BSD Portsliboqs -- Multiple vulnerabilities
The OpenQuantumSafe project reports: uninitialized encaps_derand pointer dereference out-of-bounds read in XMSS/XMSS^MT signature verification Integer underflow in CROSS crypto_sign_open() incorrect array size when calling secure_clean Implemented optimization barrier OQS_MEM_BLACK_BOX and applied to ct_select in FrodoKEM
Affected versions
- liboqs < 0.16.0
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/liboqs | 0.12.0 | vulnerable since 2026-07-16 | |
| NetBSD | security/liboqs | 0.15.0 | not listed | |
| FreeBSD | security/liboqs | 0.16.0 | fixed | (1 days after) |