25747,7 +25747,7 @@
gst-plugins1-bad<1.22.6 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-40475
gst-plugins1-bad<1.22.6 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-40476
gst-plugins1-bad<1.22.6 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-44429
-gst-plugins1-bad<1.22.6 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2023-44446
+gst-plugins1-bad<1.22.7 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2023-44446
vim<9.0.2106 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2021-48231
vim<9.0.2112 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2021-48237
gnutls<3.8.2 timing-side-channel https://nvd.nist.gov/vuln/detail/CVE-2023-5981
@@ -25821,7 +25821,7 @@
libde265<1.0.15 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-49468
gst-plugins1-bad<1.22.8 buffer-overflow https://gstreamer.freedesktop.org/security/sa-2023-0011.html
modular-xorg-server<21.1.11 heap-buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-6816
-coreutils<9.4 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2024-0684
+coreutils>=9.2<9.5 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2024-0684
gnutls<3.8.3 timing-side-channel https://nvd.nist.gov/vuln/detail/CVE-2023-0553
py{27,38,39,310,311,312}-Pillow<10.2.0 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2023-50447
postgresql-server>=11<12 eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages
@@ -27532,7 +27532,7 @@
py{27,39,310,311,312,313}-xmltodict<0.15.1 xml-injection https://nvd.nist.gov/vuln/detail/CVE-2025-9375
sqlite3<3.50.3 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-7709
tcpreplay<4.5.3 divide-by-zero https://nvd.nist.gov/vuln/detail/CVE-2025-9649
-vault<1.20.3 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-6203
+vault<1.21.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-6203
wireshark<4.4.9 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-9817
ffmpeg6-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-9951
ffmpeg7-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-9951
@@ -27655,9 +27655,9 @@
go124<1.24.6 invalid-validation https://nvd.nist.gov/vuln/detail/CVE-2025-47906
go123<1.23.12 race-condition https://nvd.nist.gov/vuln/detail/CVE-2025-47910
go124<1.24.6 race-condition https://nvd.nist.gov/vuln/detail/CVE-2025-47910
-jenkins<2.516.2 access-control-bypass https://nvd.nist.gov/vuln/detail/CVE-2025-59474
-jenkins<2.516.2 access-control-bypass https://nvd.nist.gov/vuln/detail/CVE-2025-59475
-jenkins<2.516.2 log-injection https://nvd.nist.gov/vuln/detail/CVE-2025-59476
+jenkins<2.516.3 access-control-bypass https://nvd.nist.gov/vuln/detail/CVE-2025-59474
+jenkins<2.516.3 access-control-bypass https://nvd.nist.gov/vuln/detail/CVE-2025-59475
+jenkins<2.516.3 log-injection https://nvd.nist.gov/vuln/detail/CVE-2025-59476
libsoup-[0-9]* out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2025-11021
libvips<8.17.2 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-59933
libxslt-[0-9]* use-after-free https://nvd.nist.gov/vuln/detail/CVE-2025-10911
@@ -27799,7 +27799,7 @@
python39-[0-9]* eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages
apache-cassandra>=4<4.0.15 man-in-the-middle https://nvd.nist.gov/vuln/detail/CVE-2024-27137
apache-cassandra<3.11.18 privilege-escalation https://nvd.nist.gov/vuln/detail/CVE-2025-23015
-apache-cassandra>=4<4.0. improper-authorization https://nvd.nist.gov/vuln/detail/CVE-2025-24860
+apache-cassandra>=4<4.0.16 improper-authorization https://nvd.nist.gov/vuln/detail/CVE-2025-24860
apache-roller<6.1.3 input-validation https://nvd.nist.gov/vuln/detail/CVE-2024-25090
apache-roller<6.1.4 cross-site-request-forgery https://nvd.nist.gov/vuln/detail/CVE-2024-46911
apache-roller<6.1.5 improper-session-handling https://nvd.nist.gov/vuln/detail/CVE-2025-24859
@@ -30239,7 +30239,7 @@
htslib<1.21.1 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-31971
inetutils-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2026-32772
jenkins<2.541.3 symlink-attack https://nvd.nist.gov/vuln/detail/CVE-2026-33001
-jenkins<2.426.4 security-bypass https://nvd.nist.gov/vuln/detail/CVE-2026-33002
+jenkins>=2.426.3<2.541.3 security-bypass https://nvd.nist.gov/vuln/detail/CVE-2026-33002
libarchive-[0-9]* out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2026-4424
libarchive-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-4426
libexif-[0-9]* integer-underflow https://nvd.nist.gov/vuln/detail/CVE-2026-32775
@@ -30424,3 +30424,5 @@
nginx{,-devel}>=1.31.0<1.31.3 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2026-60005
nginx{,-devel}>=0.9.6<1.30.4 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-42533
nginx{,-devel}>=1.31.0<1.31.3 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-42533
+apache-cassandra>=4.1<4.1.8 improper-authorization https://nvd.nist.gov/vuln/detail/CVE-2025-24860
+apache-cassandra>=5<5.0.3 improper-authorization https://nvd.nist.gov/vuln/detail/CVE-2025-24860
Home |
Main Index |
Thread Index |
Old Index