pkgsrc-Bugs archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
pkg/60615: doc/pkg-vulnerabilities: bound more open-ended glob entries
>Number: 60615
>Category: pkg
>Synopsis: doc/pkg-vulnerabilities: bound more open-ended glob entries
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: pkg-manager
>State: open
>Class: doc-bug
>Submitter-Id: net
>Arrival-Date: Mon Aug 17 15:35:02 +0000 2026
>Originator: Showta Ishizaki
>Release: NetBSD 10.1 / pkgsrc doc/pkg-vulnerabilities rev 1.779
>Organization:
>Environment:
System: NetBSD bambi.snowrabbit.org 10.1 NetBSD 10.1 (GENERIC) #0: Mon Dec 16 13:08:11 UTC 2024 mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/i386/compile/GENERIC i386
Architecture: i386
Machine: i386
>Description:
More entries of the kind fixed in rev 1.776-1.778 and PR
pkg/60610: patterns left open-ended after upstream fixed the
issue, so "pkg_admin audit" keeps flagging every later version
forever. These are the unbounded "pkg-[0-9]*" glob form; each
bound below was verified against the upstream advisory or fix
commit:
- opencc<1.1.2 (CVE-2018-16982): fix commit 4a4f9e58, first
contained in ver.1.1.2.
- opencc<1.2.0 (CVE-2025-15536): fix commit 345c9a50, first
contained in ver.1.2.0 (no 1.1.10 exists).
- roundup<1.6.1 (CVE-2019-10904): Roundup CHANGES.txt, 1.6.1
(2019-07-13): "fix XSS issue in wsgi and cgi when handling
url not found/404" (issue2551035, same reporter/issue as the
CVE record).
- mediawiki / CVE-2019-16738: expanded to <1.31.4,
>=1.32<1.32.4, >=1.33<1.33.1 per the 2019-10-07 security
release announcement.
- mediawiki / CVE-2019-19709: expanded to <1.31.6,
>=1.32<1.32.6, >=1.33<1.33.2 per the 2019-12-19 security
release announcement.
- moodle / CVE-2022-0984 and CVE-2022-0985: expanded to
<3.9.13, >=3.10<3.10.10, >=3.11<3.11.6 per the Moodle
security announcements.
- py{...}-cleo>=1.0.0alpha1<1.0.0 (CVE-2022-42966): the
vulnerable regex is present in all of 1.0.0a1..a5 and the fix
commit b5b9a04d is first contained in 1.0.0 final; the GHSA
"fixed in 2.0.0" claim conflates the two releases made hours
apart on 2022-11-22. (The "alpha1" spelling matters: in
dewey terms 1.0.0alpha1 sorts below 1.0.0, while a literal
"1.0.0a1" would sort above it.)
- podman<4.4.2 (CVE-2023-0778).
- py{...}-octoprint<1.10.0rc1 (CVE-2024-23637).
- py{...}-test<9.0.3 (CVE-2025-71176).
- py{...}-orjson<3.11.6 (CVE-2025-67221).
- py{...}-protobuf<5.29.6 and >=6.30.0rc1<6.33.5
(CVE-2026-0994), covering both affected branches.
Thanks as always for the prompt handling of these reports.
>How-To-Repeat:
e.g. "git tag --contains 4a4f9e58" in BYVoid/OpenCC lists
ver.1.1.2 as the earliest release containing the fix; the
mediawiki/moodle branch bounds match the respective security
release announcements.
>Fix:
Apply the following patch (against rev 1.779):
--- pkg-vulnerabilities.cvshead 2026-08-17 16:35:32
+++ pkg-vulnerabilities.1779.batchA 2026-08-18 00:32:10
@@ -15877,7 +15877,7 @@
dnsdist<1.2.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2016-7069
radare2<2.9.0 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2018-15834
gitolite<3.6.9 access-bypass https://nvd.nist.gov/vuln/detail/CVE-2018-16976
-opencc-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2018-16982
+opencc<1.1.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2018-16982
tor-browser<8.0 unspecified https://nvd.nist.gov/vuln/detail/CVE-2018-16983
php<5.6.38 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2018-17082
php>=7.0<7.0.32 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2018-17082
@@ -17146,7 +17146,7 @@
teeworlds<0.7.3 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-10877
teeworlds<0.7.3 out-of-bounds-write https://nvd.nist.gov/vuln/detail/CVE-2019-10878
teeworlds<0.7.3 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-10879
-roundup-[0-9]* cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2019-10904
+roundup<1.6.1 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2019-10904
py{27,34,35,36,37,38}-jinja2<2.8.1 sandbox-escape https://nvd.nist.gov/vuln/detail/CVE-2016-10745
py{27,34,35,36,37,38}-jinja2<2.10.1 sandbox-escape https://nvd.nist.gov/vuln/detail/CVE-2019-10906
php{56,70,71,72,73}-roundcube-plugin-enigma-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-10740
@@ -18120,7 +18120,9 @@
libgcrypt<1.8.5 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-13627
glpi<9.4.4 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2019-14666
ruby{22,24,25,26}-zip<1.3.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-16892
-mediawiki-[0-9]* information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-16738
+mediawiki<1.31.4 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-16738
+mediawiki>=1.32<1.32.4 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-16738
+mediawiki>=1.33<1.33.1 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-16738
mbedtls<2.19.0 side-channel https://nvd.nist.gov/vuln/detail/CVE-2019-16910
libreoffice<6.3.1 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-9853
exim>=4.92<4.92.3 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-16928
@@ -18584,7 +18586,9 @@
go-dns<1.1.25 insufficiently-random-numbers https://nvd.nist.gov/vuln/detail/CVE-2019-19794
knot<4.3.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-19331
libspiro-[0-9]* stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-19847
-mediawiki-[0-9]* security-bypass https://nvd.nist.gov/vuln/detail/CVE-2019-19709
+mediawiki<1.31.6 security-bypass https://nvd.nist.gov/vuln/detail/CVE-2019-19709
+mediawiki>=1.32<1.32.6 security-bypass https://nvd.nist.gov/vuln/detail/CVE-2019-19709
+mediawiki>=1.33<1.33.2 security-bypass https://nvd.nist.gov/vuln/detail/CVE-2019-19709
nethack-lib<3.6.4 privilege-escalation https://nvd.nist.gov/vuln/detail/CVE-2019-19905
py{27,34,35,36,37,38}-django>=1.11<1.11.27 account-impersonation https://nvd.nist.gov/vuln/detail/CVE-2019-19844
py{34,35,36,37,38}-django>=2.1<2.1.15 account-impersonation https://nvd.nist.gov/vuln/detail/CVE-2019-19844
@@ -23388,8 +23392,12 @@
py{27,36,37,38,39,310}-httpx-[0-9]* input-validation https://nvd.nist.gov/vuln/detail/CVE-2021-41945
podman<3.4.7 code-execution https://nvd.nist.gov/vuln/detail/CVE-2022-1227
ImageMagick>=7.1<7.1.0.28 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2022-1114
-moodle-[0-9]* authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0985
-moodle-[0-9]* authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0984
+moodle<3.9.13 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0985
+moodle>=3.10<3.10.10 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0985
+moodle>=3.11<3.11.6 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0985
+moodle<3.9.13 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0984
+moodle>=3.10<3.10.10 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0984
+moodle>=3.11<3.11.6 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2022-0984
qemu<7.0.0 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2021-4207
qemu<7.0.0 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2021-4206
mediawiki<1.36.4 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2022-28323
@@ -24691,7 +24699,7 @@
py{27,36,37,38,39,310,311}-Pillow<9.3.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2022-45199
py{27,36,37,38,39,310,311}-Pillow<9.2.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2022-45198
py{27,36,37,38,39,310,311}-certifi>=2017.11.05<2022.12.07 improper-certificate-validation https://nvd.nist.gov/vuln/detail/CVE-2022-23491
-py{27,36,37,38,39,310,311}-cleo-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2022-42966
+py{27,36,37,38,39,310,311}-cleo>=1.0.0alpha1<1.0.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2022-42966
py{27,36,37,38,39,310,311}-cryptography>=1.8<39.0.1 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-23931
py{27,36,37,38,39,310,311}-gitpython<3.1.30 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2022-24439
py{27,36,37,38,39,310,311}-ipython<8.10.0 arbitrary-command-injection https://nvd.nist.gov/vuln/detail/CVE-2023-24816
@@ -25479,7 +25487,7 @@
grpc>=1.53.0<1.55.0 expected-behavior-violation https://nvd.nist.gov/vuln/detail/CVE-2023-32731
grpc>=1.51.0<1.53.0 expected-behavior-violation https://nvd.nist.gov/vuln/detail/CVE-2023-1428
grpc<1.55.3 expected-behavior-violation https://nvd.nist.gov/vuln/detail/CVE-2023-4785
-podman-[0-9]* unknown-impact https://nvd.nist.gov/vuln/detail/CVE-2023-0778
+podman<4.4.2 unknown-impact https://nvd.nist.gov/vuln/detail/CVE-2023-0778
opensc-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2023-2977
opensc<0.23.0 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2021-34193
jhead<3.08 out-of-bounds-write https://nvd.nist.gov/vuln/detail/CVE-2022-28550
@@ -25834,7 +25842,7 @@
mbedtls<2.28.7 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-23775
mbedtls>=3<3.5.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-23775
opensc-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2023-5992
-py{27,37,38,39,310,311,312}-octoprint-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2024-23637
+py{27,37,38,39,310,311,312}-octoprint<1.10.0rc1 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2024-23637
glpi<10.0.12 code-injection https://nvd.nist.gov/vuln/detail/CVE-2023-51446
glpi<10.0.12 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2024-23645
graphviz<10 out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2023-46045
@@ -29411,7 +29419,7 @@
firefox140<140.7 multiple-vulnerabilities https://www.mozilla.org/en-US/security/advisories/mfsa2026-03/
thunderbird<147 multiple-vulnerabilities https://www.mozilla.org/en-US/security/advisories/mfsa2026-04/
thunderbird140<140.7 multiple-vulnerabilities https://www.mozilla.org/en-US/security/advisories/mfsa2026-05/
-opencc-[0-9]* out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2025-15536
+opencc<1.2.0 out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2025-15536
assimp-[0-9]* use-after-free https://nvd.nist.gov/vuln/detail/CVE-2025-15538
ImageMagick<7.1.2.13 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-22770
ImageMagick<7.1.2.13 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-23874
@@ -29508,7 +29516,7 @@
python314-[0-9]* input-validation https://nvd.nist.gov/vuln/detail/CVE-2025-12781
ImageMagick<7.1.2.13 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2026-23952
ImageMagick6<6.9.13.38 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2026-23952
-py{27,310,311,312,313,314}-test-[0-9]* insecure-temporary-files https://nvd.nist.gov/vuln/detail/CVE-2025-71176
+py{27,310,311,312,313,314}-test<9.0.3 insecure-temporary-files https://nvd.nist.gov/vuln/detail/CVE-2025-71176
py{27,310,311,312,313,314}-wheel<0.46.2 path-traversal https://nvd.nist.gov/vuln/detail/CVE-2026-24049
7-zip<25.00 path-traversal https://nvd.nist.gov/vuln/detail/CVE-2025-11002
avahi-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-24401
@@ -29530,8 +29538,9 @@
nodejs22-[0-9]* command-injection https://nvd.nist.gov/vuln/detail/CVE-2026-0775
nodejs24-[0-9]* command-injection https://nvd.nist.gov/vuln/detail/CVE-2026-0775
nodejs-[0-9]* command-injection https://nvd.nist.gov/vuln/detail/CVE-2026-0775
-py{27,310,311,312,313,314}-orjson-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-67221
-py{27,310,311,312,313,314}-protobuf-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-0994
+py{27,310,311,312,313,314}-orjson<3.11.6 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-67221
+py{27,310,311,312,313,314}-protobuf<5.29.6 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-0994
+py{27,310,311,312,313,314}-protobuf>=6.30.0rc1<6.33.5 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-0994
python310-[0-9]* invalid-validation https://nvd.nist.gov/vuln/detail/CVE-2026-1299
python311-[0-9]* invalid-validation https://nvd.nist.gov/vuln/detail/CVE-2026-1299
python312-[0-9]* invalid-validation https://nvd.nist.gov/vuln/detail/CVE-2026-1299
Home |
Main Index |
Thread Index |
Old Index