pkg/60611: doc/pkg-vulnerabilities: correct wrong upper bounds
"Showta Ishizaki via gnats" <[email protected]>
| Newsgroups | gmane.os.netbsd.devel.pkgsrc.bugs |
|---|---|
| Message-ID | <[email protected]> |
>Number: 60611 >Category: pkg >Synopsis: doc/pkg-vulnerabilities: correct wrong upper bounds >Confidential: no >Severity: non-critical >Priority: medium >Responsible: pkg-manager >State: open >Class: doc-bug >Submitter-Id: net >Arrival-Date: Mon Aug 17 08:30:00 +0000 2026 >Originator: Showta Ishizaki >Release: NetBSD 10.1 / pkgsrc doc/pkg-vulnerabilities rev 1.779 >Organization: >Environment: System: NetBSD bambi.snowrabbit.org 10.1 NetBSD 10.1 (GENERIC) #0: Mon Dec 16 13:08:11 UTC 2024 [email protected]:/usr/src/sys/arch/i386/compile/GENERIC i386 Architecture: i386 Machine: i386 >Description: These entries have an upper bound below (or otherwise different from) the version that actually fixed the issue, so users of the boundary versions are not warned although they are vulnerable. Verified against the upstream advisories: - php{56,70,71}-owncloud>=9.0<9.0.58 (was <9.058): "9.058" is a typo for "9.0.58" (the 9.0-branch fix per CVE-2017-0891); in dewey terms 9.058 parses as 9.58, distorting the range. The sibling 9.1 entry is also off by one: the fix is 9.1.6, not 9.1.5 -> >=9.1<9.1.6. - grafana<7.3.6 (was <8.3.1): CVE-2020-15216 is the goxmldsig (<1.1.0) signature-validation bypass reached via crewjam/saml; grafana first shipped the fixed goxmldsig v1.1.0 in v7.3.6. The 8.3.1 bound had no basis and left 7.3.6-8.3.0 flagged while they were not affected -- and 7.x users unflagged. - prometheus<2.50.1 / CVE-2021-3538: commented out. Prometheus never shipped satori/go.uuid -- it appears only as an unused "// indirect" go.mod requirement in v2.8.0-v2.11.0, and the vulnerable code was never compiled in. - vim<9.0.0947 (was <9.0.0946): CVE-2022-4141 affects "9.0.0946 and below"; the fix is patch 9.0.0947 (commit cc762a48). - gst-plugins1-bad<1.22.7 (was <1.22.6): GStreamer SA-2023-0010 (CVE-2023-44446, MXF demuxer UAF): "Affected Versions: gst-plugins-bad < 1.22.7". - coreutils>=9.2<9.5 (was <9.4): CVE-2024-0684 (split --line-bytes heap overflow) was introduced in 9.2 and fixed only in 9.5; 9.4 itself is vulnerable (9.5 NEWS). - vault<1.21.0 (was <1.20.3): HCSEC-2025-24 (CVE-2025-6203) was revised after the initial 1.20.3 remediation proved incomplete; the effective fix is 1.21.0. - jenkins<2.516.3 (3 entries, were <2.516.2): the Jenkins 2025-09-17 advisory says CVE-2025-59474/59475/59476 affect "LTS 2.516.2 and earlier", fixed in LTS 2.516.3 -- the old bound missed the last vulnerable LTS release. - apache-cassandra>=4<4.0.16 (was ">=4<4.0."): the truncated bound made the range empty (in dewey "4.0." == "4"), so the entry never matched anything. CVE-2025-24860 affects 4.0.0-4.0.15, 4.1.0-4.1.7 and 5.0.0-5.0.2; companion entries for the 4.1 (<4.1.8) and 5.0 (<5.0.3) branches are added at the end of the file. - jenkins>=2.426.3<2.541.3 (was <2.426.4): CVE-2026-33002 (Jenkins advisory 2026-03-18, SECURITY-3674) affects "2.442 through 2.554, LTS 2.426.3 through LTS 2.541.2", fixed in weekly 2.555 / LTS 2.541.3; the old bound covered almost none of the affected range. Thanks as always for the prompt handling of these reports. >How-To-Repeat: Compare the bounds with the referenced advisories, e.g. https://gstreamer.freedesktop.org/security/sa-2023-0010.html and https://www.jenkins.io/security/advisory/2025-09-17/. >Fix: Apply the following patch (against rev 1.779): --- pkg-vulnerabilities.cvshead 2026-08-17 16:35:32 +++ pkg-vulnerabilities.1779.bounds2 2026-08-17 17:26:30 @@ -12123,8 +12123,8 @@ libreoffice5-bin<5.2.5 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2016-10327 libreoffice<5.2.5 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2017-7870 libreoffice5-bin<5.2.5 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2017-7870 -php{56,70,71}-owncloud>=9.0<9.058 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2017-0891 -php{56,70,71}-owncloud>=9.1<9.1.5 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2017-0891 +php{56,70,71}-owncloud>=9.0<9.0.58 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2017-0891 +php{56,70,71}-owncloud>=9.1<9.1.6 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2017-0891 php{56,70,71}-wordpress<4.7.5 cross-site-scripting https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9061 php{56,70,71}-wordpress<4.7.5 input-validation https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9062 php{56,70,71}-wordpress<4.7.5 cross-site-scripting https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9063 @@ -19984,7 +19984,7 @@ mediawiki<1.34.4 invalid-validation https://nvd.nist.gov/vuln/detail/CVE-2020-26121 py{27,36,37,38}-rpyc>=4.1.0<4.1.2 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2019-16328 py{27,36,37,38}-djangorestframework<3.12.0 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2020-25626 -grafana<8.3.1 signature-forgery https://nvd.nist.gov/vuln/detail/CVE-2020-15216 +grafana<7.3.6 signature-forgery https://nvd.nist.gov/vuln/detail/CVE-2020-15216 vault>=1.5.0<1.5.4 access-bypass https://nvd.nist.gov/vuln/detail/CVE-2020-25816 vault>=1.4.0<1.4.7 access-bypass https://nvd.nist.gov/vuln/detail/CVE-2020-25816 mantis<2.24.3 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2020-25288 @@ -21516,7 +21516,7 @@ php{56,72,73,74,80}-nextcloud<21.0.3 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2021-32680 php{56,72,73,74,80}-nextcloud<21.0.3 remote-security-bypass https://nvd.nist.gov/vuln/detail/CVE-2021-32678 php{56,72,73,74,80}-nextcloud<21.0.3 information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2021-32679 -prometheus<2.50.1 insufficiently-random-numbers https://nvd.nist.gov/vuln/detail/CVE-2021-3538 +#prometheus<2.50.1 insufficiently-random-numbers https://nvd.nist.gov/vuln/detail/CVE-2021-3538 # prometheus never shipped satori/go.uuid (unused indirect go.mod entry only) grafana<11 insufficiently-random-numbers https://nvd.nist.gov/vuln/detail/CVE-2021-3538 apache-ant<1.9.16 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2021-36373 apache-ant>=1.10<1.10.11 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2021-36373 @@ -23994,7 +23994,7 @@ vim<8.2.4959 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2022-1725 vim<9.0.0614 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2022-3352 vim<9.0.0805 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2022-3705 -vim<9.0.0946 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2022-4141 +vim<9.0.0947 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2022-4141 vim<9.0.0789 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2022-3591 vim<9.0.0765 heap-based-buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2022-3520 vim<9.0.0742 heap-based-buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2022-3491 @@ -25747,7 +25747,7 @@ gst-plugins1-bad<1.22.6 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-40475 gst-plugins1-bad<1.22.6 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-40476 gst-plugins1-bad<1.22.6 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-44429 -gst-plugins1-bad<1.22.6 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2023-44446 +gst-plugins1-bad<1.22.7 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2023-44446 vim<9.0.2106 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2021-48231 vim<9.0.2112 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2021-48237 gnutls<3.8.2 timing-side-channel https://nvd.nist.gov/vuln/detail/CVE-2023-5981 @@ -25821,7 +25821,7 @@ libde265<1.0.15 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-49468 gst-plugins1-bad<1.22.8 buffer-overflow https://gstreamer.freedesktop.org/security/sa-2023-0011.html modular-xorg-server<21.1.11 heap-buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2023-6816 -coreutils<9.4 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2024-0684 +coreutils>=9.2<9.5 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2024-0684 gnutls<3.8.3 timing-side-channel https://nvd.nist.gov/vuln/detail/CVE-2023-0553 py{27,38,39,310,311,312}-Pillow<10.2.0 arbitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2023-50447 postgresql-server>=11<12 eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages @@ -27532,7 +27532,7 @@ py{27,39,310,311,312,313}-xmltodict<0.15.1 xml-injection https://nvd.nist.gov/vuln/detail/CVE-2025-9375 sqlite3<3.50.3 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-7709 tcpreplay<4.5.3 divide-by-zero https://nvd.nist.gov/vuln/detail/CVE-2025-9649 -vault<1.20.3 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-6203 +vault<1.21.0 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-6203 wireshark<4.4.9 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-9817 ffmpeg6-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-9951 ffmpeg7-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-9951 @@ -27655,9 +27655,9 @@ go124<1.24.6 invalid-validation https://nvd.nist.gov/vuln/detail/CVE-2025-47906 go123<1.23.12 race-condition https://nvd.nist.gov/vuln/detail/CVE-2025-47910 go124<1.24.6 race-condition https://nvd.nist.gov/vuln/detail/CVE-2025-47910 -jenkins<2.516.2 access-control-bypass https://nvd.nist.gov/vuln/detail/CVE-2025-59474 -jenkins<2.516.2 access-control-bypass https://nvd.nist.gov/vuln/detail/CVE-2025-59475 -jenkins<2.516.2 log-injection https://nvd.nist.gov/vuln/detail/CVE-2025-59476 +jenkins<2.516.3 access-control-bypass https://nvd.nist.gov/vuln/detail/CVE-2025-59474 +jenkins<2.516.3 access-control-bypass https://nvd.nist.gov/vuln/detail/CVE-2025-59475 +jenkins<2.516.3 log-injection https://nvd.nist.gov/vuln/detail/CVE-2025-59476 libsoup-[0-9]* out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2025-11021 libvips<8.17.2 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-59933 libxslt-[0-9]* use-after-free https://nvd.nist.gov/vuln/detail/CVE-2025-10911 @@ -27799,7 +27799,7 @@ python39-[0-9]* eol https://ftp.NetBSD.org/pub/NetBSD/packages/vulns/eol-packages apache-cassandra>=4<4.0.15 man-in-the-middle https://nvd.nist.gov/vuln/detail/CVE-2024-27137 apache-cassandra<3.11.18 privilege-escalation https://nvd.nist.gov/vuln/detail/CVE-2025-23015 -apache-cassandra>=4<4.0. improper-authorization https://nvd.nist.gov/vuln/detail/CVE-2025-24860 +apache-cassandra>=4<4.0.16 improper-authorization https://nvd.nist.gov/vuln/detail/CVE-2025-24860 apache-roller<6.1.3 input-validation https://nvd.nist.gov/vuln/detail/CVE-2024-25090 apache-roller<6.1.4 cross-site-request-forgery https://nvd.nist.gov/vuln/detail/CVE-2024-46911 apache-roller<6.1.5 improper-session-handling https://nvd.nist.gov/vuln/detail/CVE-2025-24859 @@ -30239,7 +30239,7 @@ htslib<1.21.1 stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-31971 inetutils-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2026-32772 jenkins<2.541.3 symlink-attack https://nvd.nist.gov/vuln/detail/CVE-2026-33001 -jenkins<2.426.4 security-bypass https://nvd.nist.gov/vuln/detail/CVE-2026-33002 +jenkins>=2.426.3<2.541.3 security-bypass https://nvd.nist.gov/vuln/detail/CVE-2026-33002 libarchive-[0-9]* out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2026-4424 libarchive-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-4426 libexif-[0-9]* integer-underflow https://nvd.nist.gov/vuln/detail/CVE-2026-32775 @@ -30424,3 +30424,5 @@ nginx{,-devel}>=1.31.0<1.31.3 sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2026-60005 nginx{,-devel}>=0.9.6<1.30.4 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-42533 nginx{,-devel}>=1.31.0<1.31.3 heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-42533 +apache-cassandra>=4.1<4.1.8 improper-authorization https://nvd.nist.gov/vuln/detail/CVE-2025-24860 +apache-cassandra>=5<5.0.3 improper-authorization https://nvd.nist.gov/vuln/detail/CVE-2025-24860