CVE-2026-54582 mport package installation can overwrite existing unmanaged or differently owned files

mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/checkpreconditions.c, libmport/installprimative.c, and libmport/mportprivate.h did not apply...

CVE-2026-54577

mport , the MidnightBSD Package Manager, contained a bug in its audit command prior to version 2.7.8. The function in mport/mport.c computed option-adjusted local arguments but passed the original argument entry to audit_package(). When an operator or automation used an option such as -r before a...

CVE-2026-54583

mport , the MidnightBSD Package Manager, had an insufficient input-validation flaw in libmport/fetch.c prior to version 2.7.8. The missing is_valid_bundle_filename() checks failed to reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths...

CVE-2026-54581

CVE-2026-54581 affects mport , the MidnightBSD Package Manager. The mport_fetch_bootstrap_index() function in libmport/fetch.c (prior to version 2.7.8) could return success when bootstrap index hash verification encountered a missing or invalid hash, because the failure path did not preserve a fa...

CVE-2026-54581 mport bootstrap index fetch can continue after hash verification failure

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...

EUVD-2026-82318

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...

CVE-2020-24385

In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation layer that allows attackers to crash the running kernel. During binary interaction, td-tdemuldata in sys/compat/linux/linuxemul.h is not getting initialized an...

EUVD-2020-17117

Malware in sbrugna...

EUVD-2020-17571

Malware in sbrugna...

CVE-2020-24863

A memory corruption vulnerability was found in the kernel function kerngetfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode...

CVE-2020-24385

In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation layer that allows attackers to crash the running kernel. During binary interaction, td-tdemuldata in sys/compat/linux/linuxemul.h is not getting initialized an...

CVE-2020-24863

A memory corruption vulnerability was found in the kernel function kerngetfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode...

CVE-2020-24863

A memory corruption vulnerability was found in the kernel function kerngetfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode...

CVE-2020-24385

In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation layer that allows attackers to crash the running kernel. During binary interaction, td-tdemuldata in sys/compat/linux/linuxemul.h is not getting initialized an...

Null pointer dereference

In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation layer that allows attackers to crash the running kernel. During binary interaction, td-tdemuldata in sys/compat/linux/linuxemul.h is not getting initialized an...

Memory corruption

A memory corruption vulnerability was found in the kernel function kerngetfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode...

CVE-2020-24385

The CVE-2020-24385 issue affects MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7. It is a NULL pointer dereference in the Linux emulation layer. During binary interaction, td->td_emuldata in sys/compat/linux/linux_emul.h is not initialized and can return NULL from em_...

CVE-2020-24385

In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation layer that allows attackers to crash the running kernel. During binary interaction, td-tdemuldata in sys/compat/linux/linuxemul.h is not getting initialized an...

CVE-2020-24863

The CVE-2020-24863 vulnerability is a kernel memory corruption in kern_getfsstat affecting MidnightBSD prior to 1.2.7 and 1.3 up to 2020-08-19, and FreeBSD up to 11.4. A crafted size value combined with an invalid mode can trigger an invalid free, leading to a system crash. The connected document...

CVE-2020-24863

A memory corruption vulnerability was found in the kernel function kerngetfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode...