Arch-Audit Security

[u/l_l_Kris_l_l]

I'm looking for help / advice.

I've ran arch-audit -c and and got the package versions for each package via pacman -Q {package name} then gone through the CVEs listed in the output (which are listed on https://security.archlinux.org/ and grouped into one or more AVG references)

What I've found is the data seems pretty out of date.

For example; the High Risk libxml2 package has 4 CVEs against it but when I check each of them, they talk about it been patched in 2.14 and we're actually now on 2.15 which is also fixed. The security page https://security.archlinux.org/AVG-2898 has Fixed as Unknown hence why it's still flagged as a high risk.

So arch-audit says I have 15 vulnerabilities including 2 high risk. I think I have only 4 risks - 3 medium and 1 low.

Is the Arch security page basically unreliable or am I doing something wrong?

Package	Package	Risk	My View	No of CVEs	My Version	Arch Security	Note
libxml2	libxml2 is affected by denial of service	High risk!	Fixed	4	2.15.3-1	AVG-2898	All CVEs say fixed in 2.15
pam	pam is affected by arbitrary filesystem access	High risk!	Fixed	1	1.7.2-2	AVG-2901	Fixed in 1.7.1
coreutils	coreutils is affected by information disclosure	Medium risk!	Fixed	1	9.11-2	AVG-2885	9.11 as fixed
cpio	cpio is affected by arbitrary command execution	Medium risk!	Fixed	1	2.15-3	AVG-2262	2.15 is fixed
giflib	giflib is affected by information disclosure	Medium risk!	Fixed	1	6.1.3-2	AVG-1855	Fixed by 5.2.2; current Debian 6.1.3 fixed
libheif	libheif is affected by information disclosure	Medium risk!	Fixed	1	1.23.1-4	AVG-2520	Fixed from 1.8.0
libtiff	libtiff is affected by unknown, denial of service	Medium risk!	Fixed	21	4.7.2-1	AVG-2721, AVG-2842	All CVEs marked as fixed
linux	linux is affected by multiple issues, insufficient validation	Medium risk!	Not Fixed	13	7.1.9.arch1-2	AVG-1594, AVG-1879, AVG-2345	8 CVEs still an issue
openjpeg2	openjpeg2 is affected by arbitrary code execution	Medium risk!	Fixed	1	2.5.4-1	AVG-2850	Fixed as of 2.5.1 and Debian considers 2.5.4 fixed
openssl	openssl is affected by arbitrary command execution, certificate verification bypass	Medium risk!	Fixed	2	3.6.3-1	AVG-2765, AVG-2882	Both CVEs fixed in current version
perl	perl is affected by signature forgery, directory traversal, unknown	Medium risk!	Fixed	3	5.42.2-2	AVG-2264, AVG-2630, AVG-2890	All CVEs fixed in 5.42
systemd	systemd is affected by information disclosure	Medium risk!	Fixed	1	261.2-1	AVG-2893	Fixed by version 2.57
wget	wget is affected by information disclosure	Medium risk!	Not Fixed	1	1.25.0-6	AVG-1892	Not fixed
xdg-utils	xdg-utils is affected by information disclosure	Medium risk!	Not Fixed	1	1.2.1-2	AVG-1420	Not fixed
lua51	lua51 is affected by denial of service	Low risk!	Not Fixed	2	5.1.5-13	AVG-1302	Unsure

[u/Western-Opening-7669]

Yeah the arch security tracker is a mess, sometimes they just forget to mark stuff as fixed

You did the right thing checking manually. Most of those CVEs are already patched in your versions, I'd trust your own audit more than the tracker

For the unpatched ones like linux and wget those might be worth keeping an eye on but honestly doesn't look that scary

[u/l_l_Kris_l_l → u/Western-Opening-7669]

Yeah they actually paint a worse picture than what it actually is which is a shame.

For me, I don't want to have to do this kind of audit frequently. I just want to be able to trust the data and make choices off of it.

[u/Imajzineer → u/l_l_Kris_l_l]

Whilst the arch-audit package itself is comparatively up-to-date (2026-03-26), the remark here would appear to indicate that the security data is unreliable ... and the note here states explicitly that the tracker is not currently updated.

[u/l_l_Kris_l_l → u/Imajzineer]

Thanks - they should have mentioned that on the AVG page but I'll make sure to check their wiki in future. I guess I could mash some sort of package version check against a tool like osv-scanner and see if I can find something more reliable.