On 5/16/25 13:07, Eli Schwartz wrote: On 5/16/25 12:31 PM, Taylor R Campbell wrote: [...] (a) the same pkgsrc packages are available on, e.g., NetBSD 9.x (which is not EOL); and
(b) pkgsrc is used on platforms other than NetBSD, including macOS, SmartOS, and various Linux distributions (e.g., for unprivileged use on HPC clusters where it is more flexible and up-to-date than the Linux distribution's package manager).
That is why it would be more accurate for the report to say pkgsrc-2025Q1', not NetBSD 10.1'. I strongly dispute this. It should instead list both, as both are affected.
(Again, b is the same distinction as "Gentoo, but also portage-20250508, are both affected".)
-- Jacob
In NetBSD through 9.2, the IPv6 fragment ID generation algorithm employs a weak cryptographic PRNG.
In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures.
In NetBSD through 9.2, there is an information leak in the TCP ISN (ISS) generation algorithm.
In NetBSD through 9.2, the IPv6 Flow Label generation algorithm employs a weak cryptographic PRNG.
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different vulnerability than CVE-2011-2393.
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
End of life: 5/4/2024, End of support: 2/14/2022, Latest version: 8.3
End of life: 5/4/2024, End of support: 2/14/2022, Latest version: 8.3
NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate memory leading to arbitrary code execution. This affects NetBSD 7.1 and possibly earlier versions.
A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions.
The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects NetBSD 7.1 and possibly earlier versions.
End of life: 6/30/2020, End of support: 7/17/2018, Latest version: 7.2
End of life: 6/30/2020, End of support: 7/17/2018, Latest version: 7.2
The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly implement the session timer, which allows remote attackers to cause a denial of service (resource consumption) via crafted packets.
The fetchurl function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.
The HZ module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted argument to the iconvopen function. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2014-5384 is used for the NULL pointer dereference.
The VIQR module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (out-of-bounds array access) via a crafted argument to the iconvopen function. NOTE: this issue was SPLIT from CVE-2014-3951 per ADT2 due to different vulnerability types.
bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path.
End of life: 8/23/2018, End of support: 9/25/2015, Latest version: 6.1.5
End of life: 8/23/2018, End of support: 9/25/2015, Latest version: 6.1.5
Integer overflow in the calloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which triggers a memory allocation of one byte.
On Intel CPUs sysret to non-canonical address causes a fault on the sysret instruction itself after the stack pointer is set to guest value but before the CPL is changed. Systems running on AMD CPUs are not vulnerable to this issue as sysret on AMD CPUs does not generate a fault before the CPL change.
On Xen, a privileged user on a 64 bit PV guest kernel running on a 64 bit hypervisor could use this flaw to escalate privileges to that of the host. Depending on the particular guest kernel it is also possible that non-privileged guest users could also elevate their privileges to that of the host.
For Red Hat Enterprise Linux guests, only privileged guest users can exploit this issue. HVM guests and 32-bit PV guests cannot be used to exploit this issue.
Acknowledgements:
Red Hat would like to thank the Xen project for reporting this issue. Upstream acknowledges Rafal Wojtczuk as the original reporter.
The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD, NetBSD, and possibly other BSD-based operating systems allows remote attackers to cause a denial of service (CPU consumption and device hang) by sending many Router Advertisement (RA) messages with different source addresses, a similar vulnerability to CVE-2010-4670.
BSD compress implemented an LZW compressor and decompressor. This decompressor implementation did not correctly handle compressed streams that contain code words that were not yet added to the decompression table. LZW decompression has a special case (a KwKwK string) when code word may match the first free entry in the decompression table. The implementation used in BSD compress allow code words not only matching, but also exceeding the first free entry.
It seems this compress implementation first appeared in BSD around 1985, and was later used in various other code base, such as ncompress and gzip. Other components that contain affected code will be listed below. Following page list the version of the code as was used in 4.3BSD:
http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/usr.bin/compress/compress.c
Relevant code appears in the decompress() routine:
/ Special case for KwKwK string. / if ( code >= freeent ) { stackp++ = finchar; code = oldcode; }
This allows creating a loop in the decompression table, which leads to an "infinite" loop:
/ Generate output characters in reverse order / #ifdef SIGNEDCOMPARESLOW while ( ((unsigned long)code) >= ((unsigned long)256) ) { #else while ( code >= 256 ) { #endif stackp++ = tabsuffixof(code); code = tabprefixof(code); }
where tabprefixof is:
unsigned short codetab [HSIZE]; #define codetabof(i) codetab[i] #define tabprefixof(i) codetabof(i)
This overflows destack "buffer" (part of the htab[]):
countint htab [HSIZE]; # define tabsuffixof(i) ((chartype )(htab))[i] # define destack ((chartype )&tabsuffixof(1<<BITS))
Depending on the relative htab[] and codetab[] positions, destack overflow may overwrite codetab[] entries, which may break infinite loop and let program continue its execution with possibly corrupted memory.
Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error in the IEEE80211IOCCHANINFO ioctl allows a local unprivileged user to cause the kernel to copy large amounts of kernel memory back to the user, disclosing potentially sensitive information.
A Debian bug report [1] noted that pmake (and mk-files in Fedora) contained the files /usr/share/mk/bsd.{lib,prog}.mk that created temporary files insecurely with predictable file names in /tmp (/tmp/depend[PID]), ignoring any $TMPDIR values.
In lib.mk:
446 afterdepend: .depend 447 @(TMP=/tmp/depend$$$$; \ 448 sed -e 's/^\([^\.]\).o[ ]:/\1.o \1.po \1.so \1.ln:/' \ 449 < .depend > $$TMP; \ 450 mv $$TMP .depend) 451 .endif
The same is found in prog.mk (in Fedora's mk-files package).
The Debian bug report proposes to use mktemp here:
- @(TMP=/tmp/depend$$$$; \ + @(TMP=mktemp -t dependXXXXXXXXXX || exit $$?; \
Upstream has already corrected this by removing the offending code [2],[3].
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626673 [2] http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.lib.mk.diff?r1=1.239&r2=1.240 [3] http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.prog.mk.diff?r1=1.192&r2=1.193
Multiple libc/glob(3) flaws were reported [1] that affect various BSD libc implementations. In particular, globs containing braces could lead to resource exhaustion.
One such vulnerable application is Pure-FTPd. This has been corrected in upstream version 1.0.32, where support for braces expansion in directory listings was disabled.
[1] http://securityreason.com/achievementsecurityalert/97 [2] http://www.pureftpd.org/project/pure-ftpd/news
Apache Portable Runtime (APR) is vulnerable to a denial of service, caused by an error in the aprfnmatch() function when processing specific patterns with the "" wildcard. A remote attacker could exploit this vulnerability to consume all available CPU and memory resources resulting in a denial of service.
Multiple stack consumption vulnerabilities in the kernel in NetBSD 4.0, 5.0 before 5.0.3, and 5.1 before 5.1.1, when IPsec is enabled, allow remote attackers to cause a denial of service (memory corruption and panic) or possibly have unspecified other impact via a crafted (1) IPv4 or (2) IPv6 packet with nested IPComp headers.