Mport
Monthly
Package-index corruption and denial of package-management operations affect MidnightBSD mport before 2.7.8 when a malicious or faulty package mirror supplies truncated, corrupt, or otherwise failing zstd-compressed index data. A remote unauthenticated attacker must control or machine-in-the-middle a mirror used by mport, making the practical risk moderate despite a CVSS 4.0 score of 8.3; the impact is limited to index integrity and availability, with no confidentiality exposure or whole-system compromise. The issue is fixed in mport 2.7.8; no public exploit identified at time of analysis.
Path traversal in the MidnightBSD mport package manager (libmport/fetch.c) before version 2.7.8 lets an attacker who controls package index data smuggle an unsafe value into indexEntry->bundlefile so that downloaded package data is written outside the intended cache directory or to an attacker-chosen filename. Unauthenticated remote attackers can exploit this only if they can influence the index that mport consumes, for example through a malicious or compromised package mirror or a man-in-the-middle position on the download channel, and only when the victim subsequently runs mport to download or install a package; the independent assessment rates this as a conditionally-gated integrity flaw (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L) rather than drive-by remote code execution, with no confidentiality impact and only limited availability impact. There is no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); vendor-assigned CVSS 4.0 base is 8.3, reflecting the same high integrity impact.
MidnightBSD's mport package manager prior to 2.7.8 can accept a tampered bootstrap package index as verified, because the hash-check failure path in mport_fetch_bootstrap_index() (libmport/fetch.c) fails to preserve a fatal result when the fetched index has a missing or invalid hash. An unauthenticated attacker who controls the package mirror or occupies an on-path/man-in-the-middle network position (the CVSS v4.0 AT:P prerequisite) can therefore have mport proceed with an unverified index, corrupting the integrity of packages the system later trusts and installs - the vendor vector scores 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L), emphasizing high integrity impact with no confidentiality impact. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), but the privileged network/mirror position required limits practical mass exploitation to targeted or upstream-mirror compromise scenarios. The issue is fixed in mport 2.7.8.
Spoofed or injected ICMP echo replies can steer mport's mirror-latency selection toward an attacker-chosen mirror and, if the reply carries IP options, shift the parsed ICMP header past the hardcoded offset used by ping() in libmport/ping.c, causing an out-of-bounds read. The flaw affects MidnightBSD mport releases prior to 2.7.8 and is only reachable by an unauthenticated attacker on the same adjacent network segment who can place visible ICMP traffic on-path while an mport client is actively probing mirrors (assessed CVSS:3.1 AV:A/AC:H/PR:N/UI:N/C:N/I:L/A:L; CVSS 4.0 base 2.3). Impact is low and confined to the transient probing window; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released version 2.7.8 as the fix.
Filesystem integrity compromise in MidnightBSD's mport package manager (versions prior to 2.7.8): a local user who already holds write access to a directory targeted by a package installation can race a symlink substitution between file extraction and the privileged ownership/mode changes that follow, redirecting a root-run chown/chmod onto an attacker-chosen path. Exploitation is heavily gated - it requires an authenticated local attacker with pre-existing directory write permission, a privileged install actually in progress, and a successful win of a narrow TOCTOU window (consistent with the assessed AV:L/AC:H/PR:L vector, High integrity and Low availability impact) - so this is a genuine but low-priority integrity issue rather than a broadly exploitable flaw. No public exploit code was identified at time of analysis and there is no evidence of active exploitation; mport 2.7.8 closes the race by switching to descriptors opened with O_NOFOLLOW and fchown/fchmod.
Symlink following and dot-dot path traversal in MidnightBSD mport prior to 2.7.8 lets a local attacker who can already write to part of the target installation tree redirect directory creation and ownership/permission changes to attacker-selected paths during a privileged package installation. The flaw sits in the ASSET_DIR and ASSET_DIR_OWNER_MODE handling in libmport/bundle_read_install_pkg.c, which performed path-based mport_mkdirp(), chown and chmod operations (CWE-59); impact is integrity-only, since an attacker can create directories or alter ownership and mode on paths outside the intended package directories with no confidentiality exposure. Exploitation is sharply gated: it requires an existing local foothold (PR:L per the CVSS vector), a privileged install of a bundle containing directory assets, and winning the TOCTOU race to place the symlink or '..' path first; no public exploit has been identified at time of analysis and there is no CISA KEV listing. The CVSS 4.0 base score of 5.8 and vector AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L align with the independently assessed CVSS:3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L, confirming a genuine but narrowly gated local integrity issue rather than a mass-exploitation priority.
Path-racing and shell-invocation weaknesses in the MidnightBSD mport package manager (all versions prior to 2.7.8) let a local, low-privileged attacker who can write to a participating package cache or staging path redirect privileged fetch, cache-clean, and install-related side effects outside the intended cache, and potentially influence command-line interpretation during privileged helper execution. The flaw spans libmport/fetch.c, clean.c, util.c, bundle_read_install_pkg.c, delete_primative.c, and libexec/mport.create/mport.create.c, and only becomes exploitable when a privileged mport operation runs concurrently so the attacker can win a timing-sensitive race; there is no remote reach and no public exploit identified at time of analysis. Because it requires local access, write permission on a shared cache/staging directory, and a hard-to-win race against a privileged process (AC:H, AT:P), the realistic risk is low-to-moderate despite the command-injection framing, and upgrading to 2.7.8 resolves it.
Checksum verification in MidnightBSD's mport package manager before 2.7.8 can silently continue after a hashing failure, causing an expected checksum to be compared against stale hash-buffer contents instead of a freshly computed digest, so a local low-privileged attacker who can influence an installed file or induce the hashing failure can obtain a misleading integrity result or suppress a checksum mismatch. Exploitation requires local access with low privileges (CVSS PR:L) and conditions that make MD5File() or SHA256_File() fail (AT:P); the impact is limited to integrity of the verification outcome (I:L) with no confidentiality or availability effect, and the flaw is inert whenever hashing completes normally. No public exploit code was identified at time of analysis and there is no CISA KEV entry, so this is a low-priority hardening issue rather than an active threat.
On-path tampering with package-fetch traffic in MidnightBSD's mport package manager lets a network-positioned attacker substitute or alter package indexes and bundles that the client then trusts as legitimate. The flaw affects mport releases prior to 2.7.8, whose index and bundle fetch paths in libmport/fetch.c accepted cleartext http:// mirror URLs instead of enforcing HTTPS, giving the issue a CVSS 4.0 base score of 6.0. No public exploit code has been identified at time of analysis, and MidnightBSD mport 2.7.8 addresses the issue.
Path traversal in MidnightBSD mport before 2.7.8 allows a crafted package manifest to make the privileged sample-file handler write or copy files outside the configured installation root, corrupting arbitrary local files. Exploitation requires a system administrator to install the malicious or malformed package with sufficient privileges (typically root) and to interact with the install, so it is a local, user-interaction-gated integrity flaw rather than a remote unauthenticated attack; no public exploit has been identified at time of analysis.
Package file overwrite in MidnightBSD mport prior to 2.7.8 allows a crafted package installed with privileges to replace existing files on disk that are owned by another package or unmanaged by mport, compromising local filesystem integrity and package database consistency. The flaw requires user interaction (UI:P) and specific attack requirements (AT:P), and is unauthenticated according to the CVSS vector (PR:N). No public exploit was identified at time of analysis; the vendor fixed the issue in version 2.7.8.
MidnightBSD's mport package manager, in all versions prior to 2.7.8, mis-parses the argument list for its 'audit' subcommand, so when an option such as -r is placed before the package name the tool audits the option token instead of the requested package and returns a false-negative result. The flaw is reachable only by a local user with low privileges who already has the ability to run mport, requires the specific option-before-argument invocation ordering, and is not remotely triggerable - there is no adversary-controlled input path. The practical consequence is that an operator or automation script may believe a vulnerable package is clean, leaving it unpatched; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Vendor-released patch: 2.7.8.
Package-index corruption and denial of package-management operations affect MidnightBSD mport before 2.7.8 when a malicious or faulty package mirror supplies truncated, corrupt, or otherwise failing zstd-compressed index data. A remote unauthenticated attacker must control or machine-in-the-middle a mirror used by mport, making the practical risk moderate despite a CVSS 4.0 score of 8.3; the impact is limited to index integrity and availability, with no confidentiality exposure or whole-system compromise. The issue is fixed in mport 2.7.8; no public exploit identified at time of analysis.
Path traversal in the MidnightBSD mport package manager (libmport/fetch.c) before version 2.7.8 lets an attacker who controls package index data smuggle an unsafe value into indexEntry->bundlefile so that downloaded package data is written outside the intended cache directory or to an attacker-chosen filename. Unauthenticated remote attackers can exploit this only if they can influence the index that mport consumes, for example through a malicious or compromised package mirror or a man-in-the-middle position on the download channel, and only when the victim subsequently runs mport to download or install a package; the independent assessment rates this as a conditionally-gated integrity flaw (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L) rather than drive-by remote code execution, with no confidentiality impact and only limited availability impact. There is no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); vendor-assigned CVSS 4.0 base is 8.3, reflecting the same high integrity impact.
MidnightBSD's mport package manager prior to 2.7.8 can accept a tampered bootstrap package index as verified, because the hash-check failure path in mport_fetch_bootstrap_index() (libmport/fetch.c) fails to preserve a fatal result when the fetched index has a missing or invalid hash. An unauthenticated attacker who controls the package mirror or occupies an on-path/man-in-the-middle network position (the CVSS v4.0 AT:P prerequisite) can therefore have mport proceed with an unverified index, corrupting the integrity of packages the system later trusts and installs - the vendor vector scores 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L), emphasizing high integrity impact with no confidentiality impact. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), but the privileged network/mirror position required limits practical mass exploitation to targeted or upstream-mirror compromise scenarios. The issue is fixed in mport 2.7.8.
Spoofed or injected ICMP echo replies can steer mport's mirror-latency selection toward an attacker-chosen mirror and, if the reply carries IP options, shift the parsed ICMP header past the hardcoded offset used by ping() in libmport/ping.c, causing an out-of-bounds read. The flaw affects MidnightBSD mport releases prior to 2.7.8 and is only reachable by an unauthenticated attacker on the same adjacent network segment who can place visible ICMP traffic on-path while an mport client is actively probing mirrors (assessed CVSS:3.1 AV:A/AC:H/PR:N/UI:N/C:N/I:L/A:L; CVSS 4.0 base 2.3). Impact is low and confined to the transient probing window; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released version 2.7.8 as the fix.
Filesystem integrity compromise in MidnightBSD's mport package manager (versions prior to 2.7.8): a local user who already holds write access to a directory targeted by a package installation can race a symlink substitution between file extraction and the privileged ownership/mode changes that follow, redirecting a root-run chown/chmod onto an attacker-chosen path. Exploitation is heavily gated - it requires an authenticated local attacker with pre-existing directory write permission, a privileged install actually in progress, and a successful win of a narrow TOCTOU window (consistent with the assessed AV:L/AC:H/PR:L vector, High integrity and Low availability impact) - so this is a genuine but low-priority integrity issue rather than a broadly exploitable flaw. No public exploit code was identified at time of analysis and there is no evidence of active exploitation; mport 2.7.8 closes the race by switching to descriptors opened with O_NOFOLLOW and fchown/fchmod.
Symlink following and dot-dot path traversal in MidnightBSD mport prior to 2.7.8 lets a local attacker who can already write to part of the target installation tree redirect directory creation and ownership/permission changes to attacker-selected paths during a privileged package installation. The flaw sits in the ASSET_DIR and ASSET_DIR_OWNER_MODE handling in libmport/bundle_read_install_pkg.c, which performed path-based mport_mkdirp(), chown and chmod operations (CWE-59); impact is integrity-only, since an attacker can create directories or alter ownership and mode on paths outside the intended package directories with no confidentiality exposure. Exploitation is sharply gated: it requires an existing local foothold (PR:L per the CVSS vector), a privileged install of a bundle containing directory assets, and winning the TOCTOU race to place the symlink or '..' path first; no public exploit has been identified at time of analysis and there is no CISA KEV listing. The CVSS 4.0 base score of 5.8 and vector AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L align with the independently assessed CVSS:3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L, confirming a genuine but narrowly gated local integrity issue rather than a mass-exploitation priority.
Path-racing and shell-invocation weaknesses in the MidnightBSD mport package manager (all versions prior to 2.7.8) let a local, low-privileged attacker who can write to a participating package cache or staging path redirect privileged fetch, cache-clean, and install-related side effects outside the intended cache, and potentially influence command-line interpretation during privileged helper execution. The flaw spans libmport/fetch.c, clean.c, util.c, bundle_read_install_pkg.c, delete_primative.c, and libexec/mport.create/mport.create.c, and only becomes exploitable when a privileged mport operation runs concurrently so the attacker can win a timing-sensitive race; there is no remote reach and no public exploit identified at time of analysis. Because it requires local access, write permission on a shared cache/staging directory, and a hard-to-win race against a privileged process (AC:H, AT:P), the realistic risk is low-to-moderate despite the command-injection framing, and upgrading to 2.7.8 resolves it.
Checksum verification in MidnightBSD's mport package manager before 2.7.8 can silently continue after a hashing failure, causing an expected checksum to be compared against stale hash-buffer contents instead of a freshly computed digest, so a local low-privileged attacker who can influence an installed file or induce the hashing failure can obtain a misleading integrity result or suppress a checksum mismatch. Exploitation requires local access with low privileges (CVSS PR:L) and conditions that make MD5File() or SHA256_File() fail (AT:P); the impact is limited to integrity of the verification outcome (I:L) with no confidentiality or availability effect, and the flaw is inert whenever hashing completes normally. No public exploit code was identified at time of analysis and there is no CISA KEV entry, so this is a low-priority hardening issue rather than an active threat.
On-path tampering with package-fetch traffic in MidnightBSD's mport package manager lets a network-positioned attacker substitute or alter package indexes and bundles that the client then trusts as legitimate. The flaw affects mport releases prior to 2.7.8, whose index and bundle fetch paths in libmport/fetch.c accepted cleartext http:// mirror URLs instead of enforcing HTTPS, giving the issue a CVSS 4.0 base score of 6.0. No public exploit code has been identified at time of analysis, and MidnightBSD mport 2.7.8 addresses the issue.
Path traversal in MidnightBSD mport before 2.7.8 allows a crafted package manifest to make the privileged sample-file handler write or copy files outside the configured installation root, corrupting arbitrary local files. Exploitation requires a system administrator to install the malicious or malformed package with sufficient privileges (typically root) and to interact with the install, so it is a local, user-interaction-gated integrity flaw rather than a remote unauthenticated attack; no public exploit has been identified at time of analysis.
Package file overwrite in MidnightBSD mport prior to 2.7.8 allows a crafted package installed with privileges to replace existing files on disk that are owned by another package or unmanaged by mport, compromising local filesystem integrity and package database consistency. The flaw requires user interaction (UI:P) and specific attack requirements (AT:P), and is unauthenticated according to the CVSS vector (PR:N). No public exploit was identified at time of analysis; the vendor fixed the issue in version 2.7.8.
MidnightBSD's mport package manager, in all versions prior to 2.7.8, mis-parses the argument list for its 'audit' subcommand, so when an option such as -r is placed before the package name the tool audits the option token instead of the requested package and returns a false-negative result. The flaw is reachable only by a local user with low privileges who already has the ability to run mport, requires the specific option-before-argument invocation ordering, and is not remotely triggerable - there is no adversary-controlled input path. The practical consequence is that an operator or automation script may believe a vulnerable package is clean, leaving it unpatched; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Vendor-released patch: 2.7.8.