Laffer1

**Name of the Vulnerable Software and Affected Versions** mport versions prior to 2.7.8 **Description** The audit command in `mport/mport.c` incorrectly handles argument parsing. It computes option-adjusted `local argv` and `local argc` values but passes the original argument entry to the `audit package()` function. If an option like `-r` is used before a package name, the stale `optind` state and unadjusted argument may lead the system to audit the option token instead of the intended package. This results in false-negatives, potentially leaving vulnerable packages unidentified. **Recommendations** Update to version 2.7.8.

**Name of the Vulnerable Software and Affected Versions** mport versions prior to 2.7.8 **Description** The `mport verify package()` function in `libmport/verify.c` may continue execution after `MD5File()` or `SHA256 File()` fails. This allows the system to compare an expected checksum against stale data remaining in the hash buffer instead of a newly computed digest. An attacker who can influence an installed file or the conditions causing the hashing process to fail could hide a checksum failure or obtain a misleading integrity result. **Recommendations** Update to version 2.7.8.

**Name of the Vulnerable Software and Affected Versions** mport versions prior to 2.7.8 **Description** The `ping()` function in `libmport/ping.c` fails to validate `icmp id` or `icmp seq` when accepting ICMP replies and uses a fixed IP-header offset instead of `ip hl` for parsing. A network attacker capable of injecting or spoofing ICMP replies can influence the selection of mirror latency. Additionally, a malformed packet containing IP options can shift the ICMP header, leading to an out-of-bounds read, which occurs when a program reads data outside the intended boundary of a buffer. **Recommendations** Update to version 2.7.8.

**Name of the Vulnerable Software and Affected Versions** mport versions prior to 2.7.8 **Description** The MidnightBSD Package Manager fails to treat all truncated, corrupt, or failed zstd streams as fatal within the `mport decompress zstd()` function. Additionally, the `libmport/fetch.c` component does not consistently propagate these failures to index-fetch callers. A malicious or faulty mirror could provide compressed package index data that causes `ZSTD decompressStream()` or an output write to fail, leaving partial index output available. This can lead to package-index integrity loss or a denial of service. **Recommendations** Update to version 2.7.8.

**Name of the Vulnerable Software and Affected Versions** mport versions prior to 2.7.8 **Description** The MidnightBSD Package Manager fails to perform a preflight check for non-directory assets that already exist on the disk during package installation. The logic within `libmport/check preconditions.c`, `libmport/install primative.c`, and `libmport/mport private.h` does not apply `MPORT PRECHECK FILE CONFLICTS`. Consequently, a crafted or conflicting package can overwrite files owned by other packages or files not managed by the system. This occurs during privileged installations unless the `mport->force` variable is explicitly enabled, potentially compromising local filesystem integrity and package database consistency. **Recommendations** Update to version 2.7.8.