Skip to content

libraries not fully handled #5840

Open
Open
libraries not fully handled#5840
Labels
bugSomething isn't working

Description

@EternalDreamer01
EternalDreamer01
opened on Jul 16, 2026

Description

Some libraries aren't fully handled, especially embedded ones.
Discovered after issue #5441

To reproduce

Steps to reproduce the behaviour (based on condensed-downloads):

1. Extract

Extract everything, to output into uncompressed/$filename use:

find . -type f -iname "*.tar.gz" -exec sh -c 'filename="$(printf "%s" "{}" | sed -r "s/\.tar\.gz//")"; mkdir -p "uncompressed/$filename" && cd "uncompressed/$filename" && tar xzvf "../.$(printf "%s" "{}")"' \;

Or, extract everything into the same directory ls | xargs -d"\n" -n 1 tar xzvf

2. Not fully handled libraries

The following libraries are not raised, you might use grep -aC 2 '<str>' <file>.

I sorted them into:

  1. Safe
  2. Might be unsafe
  3. Uncertain
  4. Additional not implemented libraries

The path represent the path to file when extracted with the method in 1. under test/condensed-downloads/uncompressed.
I added more context for potential safe version strings.

  • Note: I have removed eventual duplicates entries over multiple binaries.

A. Safe to implement

Version strings that seem safe and correct to implement:

  • apr subversion-libs_1.12.2-2_x86_64.ipk/usr/lib/libsvn_subr-1.so.0.0.0: 
     1.7.0
 APR-Util
  • Clang go-1.13.13-r0.apk/usr/lib/go/src/runtime/race/race_netbsd_amd64.syso: 
     clang version 5.0.1 (tags/RELEASE_501/final)
  • dbus dbus_1.8.22-0+deb8u1_amd64.deb/usr/bin/dbus-uuidgen: 
     1.8.22
 No memory
 Usage: %s [--ensure[=FILENAME]] [--get[=FILENAME]]
 D-Bus UUID Generator %s
  • Enscript enscript_1.6.5.90-3_amd64.deb/usr/bin/mkafmmap: 
     enscript
 1.6.5.90
  • expat subversion-libs_1.12.2-2_x86_64.ipk/usr/lib/libsvn_subr-1.so.0.0.0: 
     1.6.1
 Expat
  • freeradius freeradius-2.2.10-1.mga5.x86_64.rpm/usr/sbin/radmin: 
     radmin version 2.2.10
  • fribidi libfribidi0_0.19.6-3_amd64.deb/usr/lib/x86_64-linux-gnu/libfribidi.so.0.3.5: 
     (GNU FriBidi) 0.19.6
  • gawk gawk-5.1.1-5.fc38.x86_64.rpm/usr/libexec/awk/grcat: 
     {"type":"rpm","name":"gawk","version":"5.1.1-5.fc38","architecture":"x86_64","osCpe":"cpe:/o:fedoraproject:fedora:38"}
  • GCC: 
     libpcap-1.10.1-4.fc37.i686.rpm/usr/lib/libpcap.so.1.10.1: annobin gcc 12.1.1 20220628
 mutt-2.2.7-2.1.armv6hl.rpm/usr/bin/mutt: gcc version 12.2.1 20220830 [revision e927d1cf141f221c5a32574bde0913307e140984] (SUSE Linux)
 sylpheed-3.7.0-13.fc37.aarch64.rpm/usr/bin/sylpheed: running gcc 12.1.1 20220628
 sylpheed-3.7.0-13.fc37.ppc64le.rpm/usr/bin/sylpheed: running gcc 12.1.1 20220628
 mutt-patched_1.5.23-3_amd64.deb/usr/bin/mutt-patched: gcc version 4.9.2 (Debian 4.9.2-4)
 zziplib-utils-0.13.69-r2.apk/usr/bin/zzcat: GCC: (Alpine 8.3.0) 8.3.0
 zziplib-utils-0.13.69-r2.apk/usr/bin/zzcat: GCC: (Alpine 9.2.0) 9.2.0
 zsh-5.5.1-6.el8_1.2.x86_64.rpm/usr/lib64/zsh/5.5.1/zsh/cap.so: gcc 8.3.1 20190507
 lighttpd-1.4.54-2.fc31.x86_64.rpm/usr/sbin/lighttpd-angel: gcc 9.1.1 20190605
 libical-3.0.9.tgz/lib/libicalss_cxx.so.3.0.9: GCC: (nb3 20190319) 7.4.0
 kexec_2.0.16-2_x86_64.ipk/usr/sbin/kexec: GCC: (OpenWrt GCC 7.5.0 r11430-ecbbb373ed) 7.5.0
 graphicsmagick_1.3.35-1_x86_64.ipk/usr/lib/libGraphicsMagick.so.3.21.0: -I/builder/shared-workdir/build/sdk/staging_dir/target-x86_64_musl/usr/include -I/builder/shared-workdir/build/sdk/staging_dir/target-x86_64_musl/include -I/builder/shared-workdir/build/sdk/staging_dir/toolchain-x86_64_gcc-7.5.0_musl/usr/include
 twonky-x86-64-glibc-2.22-8.5.2.zip/twonkystarter: GCC: (crosstool-NG crosstool-ng-1.22.0) 5.2.0
  • GPG gnupg-1.4.23nb11.tgz/libexec/gnupg/gpgkeys_curl: 
     1.4.23
 gpgkeys_curl (GnuPG) %s
 GnuPG curl-shim
  • GpgME gpgme-1.16.0-1-aarch64.pkg.tar.xz/usr/lib/libgpgmepp.so.6.13.0: 
     1.16.0
 GpgME::Error(
  • GraphicsMagick: 
     GraphicsMagick-1.3.38-3.fc37.i686.rpm/usr/lib/GraphicsMagick-1.3.38/modules-Q16/coders/matte.so: {"type":"rpm","name":"GraphicsMagick","version":"1.3.38-3.fc37","architecture":"i386","osCpe":"cpe:/o:fedoraproject:fedora:37"}
 GraphicsMagick-1.3.38-3.fc37.i686.rpm/usr/lib/GraphicsMagick-1.3.38/modules-Q16/coders/matte.so: matte.so-1.3.38-3.fc37.i386.debug
 GraphicsMagick-1.3.38-3.fc37.aarch64.rpm/usr/lib64/libGraphicsMagickWand-Q16.so.2.9.7: {"type":"rpm","name":"GraphicsMagick","version":"1.3.38-3.fc37","architecture":"aarch64","osCpe":"cpe:/o:fedoraproject:fedora:37"}
  • Grub grub-common_2.02+dfsg1-20+deb10u1_arm64.deb/usr/sbin/grub-probe: 
     2.02+dfsg1-20+deb10u1
 GRUB
  • Guile guile-2.2-libs_2.2.7+1-9build3_amd64.deb/usr/lib/x86_64-linux-gnu/guile/2.2/ccache/texinfo.go: 
     Guile 2.2.7
  • Irssi irssi-0.8.16-4.mga5.x86_64.rpm/usr/lib64/irssi/modules/libirc_proxy.so: 
     0.8.16
 :%s 005 %s 
 MODE %s :+%s
 :%s 366 %s %s :End of /NAMES list.
 :%s 001 %s :Welcome to the Internet Relay Network %s!%s@proxy
 :%s 002 %s :Your host is irssi-proxy, running version %s
  • libbpg libbpg-0.9.8-alt1_1.x86_64.rpm/usr/bin/bpgview: 
     BPG Image Viewer version 0.9.8
  • libisc bind-libs_9.16.28-1_x86_64.ipk/usr/lib/libisc-9.16.28.so: 
     isc-timer
 ((manager->timers).head == ((void*)0))
 9.16.28
  • libpng: 
     thunderbird_52.8.0-1\~deb8u1_amd64.deb/usr\\lib\\thunderbird\\libxul.so: libpng version 1.6.26+apng - October 20, 2016
 openimageio-2.3.15.0-r1.apk/usr/lib/libOpenImageIO.so.2.3.15: libpng 1.6.37
  • libreoffice ghostscript-10.03.1-1-aarch64.pkg.tar.xz/usr/lib/libgs.so.10.03: 
     <office:document-meta xmlns:grddl="http://www.w3.org/2003/g/data-view#" xmlns:meta="urn:oasis:names:tc:opendocument:xmlns:meta:1.0" xmlns:ooo="http://openoffice.org/2004/office" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" office:version="1.3"><office:meta><meta:creation-date>2021-04-05T17:06:57.937137058</meta:creation-date><meta:generator>LibreOffice/7.0.1.2$OpenBSD_X86_64 LibreOffice_project/00$Build-2</meta:generator><dc:date>2021-04-06T17:14:51.409959656</dc:date><meta:editing-duration>PT20S</meta:editing-duration><meta:editing-cycles>1</meta:editing-cycles><meta:document-statistic meta:table-count="0" meta:image-count="0" meta:object-count="0" meta:page-count="1" meta:paragraph-count="0" meta:word-count="0" meta:character-count="0" meta:non-whitespace-character-count="0"/></office:meta></office:document-meta>
  • libxml2 libphp7.3-embed_7.3.31-1~deb10u1_amd64.deb/usr/lib/libphp7.3.so: 
     libXML support
 2.9.4
 libXML Compiled Version
  • Lua lua50_5.0.3-8_arm64.deb/usr/bin/luac50: 
     Lua 5.0.3
  • lxc liblxc-common_5.0.1-1+b1_arm64.deb/usr/libexec/lxc/lxc-monitord: 
     Out of memory setting new lxc path
 Out of memory setting new config filename
 5.0.1
  • pspp pspp-1.4.0-1.fc33.aarch64.rpm/usr/lib64/pspp/libpspp-core-1.4.0.so: 
     GNU pspp 1.4.0
 GNU PSPP 1.4.0
  • OpenSSL libsofia-sip-ua0_1.12.11+20110422.1-2_armel.deb/usr/lib/libsofia-sip-ua.so.0.6.0: 
     OpenSSL 1.0.1e 11 Feb 2013
  • Qt qt-3.3.8b-8.fc9.i386.rpm/usr/lib/qt-3.3/plugins/inputmethods/libqsimple.so: 
     pattern=QT_UCM_VERIFICATION_DATA
 version=3.3.8b
 flags=11
 buildkey=i686 Linux g++-4.* full-config
 QSimpleInputContext
  • radare2: 
     radare2-3.0.1-2.fc27.x86_64.rpm/usr/bin/radare2: Usage: r2 [-ACdfLMnNqStuvwzX] [-P patch] [-p prj] [-a arch] [-b bits] [-i file]
 radare2-3.0.1-2.fc27.x86_64.rpm/usr/bin/radare2:       [-s addr] [-B baddr] [-m maddr] [-c cmd] [-e k=v] file|pid|-|--|=
 radare2-3.0.1-2.fc27.x86_64.rpm/usr/bin/radare2: %s 3.0.1 %d @ linux-x86-%d git.%s
 radare2_3.2.1+dfsg-5build1_amd64.deb/usr/bin/r2agent: 3.2.1
  • sqlite subversion-libs_1.12.2-2_x86_64.ipk/usr/lib/libsvn_subr-1.so.0.0.0: 
     sqlite[S%d]: %s
 3.31.1
 SQLite compiled for %s, but running with %s
  • Sylpheed sylpheed-3.7.0-13.fc37.aarch64.rpm/usr/lib64/sylpheed/plugins/attachment_tool.so: 
     {"type":"rpm","name":"sylpheed","version":"3.7.0-13.fc37","architecture":"aarch64","osCpe":"cpe:/o:fedoraproject:fedora:37"}
  • Varnish: 
     varnish-7.7.3-r0.apk/usr/lib/varnish/vmods/libvmod_purge.so: Varnish 7.7.3
 varnish_6.5.1-1+deb11u3_amd64.deb/usr/lib/x86_64-linux-gnu/varnish/vmods/libvmod_purge.so: Varnish 6.5.1 1dae23376bb5ea7a6b8e9e4b9ed95cdc9469fb64
  • zlib: 
     libssh2-1.9.0nb1.tgz/lib/libssh2.so.1.0.1: 1.2.10
 glib2_2.58.3-5_x86_64.ipk/usr/lib/libgio-2.0.so.0.5800.3: 1.2.11
 ghostscript-10.03.1-1-aarch64.pkg.tar.xz/usr/lib/libgs.so.10.03: 1.3.1
 subversion-libs_1.12.2-2_x86_64.ipk/usr/lib/libsvn_subr-1.so.0.0.0: 1.2.11
 squashfs-4.5.1-3.1.aarch64.rpm/usr/bin/unsquashfs: 1.2.12
 libarchive-3.1.2-14.el7_7.x86_64.rpm/usr/lib64/libarchive.so.13.1.2: 1.2.7

B. Might be unsafe

Version strings that might be unsafe due to:

  • look like filepaths,
  • they might be difficult to associate with their product/binary/library
  • GIMP gimp_2.8.18-1+deb9u1_i386.deb/usr/lib/gimp/2.0/plug-ins/lcms: 
     /build/gimp-2hL3d5/gimp-2.8.18/./plug-ins/common/lcms.c:1081
  • Janus janus-gateway-1.1.0-1.1.armv6hl.rpm/usr/lib/janus/transports/libjanus_http.so.1.0.1: 
     libjanus_http.so.1.0.1-1.1.0-1.1.arm.debug
  • libpng: 
     libVNCServer-0.9.13.tgz/lib/libvncserver.so.0.9.13: 1.6.37
 ghostscript-10.03.1-1-aarch64.pkg.tar.xz/usr/lib/libgs.so.10.03: 1.6.43
 qt-3.3.8-10.fc9.x86_64.rpm/usr/lib64/qt-3.3/lib/libqt-mt.so.3.3.8: 1.2.22
 kodi-bin_17.1+dfsg1-3_amd64.deb/usr/lib/x86_64-linux-gnu/kodi/TexturePacker: 1.6.28
 poppler-0.82.0-r1.apk/usr/lib/libpoppler.so.92.0.0: 1.6.37
 netpbm_10.0-15.3+b2_amd64.deb/usr/bin/pnmtopng: 1.6.28
 gimp_2.8.18-1+deb9u1_i386.deb/usr/lib/gimp/2.0/plug-ins/file-png: 1.6.28
 gimp-2.6.12-1.fc15.x86_64.rpm/usr/lib64/gimp/2.0/plug-ins/file-mng: 1.2.46
  • lighttpd lighttpd-1.4.54-2.fc31.x86_64.rpm/usr/sbin/lighttpd-angel: 
     lighttpd-angel-1.4.54-2.fc31.x86_64.debug
  • linuxptp linuxptp_3.1.1-4+b2_amd64.deb/usr/sbin/hwstamp_ctl: 
     3.1.1
  • lldpd lldpd_1.0.3-1_x86_64.ipk/usr/lib/liblldpctl.so.4.8.0: 
     -iremap/builder/shared-workdir/build/sdk/build_dir/target-x86_64_musl/lldpd-1.0.3:lldpd-1.0.3
  • mutt mutt-2.2.7-2.1.armv6hl.rpm/usr/bin/mutt_pgpring: 
     mutt_pgpring-2.2.7-2.1.arm.debug
  • netatalk netatalk_3.1.13-1_x86_64.ipk/usr/lib/libatalk.so.18.0.0: 
     3.1.13
  • ntp ntp-4.2.8p15-3.fc33.x86_64.rpm/usr/sbin/ntptime: 
     ntptime-4.2.8p15-3.fc33.x86_64.debug
  • proftpd proftpd-1.3.8-0.4.rc4.el9.aarch64.rpm/usr/libexec/proftpd/mod_ban.so: 
     mod_ban.so-1.3.8-0.4.rc4.el9.aarch64.debug
  • PureFtpd pure-ftpd-1.0.51-1.2.aarch64.rpm/usr/sbin/pure-uploadscript: 
     pure-uploadscript-1.0.51-1.2.aarch64.debug
  • rsvg librsvg2-2.50.7-2.fc35.aarch64.rpm/usr/lib64/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-svg.so: 
     libpixbufloader-svg.so-2.50.7-2.fc35.aarch64.debug
  • ruby ruby-libs-3.4.2-23.fc43.aarch64.rpm/usr/lib64/ruby/enc/encdb.so: 
     encdb.so-3.4.2-23.fc43.aarch64.debug
  • tcpdump tcpdump-4.9.1-1.fc27.x86_64.rpm/usr/sbin/tcpslice: 
     tcpslice-4.9.1-1.fc27.x86_64.debug
  • unixodbc unixODBC-2.3.11-2.2.armv6hl.rpm/usr/lib/unixODBC/libnn.so.1.0.0: 
     libnn.so.1.0.0-2.3.11-2.2.arm.debug
  • zlib: 
     libneon27_0.30.1-1_amd64.deb/usr/lib/libneon.so.27.3.1: 1.2.8
 libspice-server1_0.12.5-1+deb8u5_amd64.deb/usr/lib/x86_64-linux-gnu/libspice-server.so.1.9.0: 1.2.8
 uwsgi-2.0.28-4.fc42.aarch64.rpm/usr/bin/uwsgi: 1.3.1.zlib-ng
 mpd_0.22.6-1+b1_amd64.deb/usr/bin/mpd: 1.2.11
 rsync_3.1.3-2_x86_64.ipk/usr/bin/rsync: 1.2.11
 libarchive_3.4.2-1_x86_64.ipk/usr/lib/libarchive.so.13.4.2: 1.2.11
 netpbm_10.0-15.3+b2_amd64.deb/usr/bin/pnmtopng: 1.2.8
 libhtp-0.5.25-r0.apk/usr/lib/libhtp.so.2.0.0: 1.2.11

C. Uncertain

libxml2-2.9.1-6.el7.5.x86_64.rpm/usr/lib64/libxml2.so.2.9.1: 1.2.7 # Possibly zlib
libxml2-2.9.6-1.fc26.x86_64.rpm/usr/lib64/libxml2.so.2.9.6: 1.2.11 # Possibly zlib
libarchive_3.4.2-1_x86_64.ipk/usr/lib/libarchive.so.13.4.2: 5.2.5 # Possibly xz
curl-7.77.0.tgz/lib/libcurl.so.4.7.0: 1.2.0.4
curl-7.77.0.tgz/lib/libcurl.so.4.7.0: 1.2.10 # Possibly zlib
curl-7.77.0.tgz/lib/libcurl.so.4.7.0: 2.3.1
gimp-2.6.12-1.fc15.x86_64.rpm/usr/lib64/gimp/2.0/plug-ins/map-object: Version 1.2.0, July 16 1998
gimp_2.8.18-1+deb9u1_i386.deb/usr/lib/gimp/2.0/plug-ins/file-png: 1.3.4 - 03 September 2002

Additional

  • Java / JDK: 
     jackson-databind-2.9.10.6.jar/META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.xml: <javac.src.version>1.7</javac.src.version>
 commons-compress-1.16.1.jar/META-INF/maven/org.apache.commons/commons-compress/pom.xml: <maven.compiler.source>1.7</maven.compiler.source>
  • libntlm: 
     fetchmail-6.4.1-r1.apk/usr/bin/fetchmail: libntlm version 0.21
  • mesa 
     thunderbird_52.8.0-1~deb8u1_amd64.deb/usr\\lib\\thunderbird\\libxul.so: Mesa 7.10.3

Version/platform info

Version of CVE-bin-tool( e.g. output of cve-bin-tool --version): 3.4.1
Installed from pypi or github? GitHub
Operating system: Linux/Windows (other platforms are unsupported but feel free to report issues anyhow)

  • On Linux (or Windows Subsystem for Linux) you can run uname -a:
  • On Windows you can run systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
    Python version (e.g. python3 --version):
    Running in any particular CI environment we should know about? (e.g. Github Actions)

Anything else?

The scripts I have used to find these:

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions