add the openssl cve we already posted on github

Author: laffer1

.gitignore

@@ -1,2 +1,3 @@
 *.json
 .idea
+scripts/output/

latest-id.txt

@@ -1 +1 @@
-2025-4
+2025-6

vulns/midnightbsd/MNBSD-2022-0.yaml

@@ -0,0 +1,42 @@
+id: MNBSD-2022-0
+details: Fixes a security issue with NULL argv[0] entries, similar to the recent
+  CVE with polkit on Linux. The current POC for that does not work on
+  MidnightBSD since we don't use glibc, but proactively prevent similar issues.
+summary: Reject execve when new argc is zero
+affected:
+  - package:
+      name: kernel
+      ecosystem: MidnightBSD
+    ranges:
+      - type: ECOSYSTEM
+        events:
+          - introduced: 0.1.0
+          - fixed: 2.1.4
+    versions:
+      - 0.1.0
+      - 0.1.1
+      - 0.2.0
+      - 0.2.1
+      - 0.3.0
+      - 0.4.0
+      - 0.5.0
+      - 0.6.0
+      - 0.7.0
+      - 0.8.0
+      - 0.9.0
+      - 1.0.0
+      - 1.1.0
+      - 1.2.0
+      - 2.0.0
+      - 2.0.1
+      - 2.0.2
+      - 2.1.0
+      - 2.1.1
+      - 2.1.2
+      - 2.1.3
+references:
+  - type: WEB
+    url: https://github.com/MidnightBSD/src/commit/4348ca6320189db4db7e94d300f65d8c6f8a46ec
+aliases:
+modified: "2022-01-26T01:17:00.600Z"
+published: "2022-01-26T02:22:58.600Z"

vulns/midnightbsd/MNBSD-2022-1.yaml

@@ -0,0 +1,37 @@
+id: MNBSD-2022-1
+details: Fix multiple use after free and buffer overflows in libmport, a
+  part of mport package manager.
+summary:  multiple issues with memory handling in libmport
+affected:
+  - package:
+      name: mport
+      ecosystem: MidnightBSD
+    ranges:
+      - type: ECOSYSTEM
+        events:
+          - introduced: 0.4.0
+          - fixed: 2.1.5
+    versions:
+      - 0.4.0
+      - 0.5.0
+      - 0.6.0
+      - 0.7.0
+      - 0.8.0
+      - 0.9.0
+      - 1.0.0
+      - 1.1.0
+      - 1.2.0
+      - 2.0.0
+      - 2.0.1
+      - 2.0.2
+      - 2.1.0
+      - 2.1.1
+      - 2.1.2
+      - 2.1.3
+      - 2.1.4
+references:
+  - type: WEB
+    url: https://github.com/MidnightBSD/src/commit/3deeda3406d66bd4db3a9f464ae7f626910afccb
+aliases:
+modified: "2022-02-10T01:17:00.600Z"
+published: "2022-02-10T02:22:58.600Z"

vulns/midnightbsd/MNBSD-2025-6.yaml

@@ -0,0 +1,42 @@
+id: MNBSD-2025-6
+summary: Out-of-bounds read in OpenSSL
+details: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an
+  out-of-bounds read and write. This out-of-bounds read may trigger a crash which leads to Denial of
+  Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences
+  including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful
+  exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low.
+  Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was
+  assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0
+  are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.
+affected:
+  - package:
+      name: openssl
+      ecosystem: MidnightBSD
+    ranges:
+      - type: ECOSYSTEM
+        events:
+          - introduced: 3.0.0
+          - fixed: 3.2.4
+    versions:
+      - 3.0.0
+      - 3.0.1
+      - 3.0.2
+      - 3.1.0
+      - 3.1.1
+      - 3.1.2
+      - 3.1.3
+      - 3.1.4
+      - 3.1.5
+      - 3.2.0
+      - 3.2.1
+      - 3.2.2
+      - 3.2.3
+references:
+  - type: WEB
+    url: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9230
+  - type: WEB
+    url: https://github.com/MidnightBSD/src/commit/ad1cfffb414dd9f3e6787cd0e39c3d2b319addd5
+aliases:
+  - CVE-2025-9230
+modified: "2025-09-30T10:30:00.600Z"
+published: "2025-09-30T10:30:00.600Z"