BSD PortsLibreSSL -- overwrite and -read vulnerability
The LibreSSL project reports: An incorrect length check can result in a 4-byte overwrite and an 8-byte overread.
Affected versions
- libressl < 4.1.1
- libressl-devel < 4.1.1
By system
0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | security/libressl | 4.4.0 | fixed | (369 days after) |
| NetBSD | security/libressl | 4.1.0 | not listed | |
| MidnightBSD | security/libressl | 4.3.3 | out of range, by version | |
| FreeBSD | security/libressl-devel | 4.4.0 | fixed | (369 days after) |