pkg/60610: doc/pkg-vulnerabilities: add missing upper bounds to open-ended entries
"Showta Ishizaki via gnats" <[email protected]>
| Newsgroups | gmane.os.netbsd.devel.pkgsrc.bugs |
|---|---|
| Message-ID | <[email protected]> |
>Number: 60610 >Category: pkg >Synopsis: doc/pkg-vulnerabilities: add missing upper bounds to open-ended entries >Confidential: no >Severity: non-critical >Priority: medium >Responsible: pkg-manager >State: open >Class: doc-bug >Submitter-Id: net >Arrival-Date: Mon Aug 17 08:25:00 +0000 2026 >Originator: Showta Ishizaki >Release: NetBSD 10.1 / pkgsrc doc/pkg-vulnerabilities rev 1.779 >Organization: >Environment: System: NetBSD bambi.snowrabbit.org 10.1 NetBSD 10.1 (GENERIC) #0: Mon Dec 16 13:08:11 UTC 2024 [email protected]:/usr/src/sys/arch/i386/compile/GENERIC i386 Architecture: i386 Machine: i386 >Description: Some entries were added with only a lower bound while the fix was not yet released -- correct at the time, but the upper bound was never added after upstream fixed the issue, so "pkg_admin audit" keeps flagging current packages forever. An audit against rev 1.779 found 13 such entries, plus one with an inverted range. The patch corrects them in place; each bound comes from the upstream fix: - kdegraphics>=4.3.0<4.5.1: CVE-2010-2575 (SA40952) fixed in KDE SC 4.5.1 per KDE advisory 20100825-1. - fuse>=2.0<2.8.6: SA42961 = CVE-2010-3879/CVE-2011-0541..0543, "2.8.5 and earlier", fixed in fuse 2.8.6. - libvirt>1.0.0<1.0.6: SA53440 = CVE-2013-1962, fixed in 1.0.6. - libbpg>=0.9.5<0.9.8: CVE-2016-5637 affects "0.9.5 through 0.9.7". (pkgsrc libbpg has been 0.9.2 since its 2014 import, so this entry has never matched anything; bounded for correctness.) - pam-yubico>=2.18<2.26: CVE-2018-9275 affects "2.18 through 2.25"; 2.26 NEWS: "Make sure to close authfile (CVE-2018-9275)". - libvirt>=4.8.0<5.3.0: CVE-2019-3886 fixed by commit 2a07c990bd, contained in 5.3.0. - libvirt>=0.9.4<5.4.1: CVE-2019-10161 fixed "before versions 4.10.1 and 5.4.1" (LSN-2019-0004). - virt-manager>=2.2.0<2.2.1: CVE-2019-10183 introduced in 2.2.0, fixed in 2.2.1 (named in upstream NEWS). - lilo>=23.1<23.2: CVE-2011-1934 affects exactly 23.1, fixed in 23.2 (Debian #615103). (pkgsrc lilo is 22.8, so the open range never matched it either way.) - pppd>=2.4.2<2.4.9: CVE-2020-8597 fixed upstream by commit 8d7970b8, contained in ppp 2.4.9. Note this is behavior-neutral today: pkgsrc net/pppd is 2.4.3nb2 with no patch for eap.c, so it remains (correctly) flagged. - opendmarc>=1.3.2<1.4.0: CVE-2020-12460 affects "through 1.3.2 and 1.4.x through 1.4.0-Beta1"; 1.4.0 RELEASE_NOTES name the fix (GitHub issue #64). - qemu>=10.0.0<10.1.0 (2 entries): CVE-2025-54566/54567 fixed by commit cad9aa6fbd ("pcie_sriov: Fix configuration and state synchronization", names both CVEs), contained in QEMU 10.1.0. - pptp<=1.7.2 (was pptp>1.7.2): RHBZ#492090 affects pptpsetup in 1.7.2 and earlier -- the range direction was inverted, flagging exactly the unaffected versions. Thanks as always for the prompt handling of these reports. >How-To-Repeat: pkg_admin audit on a current system with e.g. libvirt or virt-manager installed reports the CVEs above although the installed versions contain the fixes. >Fix: Apply the following patch (against rev 1.779): --- pkg-vulnerabilities.cvshead 2026-08-17 16:35:32 +++ pkg-vulnerabilities.1779.bounds 2026-08-17 17:20:39 @@ -3829,7 +3829,7 @@ ap{2,22}-perl<2.0.4nb5 cross-site-scripting https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0796 unrealircd<3.2.7nb2 denial-of-service http://forums.unrealircd.com/viewtopic.php?t=6204 ntp<4.2.4p7 arbitrary-code-execution https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0159 -pptp>1.7.2 information-disclosure https://bugzilla.redhat.com/show_bug.cgi?id=492090 +pptp<=1.7.2 information-disclosure https://bugzilla.redhat.com/show_bug.cgi?id=492090 geeklog<1.5.2.2 sql-injection http://www.geeklog.net/article.php/geeklog-1.5.2sr2 geeklog<1.5.2.3 sql-injection http://www.geeklog.net/article.php/webservices-exploit ghostscript<8.64 arbitrary-code-execution https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6679 @@ -4850,7 +4850,7 @@ libgdiplus<2.6nb1 remote-system-access http://secunia.com/advisories/40792/ quagga<0.99.17 remote-system-access http://secunia.com/advisories/41038/ squid>=3.1.5.1<3.1.7 denial-of-service http://bugs.squid-cache.org/show_bug.cgi?id=3021 -kdegraphics>=4.3.0 remote-system-access http://secunia.com/advisories/40952/ +kdegraphics>=4.3.0<4.5.1 remote-system-access http://secunia.com/advisories/40952/ fuse-encfs<1.7 multiple-vulnerabilities http://secunia.com/advisories/41158/ qt4-libs<4.7.0rc1 ssl-certificate-spoofing http://secunia.com/advisories/41236/ nss<3.12.8 ssl-certificate-spoofing http://secunia.com/advisories/41237/ @@ -5054,7 +5054,7 @@ asterisk>=1.8<1.8.2.2 buffer-overflow http://downloads.digium.com/pub/security/AST-2011-001.html p5-Convert-UUlib<1.4 denial-of-service http://secunia.com/advisories/42998/ pango<1.28.3nb2 denial-of-service http://secunia.com/advisories/42934/ -fuse>=2.0 denial-of-service http://secunia.com/advisories/42961/ +fuse>=2.0<2.8.6 denial-of-service http://secunia.com/advisories/42961/ maradns<1.4.06 remote-system-access https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0520 dpkg<1.14.31 remote-system-access https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0402 suse{,32}_openssl<11.3nb2 remote-security-bypass https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4180 @@ -6832,7 +6832,7 @@ php{53,54}-owncloud<5.0.6 multiple-vulnerabilities http://secunia.com/advisories/53392/ ruby193-base<1.9.3p429 local-security-bypass http://secunia.com/advisories/53432/ acroread9<9.5.5 multiple-vulnerabilities https://www.adobe.com/support/security/bulletins/apsb13-15.html -libvirt>1.0.0 denial-of-service http://secunia.com/advisories/53440/ +libvirt>1.0.0<1.0.6 denial-of-service http://secunia.com/advisories/53440/ wireshark<1.8.7 denial-of-service https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2486 wireshark<1.8.7 denial-of-service https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2487 wireshark<1.8.7 denial-of-service https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2488 @@ -10307,7 +10307,7 @@ php{55,56,70}-contao35<3.5.15 arbitrary-code-execution https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4567 php{55,56,70}-contao41-[0-9]* arbitrary-code-execution https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4567 php{55,56,70}-contao42<4.2.1 arbitrary-code-execution https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4567 -libbpg>=0.9.5 out-of-bounds-write https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5637 +libbpg>=0.9.5<0.9.8 out-of-bounds-write https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5637 adobe-flash-plugin<11.2.202.632 multiple-vulnerabilities https://helpx.adobe.com/security/products/flash-player/apsb16-25.html go>=1.6<1.6.3 input-validation https://golang.org/issue/16405 thunderbird>=45<45.2.0 multiple-vulnerabilities https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird45.2 @@ -14759,7 +14759,7 @@ ncmpc<0.30 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2018-9240 jasper<2.0.19 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2018-9252 libxml2>=2.9.6<2.9.8nb1 infinite-loop https://nvd.nist.gov/vuln/detail/CVE-2018-9251 -pam-yubico>=2.18 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2018-9275 +pam-yubico>=2.18<2.26 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2018-9275 moodle<3.4.2 verification-bypass https://nvd.nist.gov/vuln/detail/CVE-2018-1081 moodle<3.4.2 verification-bypass https://nvd.nist.gov/vuln/detail/CVE-2018-1082 exiv2<0.27 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2018-9303 @@ -17138,7 +17138,7 @@ cups<2.2.10 insufficiently-random-numbers https://nvd.nist.gov/vuln/detail/CVE-2018-4300 podofo<0.9.7 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-10723 py{27,34,35,36,37,38}-notebook<5.7.8 open-redirect https://nvd.nist.gov/vuln/detail/CVE-2019-10856 -libvirt>=4.8.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-3886 +libvirt>=4.8.0<5.3.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-3886 py27-trytond<4.2.21 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2019-10868 poppler<0.81.0 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-10871 poppler<0.77.0 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-10872 @@ -17497,7 +17497,7 @@ apache-tomcat>=9.0.0.M1<9.0.20 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-10072 postgresql10-server<10.9 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-10164 postgresql11-server<11.4 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-10164 -libvirt>=0.9.4 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-10161 +libvirt>=0.9.4<5.4.1 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-10161 libvirt-[0-9]* arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-10166 libvirt-[0-9]* arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-10167 libvirt-[0-9]* arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-10168 @@ -17570,7 +17570,7 @@ ImageMagick<7.0.8.50 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-13136 ImageMagick<7.0.8.50 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-13137 ImageMagick6<6.9.10.50 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2019-13137 -virt-manager>=2.2.0 information-leak https://nvd.nist.gov/vuln/detail/CVE-2019-10183 +virt-manager>=2.2.0<2.2.1 information-leak https://nvd.nist.gov/vuln/detail/CVE-2019-10183 qemu<4.1.0 acl-bypass https://nvd.nist.gov/vuln/detail/CVE-2019-13164 SDL2_image<2.0.5 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-5052 SDL2_image<2.0.5 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2019-5051 @@ -18443,7 +18443,7 @@ gnupg<1.4.19 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2015-1607 gnupg2<2.1.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2015-1607 ikiwiki<3.20150329 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2015-2793 -lilo>=23.1 unspecified https://nvd.nist.gov/vuln/detail/CVE-2011-1934 +lilo>=23.1<23.2 unspecified https://nvd.nist.gov/vuln/detail/CVE-2011-1934 mediawiki<1.20.3 remote-denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2013-1816 mediawiki<1.20.3 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2013-1817 moodle<2.2.2 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2012-1155 @@ -18885,7 +18885,7 @@ py{27,34,35,36,37,38}-django>=1.11<1.11.28 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2020-7471 py{34,35,36,37,38}-django>=2.2<2.2.10 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2020-7471 py{27,36,37,38}-waitress>=1.4.2<1.4.3 remote-denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2020-5236 -pppd>=2.4.2 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2020-8597 +pppd>=2.4.2<2.4.9 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2020-8597 qt5-qtbase<5.14.0 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2020-0569 qt5-qtbase<5.14.0 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2020-0570 mariadb-server>=10.4.7<10.4.12 privilege-escalation https://nvd.nist.gov/vuln/detail/CVE-2020-7221 @@ -19717,7 +19717,7 @@ mozjs78<78.1 multiple-vulnerabilities https://www.mozilla.org/en-US/security/advisories/mfsa2020-32/ thunderbird<78.1 multiple-vulnerabilities https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/ webkit-gtk<2.28.4 multiple-vulnerabilities https://webkitgtk.org/security/WSA-2020-0007.html -opendmarc>=1.3.2 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2020-12460 +opendmarc>=1.3.2<1.4.0 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2020-12460 cherokee>=0.4.27<1.2.104 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2020-12845 freerdp<2.2.0 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2020-15103 ghostscript-agpl<9.53.0 memory-corruption https://nvd.nist.gov/vuln/detail/CVE-2020-15900 @@ -27284,8 +27284,8 @@ php{56,74,81,82,83,84}-piwigo<15.0.0 sql-injection https://nvd.nist.gov/vuln/detail/CVE-2024-43018 # https://github.com/jpadilla/pyjwt/issues/1080 #py{27,39,310,311,312,313}-JWT-[0-9]* weak-encryption https://nvd.nist.gov/vuln/detail/CVE-2025-45768 -qemu>=10.0.0 unspecified https://nvd.nist.gov/vuln/detail/CVE-2025-54566 -qemu>=10.0.0 unspecified https://nvd.nist.gov/vuln/detail/CVE-2025-54567 +qemu>=10.0.0<10.1.0 unspecified https://nvd.nist.gov/vuln/detail/CVE-2025-54566 +qemu>=10.0.0<10.1.0 unspecified https://nvd.nist.gov/vuln/detail/CVE-2025-54567 sqlite3<3.42.0 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-7458 squid<6.4 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-54574 tiff<4.7.0nb2 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2024-13978