Highlaffer1

**Name of the Vulnerable Software and Affected Versions** mport versions prior to 2.7.8 **Description** The `mport fetch bootstrap index()` function in libmport/fetch.c fails to preserve a fatal result when bootstrap index hash verification encounters a missing or invalid hash, incorrectly returning success. This allows a network attacker or a compromised mirror to alter the bootstrap index content or its transport path, leading the system to use an unverified or tampered bootstrap package index. **Recommendations** Update to version 2.7.8.

**Name of the Vulnerable Software and Affected Versions** mport versions prior to 2.7.8 **Description** The MidnightBSD Package Manager contains a flaw where the `do actual install()` function in `libmport/bundle read install pkg.c` utilizes path-based `lstat()`, `chown()`, `stat()`, and `chmod()` operations during package installation. A local attacker with write access to a target directory can exploit this by replacing a checked file with a symbolic link before privileged ownership or mode changes are applied. This allows the attacker to redirect these changes to an arbitrary path, potentially compromising filesystem integrity or permissions. **Recommendations** Update to version 2.7.8.

**Name of the Vulnerable Software and Affected Versions** mport versions prior to 2.7.8 **Description** The MidnightBSD Package Manager fails to enforce HTTPS for repository and package mirror URLs within the `mport fetch index()`, `mport fetch bootstrap index()`, and `mport fetch bundle()` functions located in libmport/fetch.c. This lack of `url is https()` verification allows a network-positioned attacker to intercept and modify cleartext traffic during package index retrieval or package downloads, potentially compromising the integrity of the downloaded packages or the package selection process. **Recommendations** Update to version 2.7.8.