BSD Ports

ISC KEA -- Multiple vulnerabilities

· CVE-2025-32801, CVE-2025-32802, CVE-2025-32803 · VuXML entry

Internet Systems Consortium, Inc. reports: Loading a malicious hook library can lead to local privilege escalation https://kb.isc.org/docs/cve-2025-32801 Insecure handling of file paths allows multiple local attacks https://kb.isc.org/docs/cve-2025-32802 Insecure file permissions can result in confidential information leakage https://kb.isc.org/docs/cve-2025-32803

Affected versions

By system

0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.

SystemPortVersionStateFixed
DragonFlynet/kea2.6.3 fixed
OpenBSDnet/kea3.2.1 out of range, by version
NetBSDnet/kea3.1.9nb2 not listed
MidnightBSDnet/kea3.0.2_1 out of range, by version
FreeBSDnet/kea3.2.1_1 fixed (491 days after)