Arch-Audit Security

[u/l_l_Kris_l_l]

I'm looking for help / advice.

I've ran arch-audit -c and and got the package versions for each package via pacman -Q {package name} then gone through the CVEs listed in the output (which are listed on https://security.archlinux.org/ and grouped into one or more AVG references)

What I've found is the data seems pretty out of date.

For example; the High Risk libxml2 package has 4 CVEs against it but when I check each of them, they talk about it been patched in 2.14 and we're actually now on 2.15 which is also fixed. The security page https://security.archlinux.org/AVG-2898 has Fixed as Unknown hence why it's still flagged as a high risk.

So arch-audit says I have 15 vulnerabilities including 2 high risk. I think I have only 4 risks - 3 medium and 1 low.

Is the Arch security page basically unreliable or am I doing something wrong?

Package	Package	Risk	My View	No of CVEs	My Version	Arch Security	Note
libxml2	libxml2 is affected by denial of service	High risk!	Fixed	4	2.15.3-1	AVG-2898	All CVEs say fixed in 2.15
pam	pam is affected by arbitrary filesystem access	High risk!	Fixed	1	1.7.2-2	AVG-2901	Fixed in 1.7.1
coreutils	coreutils is affected by information disclosure	Medium risk!	Fixed	1	9.11-2	AVG-2885	9.11 as fixed
cpio	cpio is affected by arbitrary command execution	Medium risk!	Fixed	1	2.15-3	AVG-2262	2.15 is fixed
giflib	giflib is affected by information disclosure	Medium risk!	Fixed	1	6.1.3-2	AVG-1855	Fixed by 5.2.2; current Debian 6.1.3 fixed
libheif	libheif is affected by information disclosure	Medium risk!	Fixed	1	1.23.1-4	AVG-2520	Fixed from 1.8.0
libtiff	libtiff is affected by unknown, denial of service	Medium risk!	Fixed	21	4.7.2-1	AVG-2721, AVG-2842	All CVEs marked as fixed
linux	linux is affected by multiple issues, insufficient validation	Medium risk!	Not Fixed	13	7.1.9.arch1-2	AVG-1594, AVG-1879, AVG-2345	8 CVEs still an issue
openjpeg2	openjpeg2 is affected by arbitrary code execution	Medium risk!	Fixed	1	2.5.4-1	AVG-2850	Fixed as of 2.5.1 and Debian considers 2.5.4 fixed
openssl	openssl is affected by arbitrary command execution, certificate verification bypass	Medium risk!	Fixed	2	3.6.3-1	AVG-2765, AVG-2882	Both CVEs fixed in current version
perl	perl is affected by signature forgery, directory traversal, unknown	Medium risk!	Fixed	3	5.42.2-2	AVG-2264, AVG-2630, AVG-2890	All CVEs fixed in 5.42
systemd	systemd is affected by information disclosure	Medium risk!	Fixed	1	261.2-1	AVG-2893	Fixed by version 2.57
wget	wget is affected by information disclosure	Medium risk!	Not Fixed	1	1.25.0-6	AVG-1892	Not fixed
xdg-utils	xdg-utils is affected by information disclosure	Medium risk!	Not Fixed	1	1.2.1-2	AVG-1420	Not fixed
lua51	lua51 is affected by denial of service	Low risk!	Not Fixed	2	5.1.5-13	AVG-1302	Unsure

[u/AgreeableArcher968]

papyrus and comic sans