pkg/60609: doc/pkg-vulnerabilities: fix patterns that cannot match any PKGBASE
"Showta Ishizaki via gnats" <[email protected]>
| Newsgroups | gmane.os.netbsd.devel.pkgsrc.bugs |
|---|---|
| Message-ID | <[email protected]> |
>Number: 60609 >Category: pkg >Synopsis: doc/pkg-vulnerabilities: fix patterns that cannot match any PKGBASE >Confidential: no >Severity: non-critical >Priority: medium >Responsible: pkg-manager >State: open >Class: doc-bug >Submitter-Id: net >Arrival-Date: Mon Aug 17 08:10:00 +0000 2026 >Originator: Showta Ishizaki >Release: NetBSD 10.1 / pkgsrc doc/pkg-vulnerabilities rev 1.779 >Organization: >Environment: System: NetBSD bambi.snowrabbit.org 10.1 NetBSD 10.1 (GENERIC) #0: Mon Dec 16 13:08:11 UTC 2024 [email protected]:/usr/src/sys/arch/i386/compile/GENERIC i386 Architecture: i386 Machine: i386 >Description: Dewey-style patterns in pkg-vulnerabilities are matched against the exact PKGBASE, so an entry written against a package name that does not exist can never fire and "pkg_admin audit" users are silently never warned. An audit against rev 1.779 found 92 such active entries: - 80 postgresql-server / postgresql-client entries added since 2022 (CVE-2022-1552, CVE-2022-2625, CVE-2024-0985, CVE-2025-1094, CVE-2025-4207, CVE-2025-8713..8715, CVE-2025-12817/12818, CVE-2026-2003..2007, and two eol entries). The unversioned postgresql packages were removed in 2004 at version 7.4; the real packages are postgresqlNN-server / postgresqlNN-client. Note the file itself used the correct form for the 2020 CVEs, e.g. "postgresql13-server<13.1" (CVE-2020-25694..25696), so this is a regression in newer entries. This block also contains 5 accidental byte-identical duplicate lines (4x CVE-2026-2004, 1x CVE-2026-2005). - 12 other entries: djvulibre (3 entries; the packages are djvulibre-lib / djvulibre-tools, all sibling entries already use djvulibre-lib), "qimp" (typo for gimp, CVE-2023-44442), gstreamer (2 entries; the 1.x framework is gstreamer1 / gst-plugins1-*, the 0.8-era "gstreamer" package was removed in 2006), c-ares (the package is libcares; the other 14 entries for this library already say libcares; bound also corrected to the actual fix 1.17.1), commonmarker (the gem is rubyNN-commonmarker), yubico-c-client (the package is ykclient), py{NN}-mysql (PyMySQL is packaged as py{NN}-pymysql; bound also corrected to <1.1.1, the actual fixed version of CVE-2024-36039), "php-8.1<8.2" eol entry (the PHP base PKGBASE is "php"; cf. the correct "php>=7.4<8.0" form four lines above), and the p5-Apache-Session-Generate-[0-9]* glob (the affected module Apache::Session::Generate::MD5 ships in the Apache-Session distribution, packaged as p5-Apache-Session; the glob requires a digit after "Generate-" and matches nothing). The patch: - corrects 85 entries in place where the old pattern never matched any package that ever existed; - comments out 7 entries whose pattern DID match a historic package (the pre-2004 unversioned postgresql at <13.23 / <14.21 without a lower bound, and 0.8-era gstreamer at <1.26.3) and adds 7 corrected replacement entries at the end of the file, so behavior for museum systems is preserved in the comment trail; - comments out the 5 accidental duplicate lines. Thanks as always for the prompt handling of these reports. >How-To-Repeat: pkg_info -e 'postgresql16-server>=0' vs the patterns above; grep '^postgresql-server' pkg-vulnerabilities and compare with databases/postgresql16-server/Makefile (PKGNAME= ${DISTNAME:S/-/16-server-/}). >Fix: Apply the following patch (against rev 1.779): --- pkg-vulnerabilities.cvshead 2026-08-17 16:35:32 +++ pkg-vulnerabilities.1779.deadfix 2026-08-17 17:03:55 @@ -24998,16 +24998,16 @@ amanda-client<3.3.9nb7 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2022-37703 GraphicsMagick<1.3.38 heap-based-buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2022-1270 ap{22,24}-auth-openidc<2.4.12.2 open-redirect https://nvd.nist.gov/vuln/detail/CVE-2022-23527 -postgresql-server>=10<10.22 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-2625 -postgresql-server>=11<11.17 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-2625 -postgresql-server>=12<12.12 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-2625 -postgresql-server>=13<13.8 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-2625 -postgresql-server>=14<14.5 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-2625 -postgresql-server>=10<10.21 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-1552 -postgresql-server>=11<11.16 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-1552 -postgresql-server>=12<12.11 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-1552 -postgresql-server>=13<13.7 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-1552 -postgresql-server>=14<14.3 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-1552 +postgresql10-server<10.22 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-2625 +postgresql11-server<11.17 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-2625 +postgresql12-server<12.12 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-2625 +postgresql13-server<13.8 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-2625 +postgresql14-server<14.5 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-2625 +postgresql10-server<10.21 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-1552 +postgresql11-server<11.16 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-1552 +postgresql12-server<12.11 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-1552 +postgresql13-server<13.7 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-1552 +postgresql14-server<14.3 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2022-1552 asterisk>=16<16.16.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2021-46837 asterisk>=17<17.9.3 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2021-46837 asterisk>=18<18.2.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2021-46837 @@ -25086,7 +25086,7 @@ nodejs>=19<19.6.1 security-restrictions-bypass https://nvd.nist.gov/vuln/detail/CVE-2023-23918 apache<2.4.56 http-response-splitting https://nvd.nist.gov/vuln/detail/CVE-2023-27522 apache<2.4.56 http-response-splitting https://nvd.nist.gov/vuln/detail/CVE-2023-25690 -yubico-c-client-[0-9]* eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages +ykclient-[0-9]* eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages curl>=7.7<8.00 command-injection https://nvd.nist.gov/vuln/detail/CVE-2023-27533 curl>=7.18<8.00 improper-path-limitation https://nvd.nist.gov/vuln/detail/CVE-2023-27534 curl>=7.13<8.00 authentication-bypass https://nvd.nist.gov/vuln/detail/CVE-2023-27535 @@ -25473,8 +25473,8 @@ libcue<2.2.1nb1 memory-corruption https://nvd.nist.gov/vuln/detail/CVE-2023-43641 mutt<2.2.12 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2023-4874 mutt<2.2.12 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2023-4875 -djvulibre-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2021-46312 -djvulibre-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2021-46310 +djvulibre-lib-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2021-46312 +djvulibre-lib-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2021-46310 grpc<1.53.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2023-32732 grpc>=1.53.0<1.55.0 expected-behavior-violation https://nvd.nist.gov/vuln/detail/CVE-2023-32731 grpc>=1.51.0<1.53.0 expected-behavior-violation https://nvd.nist.gov/vuln/detail/CVE-2023-1428 @@ -25726,7 +25726,7 @@ exiv2>=0.28<0.28.1 out-of-bounds-write https://nvd.nist.gov/vuln/detail/CVE-2023-44398 ltm<1.2.1 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-36328 gimp<2.10.36 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2023-44441 -qimp<2.10.36 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2023-44442 +gimp<2.10.36 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2023-44442 gimp<2.10.36 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2023-44443 gimp<2.10.36 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2023-44444 tor<0.4.8.8 unknown-impact https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE @@ -25824,7 +25824,7 @@ coreutils<9.4 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2024-0684 gnutls<3.8.3 timing-side-channel https://nvd.nist.gov/vuln/detail/CVE-2023-0553 py{27,38,39,310,311,312}-Pillow<10.2.0 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2023-50447 -postgresql-server>=11<12 eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages +postgresql11-* eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages nodejs>=16<18 eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages py{27,37,38,39,310,311,312}-aiohttp<3.9.2 directory-traversal https://nvd.nist.gov/vuln/detail/CVE-2024-23334 py{27,37,38,39,310,311,312}-aiohttp<3.9.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-23829 @@ -25845,11 +25845,11 @@ py{37,38,39,310,311,312}-django>=4.1<4.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-24680 py{37,38,39,310,311,312}-django>=4.2<4.2.10 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-24680 libuv>=1.24.0<1.48 address-check-bypass https://nvd.nist.gov/vuln/detail/CVE-2024-24806 -postgresql-server>=12<12.18 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2024-0985 -postgresql-server>=13<13.14 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2024-0985 -postgresql-server>=14<14.11 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2024-0985 -postgresql-server>=15<15.6 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2024-0985 -postgresql-server>=16<16.2 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2024-0985 +postgresql12-server<12.18 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2024-0985 +postgresql13-server<13.14 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2024-0985 +postgresql14-server<14.11 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2024-0985 +postgresql15-server<15.6 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2024-0985 +postgresql16-server<16.2 arbitrary-command-execution https://nvd.nist.gov/vuln/detail/CVE-2024-0985 asterisk-13.* eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages unbound<1.19.1 denial-of-service https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50387 unbound<1.19.1 denial-of-service https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50868 @@ -25973,7 +25973,7 @@ keepassxc-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2024-33900 keepassxc-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2024-33901 py{27,37,38,39,310,311,312}-requests<2.32.0 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2024-35195 -py{37,38,39,310,311,312}-mysql<1.1.0 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2024-36039 +py{37,38,39,310,311,312}-pymysql<1.1.1 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2024-36039 gst-plugins1-base<1.24.3 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2024-4453 lighttpd-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2024-3708 libarchive<3.7.4 out-of-bounds-access https://nvd.nist.gov/vuln/detail/CVE-2024-26256 @@ -26102,13 +26102,13 @@ openafs>=1.7<1.8.13 denial-of-service http://openafs.org/pages/security/OPENAFS-SA-2024-002.txt openafs<1.6.25 buffer-overflow http://openafs.org/pages/security/OPENAFS-SA-2024-003.txt openafs>=1.7<1.8.13 buffer-overflow http://openafs.org/pages/security/OPENAFS-SA-2024-003.txt -postgresql-server>=12<13 eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages +postgresql12-* eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages wget<1.25.0 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2024-10524 webkit-gtk<2.46.4 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2024-44308 py{38,39,310,311,312}-django>=4<4.2.17 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-53907 py{38,39,310,311,312}-django>=5<5.1.4 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-53907 curl<8.11.1 credential-leak https://nvd.nist.gov/vuln/detail/CVE-2024-11053 -gstreamer-1.24.10 multiple-vulnerabilities https://discourse.gstreamer.org/t/gstreamer-1-24-10-stable-bug-fix-release/3683 +gstreamer1<1.24.10 multiple-vulnerabilities https://discourse.gstreamer.org/t/gstreamer-1-24-10-stable-bug-fix-release/3683 firefox<131.0.2 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2024-9680 firefox128<128.3.1 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2024-9680 firefox115<115.16.1 remote-code-execution https://nvd.nist.gov/vuln/detail/CVE-2024-9680 @@ -26126,11 +26126,11 @@ libtasn1<4.20.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-12133 openssl>=3.3<3.3.3 man-in-the-middle https://nvd.nist.gov/vuln/detail/CVE-2024-12797 openssl>=3.4<3.4.1 man-in-the-middle https://nvd.nist.gov/vuln/detail/CVE-2024-12797 -postgresql-server>=13<13.19 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2025-1094 -postgresql-server>=14<14.16 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2025-1094 -postgresql-server>=15<15.11 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2025-1094 -postgresql-server>=16<16.7 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2025-1094 -postgresql-server>=17<17.3 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2025-1094 +postgresql13-server<13.19 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2025-1094 +postgresql14-server<14.16 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2025-1094 +postgresql15-server<15.11 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2025-1094 +postgresql16-server<16.7 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2025-1094 +postgresql17-server<17.3 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2025-1094 vim<9.1.1115 use-after-free https://github.com/vim/vim/security/advisories/GHSA-63p5-mwg2-787v libxml2<2.12.10 stack-buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-24928 libxml2<2.12.10 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2024-56171 @@ -26184,11 +26184,11 @@ liboqs<0.13.0 information-disclosure https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/Wiu4ZQo3fP8 py{39,310,311,312,313}-django<4.2.21 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-32873 py{39,310,311,312,313}-django>=5<5.2.1 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-32873 -postgresql-server>=13<13.21 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-4207 -postgresql-server>=14<14.18 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-4207 -postgresql-server>=15<15.13 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-4207 -postgresql-server>=16<16.9 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-4207 -postgresql-server>=17<17.5 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-4207 +postgresql13-server<13.21 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-4207 +postgresql14-server<14.18 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-4207 +postgresql15-server<15.13 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-4207 +postgresql16-server<16.9 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-4207 +postgresql17-server<17.5 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-4207 dropbear<2025.88 command-injection https://nvd.nist.gov/vuln/detail/CVE-2025-47203 screen<4.9.1nb2 multiple-vulnerabilities https://security.opensuse.org/2025/05/12/screen-security-issues.html screen>=5<5.0.0nb3 multiple-vulnerabilities https://security.opensuse.org/2025/05/12/screen-security-issues.html @@ -27118,7 +27118,7 @@ chromium<138.0.7204.96 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-6554 cpp-httplib<0.20.1 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-53628 cpp-httplib<0.20.1 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-53629 -djvulibre<3.5.29 out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2025-53367 +djvulibre-lib<3.5.29 out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2025-53367 dpkg<1.22.21 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-6297 gdk-pixbuf2<2.42.12nb3 out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2025-7345 git-base>=2.50<2.50.1 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-48386 @@ -27132,7 +27132,7 @@ gnutls<3.8.10 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-32989 gnutls<3.8.10 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-32990 gnutls<3.8.10 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-6395 -gstreamer<1.26.3 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-6663 +#gstreamer<1.26.3 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-6663 # wrong PKGBASE; corrected entry added at end of file gtar-[0-9]* directory-traversal https://nvd.nist.gov/vuln/detail/CVE-2025-45582 guacamole-server<1.6.0 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2024-35164 hdf5-[0-9]* heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-7067 @@ -27392,21 +27392,21 @@ libsixel<1.8.7 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-9300 libsndfile-[0-9]* buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-52194 libssh<0.112 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-4877 -postgresql-server>=13<13.22 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-8713 -postgresql-server>=14<14.19 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-8713 -postgresql-server>=15<15.14 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-8713 -postgresql-server>=16<16.10 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-8713 -postgresql-server>=17<17.6 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-8713 -postgresql-server>=13<13.22 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8714 -postgresql-server>=14<14.19 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8714 -postgresql-server>=15<15.14 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8714 -postgresql-server>=16<16.10 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8714 -postgresql-server>=17<17.6 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8714 -postgresql-server>=13<13.22 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8715 -postgresql-server>=14<14.19 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8715 -postgresql-server>=15<15.14 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8715 -postgresql-server>=16<16.10 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8715 -postgresql-server>=17<17.6 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8715 +postgresql13-server<13.22 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-8713 +postgresql14-server<14.19 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-8713 +postgresql15-server<15.14 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-8713 +postgresql16-server<16.10 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-8713 +postgresql17-server<17.6 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-8713 +postgresql13-server<13.22 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8714 +postgresql14-server<14.19 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8714 +postgresql15-server<15.14 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8714 +postgresql16-server<16.10 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8714 +postgresql17-server<17.6 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8714 +postgresql13-server<13.22 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8715 +postgresql14-server<14.19 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8715 +postgresql15-server<15.14 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8715 +postgresql16-server<16.10 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8715 +postgresql17-server<17.6 code-injection https://nvd.nist.gov/vuln/detail/CVE-2025-8715 proftpd<1.3.3d backdoor https://nvd.nist.gov/vuln/detail/CVE-2010-20103 # disputed, this is how Python's import works #py{27,39,310,311,312,313}-future-[0-9]* arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2025-50817 @@ -28040,7 +28040,7 @@ botan>=3<3.5.0 improper-certificate-validation https://nvd.nist.gov/vuln/detail/CVE-2024-39312 botan<3.6.0 unspecified https://nvd.nist.gov/vuln/detail/CVE-2024-50382 botan<3.6.0 unspecified https://nvd.nist.gov/vuln/detail/CVE-2024-50383 -c-ares<1.17.0 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2020-22217 +libcares<1.17.1 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2020-22217 cJSON<1.7.17 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2023-50471 cJSON<1.7.17 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2023-50472 cJSON<1.7.18 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-31755 @@ -28092,7 +28092,7 @@ clamav<1.4.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-20128 clojure<1.9.0 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2017-20189 clojure<1.12.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-22871 -commonmarker<0.23.4 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2024-22051 +ruby{26,27,30,31,32,33,34}-commonmarker<0.23.4 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2024-22051 consul<1.20.1 path-traversal https://nvd.nist.gov/vuln/detail/CVE-2024-10005 consul<1.20.1 security-bypass https://nvd.nist.gov/vuln/detail/CVE-2024-10006 consul<1.20.0 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2024-10086 @@ -28916,18 +28916,18 @@ php{56,74,81,82,83,84}-phppgadmin<9.10 command-injection https://nvd.nist.gov/vuln/detail/CVE-2025-12763 php{56,74,81,82,83,84}-phppgadmin<9.10 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12764 php{56,74,81,82,83,84}-phppgadmin<9.10 improper-certificate-validation https://nvd.nist.gov/vuln/detail/CVE-2025-12765 -postgresql-client<13.23 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 -postgresql-client>=14<14.20 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 -postgresql-client>=15<15.15 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 -postgresql-client>=16<16.11 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 -postgresql-client>=17<17.7 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 -postgresql-client>=18<18.1 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 -postgresql-server<13.23 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 -postgresql-server>=14<14.20 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 -postgresql-server>=15<15.15 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 -postgresql-server>=16<16.11 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 -postgresql-server>=17<17.7 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 -postgresql-server>=18<18.1 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 +#postgresql-client<13.23 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 # wrong PKGBASE; corrected entry added at end of file +postgresql14-client<14.20 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 +postgresql15-client<15.15 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 +postgresql16-client<16.11 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 +postgresql17-client<17.7 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 +postgresql18-client<18.1 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 +#postgresql-server<13.23 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 # wrong PKGBASE; corrected entry added at end of file +postgresql14-server<14.20 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 +postgresql15-server<15.15 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 +postgresql16-server<16.11 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 +postgresql17-server<17.7 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 +postgresql18-server<18.1 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 radare2<6.0.5 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2025-63744 radare2<6.0.5 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2025-63745 qjson-[0-9]* eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages @@ -29326,7 +29326,7 @@ iperf3<3.14 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-38403 iperf3<3.17 timing-side-channel https://nvd.nist.gov/vuln/detail/CVE-2024-26306 iperf3<3.18 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2024-53580 -php-8.1<8.2 eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages +php>=8.1<8.2 eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages php81-* eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages chromium<143.0.7499.192 code-injection https://nvd.nist.gov/vuln/detail/CVE-2026-0628 libtasn1<4.21.0 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-13151 @@ -29906,32 +29906,32 @@ php{56,74,81,82,83,84}-owncloud-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-25337 php{56,74,81,82,83,84}-piwigo<15.0.0 insufficiently-random-numbers https://nvd.nist.gov/vuln/detail/CVE-2024-48928 php{56,74,81,82,83,84}-piwigo-[0-9]* information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2025-62512 -postgresql-server<14.21 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2003 -postgresql-server>=15<15.16 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2003 -postgresql-server>=16<16.12 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2003 -postgresql-server>=17<17.8 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2003 -postgresql-server>=18<18.2 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2003 -postgresql-server<14.21 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 -postgresql-server>=15<15.16 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 -postgresql-server>=15<15.16 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 -postgresql-server>=15<15.16 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 -postgresql-server>=15<15.16 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 -postgresql-server>=15<15.16 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 -postgresql-server>=16<16.12 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 -postgresql-server>=17<17.8 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 -postgresql-server>=18<18.2 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 -postgresql-server<14.21 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 -postgresql-server>=15<15.16 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 -postgresql-server>=16<16.12 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 -postgresql-server>=17<17.8 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 -postgresql-server>=17<17.8 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 -postgresql-server>=18<18.2 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 -postgresql-server<14.21 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2026-2006 -postgresql-server>=15<15.16 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2026-2006 -postgresql-server>=16<16.12 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2026-2006 -postgresql-server>=17<17.8 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2026-2006 -postgresql-server>=18<18.2 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2026-2006 -postgresql-server>=18<18.2 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2007 +#postgresql-server<14.21 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2003 # wrong PKGBASE; corrected entry added at end of file +postgresql15-server<15.16 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2003 +postgresql16-server<16.12 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2003 +postgresql17-server<17.8 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2003 +postgresql18-server<18.2 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2003 +#postgresql-server<14.21 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 # wrong PKGBASE; corrected entry added at end of file +postgresql15-server<15.16 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 +#postgresql15-server<15.16 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 # accidental duplicate of the previous line +#postgresql15-server<15.16 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 # accidental duplicate of the previous line +#postgresql15-server<15.16 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 # accidental duplicate of the previous line +#postgresql15-server<15.16 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 # accidental duplicate of the previous line +postgresql16-server<16.12 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 +postgresql17-server<17.8 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 +postgresql18-server<18.2 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 +#postgresql-server<14.21 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 # wrong PKGBASE; corrected entry added at end of file +postgresql15-server<15.16 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 +postgresql16-server<16.12 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 +postgresql17-server<17.8 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 +#postgresql17-server<17.8 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 # accidental duplicate of the previous line +postgresql18-server<18.2 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 +#postgresql-server<14.21 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2026-2006 # wrong PKGBASE; corrected entry added at end of file +postgresql15-server<15.16 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2026-2006 +postgresql16-server<16.12 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2026-2006 +postgresql17-server<17.8 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2026-2006 +postgresql18-server<18.2 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2026-2006 +postgresql18-server<18.2 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2007 py{27,310,311,312,313,314}-Pillow<12.1.1 out-of-bounds-write https://nvd.nist.gov/vuln/detail/CVE-2026-25990 py{27,310,311,312,313,314}-flask<3.1.3 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2026-27205 py{27,310,311,312,313,314}-nltk<3.9.3 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2025-14009 @@ -30145,7 +30145,7 @@ mold-[0-9]* heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-3994 openexr<3.4.6 out-of-bounds-write https://nvd.nist.gov/vuln/detail/CVE-2026-27622 openssl<3.6.2 security-bypass https://nvd.nist.gov/vuln/detail/CVE-2026-2673 -p5-Apache-Session-Generate-[0-9]* weak-cryptography https://nvd.nist.gov/vuln/detail/CVE-2025-40931 +p5-Apache-Session-[0-9]* weak-cryptography https://nvd.nist.gov/vuln/detail/CVE-2025-40931 php{56,74,81,82,83,84}-concrete-cms<9.4.8 cross-site-request-forgery https://nvd.nist.gov/vuln/detail/CVE-2026-2994 php{56,74,81,82,83,84}-concrete-cms<9.4.8 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2026-3240 php{56,74,81,82,83,84}-concrete-cms<9.4.8 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2026-3241 @@ -30424,3 +30424,10 @@ nginx{,-devel}>=1.31.0<1.31.3 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2026-60005 nginx{,-devel}>=0.9.6<1.30.4 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-42533 nginx{,-devel}>=1.31.0<1.31.3 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-42533 +gst-plugins1-bad<1.26.3 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-6663 +postgresql13-client<13.23 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12818 +postgresql13-server<13.23 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-12817 +postgresql14-server<14.21 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2003 +postgresql14-server<14.21 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-2004 +postgresql14-server<14.21 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-2005 +postgresql14-server<14.21 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2026-2006