Vendor
MidnightBSD
13 known vulnerabilities.
Products
3 results · Clear filters · Feed
-
High 8.3
mport index decompression can leave partial or corrupt index data after zstd failures
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mport_decompress_zstd(), and libmport/fetch.c did not consistently propagate those failures to index-fetch callers.…
-
High 8.3
mport package bundle downloads allow unsafe destination filenames
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an uns…
-
High 8.3
mport bootstrap index fetch can continue after hash verification failure
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserv…