Vendor
MidnightBSD
13 known vulnerabilities.
Products
3 results · Clear filters · Feed
-
Low 2.3
mport mirror-selection ping accepts insufficiently validated ICMP replies
mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. A network attacker able to inject or spoof v…
-
Low 2.0
mport verify can compare stale checksum data after hashing failures
mport is the MidnightBSD Package Manager. Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed and compare an expected checksum with stale data in the hash buffer rather than a newly computed diges…
-
Low 2.0
mport audit can inspect the wrong package when options are present
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but passed the original argument entry to audit_package(). When an operator or automation used an option suc…